www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
301 Moved Permanently 0 B URL HTTP/1.1 www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
GET /dead-cells-the-queen-and-the-sea-codex/ HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Sun, 05 Feb 2023 06:37:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 05 Feb 2023 07:37:21 GMT
Location: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6HULFHqVXZYOm8OMsMMFhAlrH8vNXZvaz2VxslY0a1N0eBVNGmwBROhjNjDV4DQfruo0bOGK%2FLhn%2FDL6NUKZBQ3MKxONG9bZR%2BMJ564aa5UlvBQIIbkUeCsM%2BNtTgtLUCJNFAKUIg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7949a3141d68b4ee-OSL
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c21ba65e44ac95470c314e068e49a9eb
17a13b13738993d889d4afa3d848dc63bf6eba64
9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66"
Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10715
Expires: Sun, 05 Feb 2023 09:35:57 GMT
Date: Sun, 05 Feb 2023 06:37:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1cdc095521e9ee2606059be447d1fdd5
02b5d0a5b5823e2338daf7e144700babe2a213af
8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7574
Expires: Sun, 05 Feb 2023 08:43:36 GMT
Date: Sun, 05 Feb 2023 06:37:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fb7b6b46e708ad73eaaa3c21e74569ae
950663c025acad81556af5aa3022ecc9d55097fe
763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763F58B9FB838378C92033B59907B036F4C33081F5103D9BCC2CA2A8DE500D64"
Last-Modified: Sat, 04 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18396
Expires: Sun, 05 Feb 2023 11:43:58 GMT
Date: Sun, 05 Feb 2023 06:37:22 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 05 Feb 2023 06:33:54 GMT
content-type: application/json
age: 208
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash 2410dbce834f4a5226006572a18739aa
aaab82f4e63834a9174b8e901f292531e49265ef
4260da8ff6f6cf9003611d83a6686c3a0d8f7356872f5b0516364a1bca71b5e6
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6058
Cache-Control: max-age=122640
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:22 GMT
Etag: "63de7308-118"
Expires: Mon, 06 Feb 2023 16:41:22 GMT
Last-Modified: Sat, 04 Feb 2023 15:00:24 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 280
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: nmCqPwubIbH/1EWsvmsFdJmWqwEuJCu7LdEqRF2Bb4apk/22zeDtSJ8LSrscFvY+RtOHa93kvY5FgQm9i66Glw==
x-amz-request-id: 3Y54DVF5RGJF7J99
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 05 Feb 2023 05:53:09 GMT
age: 2653
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/css/widget.css?ver=1.5.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/css/widget.css?ver=1.5.5
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/css/widget.css?ver=1.5.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
content-length: 0
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
vary: Accept-Encoding
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MUllCSR%2FNthHbLSpb1qQRB8Evsfeyok%2BiAJMSkKVmG7AHck5KJAlBQe%2FL9wTjoI%2Fka%2FvcfZmSeJ9IBkbv1g8ErWlzWd5wsvFW9j%2B%2FvOwKZcQOhSb1vafnjp8nvWqHguTx9R06DHIVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3186d56b512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/bbpress.css?ver=20160930
200 OK 52 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/bbpress.css?ver=20160930
IP
File type ASCII text, with very long lines (20130)
Hash 7b84cbbf987e4cd4288eafef3b1072bc
6a812d8084cdcdfa01774ffd12826594e6f47b73
3cbb0578086b5acb1724979614ef87e069ed5a7fe8014cea1142ad0d0f515a4f
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/bbpress.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 20 Jan 2024 06:34:58 GMT
etag: W/"62d880ff-57f3"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1382546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wlxrMFmY%2FD%2Bk8wUrYUMpRgrv4XcLd2zsq07%2BXP%2FAOIex3gZJnOXVjW8r%2FIcGAyeES0gabp24E%2FJIDjs5H2kjveTshD7l5YJ1Pw21luY7aEHyBnjPetlVt24MkUGze1PSttus2E5DOw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d64b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 98be7fe21d059e46146a43d20c4eea92
1ec58129fea75085588be7b8baec05b0874b5274
7bb2eb5ffcd88a3b6ba7b210bdbcd4469134c9708f06befb6c616beebf8dae46
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/jquery.fancybox.css?ver=20150401
200 OK 60 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/jquery.fancybox.css?ver=20150401
IP
File type ASCII text, with very long lines (3437), with no line terminators
Hash a508ba0696ce81925c0a7e0faa0ee3b3
55f52d49c32758c6d5ec5801b38238ccaa481e16
e24da8e2c3ab1d8ab550c707b0da25ae2d8dadf0d07fdd96c3b7fe2c1a01d320
GET /wp-content/themes/skidrowcodex-main/css/jquery.fancybox.css?ver=20150401 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:36:01 GMT
etag: W/"62d880ff-d6d"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455282
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=04%2FN4p%2FZlGDgtNWgGudzZDHvhW%2BLnhJl7gGOHq5GevbW%2F%2B82IhPqEZBLiqPDC%2BYsLYi6R6MK0zWkdpwS%2FhHNKg8ROfZ93bZWy3vaEyPhREQrGbOxFZbHW%2FVL7i2eqJfLBK0C4JqbMA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d76b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/css/media-views.min.css
200 OK 13 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/css/media-views.min.css
IP
File type ASCII text, with very long lines (43713)
Hash f15d7f8d633281dfd9ae733690c553db
c403e2b15a7ae9d9443fd3ebd5cfb1819dbbb35f
44c135b9e7b59b8205f06571c7f5dd3cc68519898c25f09778906e5714363534
GET /wp-includes/css/media-views.min.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 25 May 2022 22:03:40 GMT
cache-control: public, max-age=31536000
expires: Tue, 04 Jul 2023 17:48:48 GMT
etag: W/"628ea7bc-b7a8"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 18622114
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JU1Jh2O%2F2VJCzOPYYKMG2t4P9AiGMkn4X4K4pg3NnIsLn4uL2JM1fclaZPwaC6LpDp%2FkwrB%2BSia7z77bDbWRi13ZFDMlSuqR4Amw6QjBbM0zMcpP80YJUIm7ZMbTn0GFudD5h8RcJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3188d97b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/imgareaselect/imgareaselect.css?ver=0.9.8
200 OK 500 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/imgareaselect/imgareaselect.css?ver=0.9.8
IP
Hash b1d15030aa148c6f3c22d7b4f4731e47
6e1f32518b3f0d9fefc00ddd66700c53fac6c7c4
f6a8fd90886dfb60bd58b636a0d8b6e3775ca31b429ad0dbf7432110b4f34650
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/imgareaselect/imgareaselect.css?ver=0.9.8 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:08 GMT
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:25:15 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455928
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=izYRDXkYRviGXO%2FYzBHLwzhRDNUW3QKZj3E4lM0wmrDoL5vifQDpWtmDOsNn9KzW3V9Iz%2FC7supsjK44alXc7H3jQeVTMsTaBikv6eHIgH5%2FrXFxapm0x9%2BbMU6xiRZiuXuWikbR0g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3188d98b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/member.min.css?ver=11.0.0
200 OK 841 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/member.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (1898), with no line terminators
Hash 45fc238616e3e1a7783831313d0e4d79
c61c9077ec6c95197b2dbdc6fe155621fd5aaae1
6848b706730bd1fc1c798384296751b3ce4030ede10afcb4d650716e26163b99
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-members/css/blocks/member.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-76a"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zyk0P5pxR%2F64P9PfKkeS9KNhfxL9vS3HNbR1073u%2BpQeOGijbNjyea6JQrxka%2BvjON32tNHuMUwT5LBYeAAEO1iZVD8YU%2FLXTxHkeB0W8karGt0xTqLN3QIkf7liTCllo4RatwnuFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d23b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/shadowbox.css?ver=20160930
200 OK 901 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/shadowbox.css?ver=20160930
IP
File type ASCII text, with CR line terminators
Hash 5513567ff0d1d92d0f2fe46c1384fc02
72258e53d2ffaccbd5b4aed571ee5e8597f058b5
6f8017919d7e1484a7beb7cd0a4377612a0840d02cb3c6ca87ca810a4b2d47c9
GET /wp-content/themes/skidrowcodex-main/css/shadowbox.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:25:15 GMT
etag: W/"62d880ff-7f9"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455928
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=esQHxBqkedhmA0nWUN0u5G%2FjvXU1cLDns4UbV%2BToqn0UR3ooMOBFRvEsU2%2BKjdGTI6UMXUNIemeORnpwsYpXiHMeu3KYH6XE5nIR0h8Lj%2BeFpOHn8YcUw7lzsxgIfZ7hCUOce5YP1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3186d57b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=11.0.0
200 OK 10 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=11.0.0
IP
File type ASCII text, with very long lines (857)
Hash a0cca93de0e49119da393eaa884a6c8d
cbb0dbc570a0b3172d6939e433cd95339dfc9380
8fe13f5be79d297741bb32409f701292639334dab3e5cb210a550274712d43b4
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"62d880ff-e393"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tYoz9Pg6RPa%2B%2B7isJuJZp5mAq9D4S5VAuKRYt4FtpxdlceJEayGYyULV4EpqvvCBz5Blc0lJoWWCO58krYK0ESTuYJdta6eyy0co9BFC2WqoER2EoJGZ67UWCjzCpZrlhtFUwpaPvA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3185d4db512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/wp-rocket/assets/js/heartbeat.js?ver=3.12.5.2
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/wp-rocket/assets/js/heartbeat.js?ver=3.12.5.2
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/wp-rocket/assets/js/heartbeat.js?ver=3.12.5.2 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
x-accel-version: 0.01
last-modified: Fri, 27 Jan 2023 08:44:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 27 Jan 2024 08:47:19 GMT
vary: Accept-Encoding
x-powered-by: PleskLin
cf-cache-status: HIT
age: 769805
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u7hdHqUMDuDoF8UAq4upGI6NROXq6jwsrywEtE7qDM%2FnGBnoN3S%2FfPitwI8v%2B2P5js4PFossuCIJKa6uR2GHMGsYXLsS6sgJF1qYeQWWVFRJFIeyKLgBQ5boq1iyv7Qg1rE4ynrfUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a0ee2b512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/media-views.min.js
200 OK 28 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/js/media-views.min.js
IP
File type ASCII text, with very long lines (65501)
Hash 85de406ef500ab4af1e22f9cc3bba6bf
d02930214133b3c6021da710b3d2906ef7700e46
679294301ac79b366ee92e1d4dffb870f8c67dd14861de54f807585a9a366133
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/media-views.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:49 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 19:54:19 GMT
etag: W/"6381e8bd-1b2a3"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2457784
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4AXI8vXQ%2BAZjQShnOnhoWWf%2F%2BrgxjGEVHrVAoKaY5fTXzXYk5tigrmSh9FbPqfAJWfdLoz7I4Pwuzkumhe%2BEKLPXJBKfhvF2hbbAuoxos13gXFOtEguHT2u5S%2BLIZtWUcdOzawr5ag%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319fed3b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/media-audiovideo.min.js
200 OK 4.2 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/js/media-audiovideo.min.js
IP
File type ASCII text, with very long lines (12929)
Hash c8b73e0be62b07d5e44c0349a5c7bb1a
664bf405490d47b8eca33782bd3dd8567764a338
5df3627251c858a03d0ca75dc2c827c7b4390e5d0568291f4b639e67c5d8b791
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/media-audiovideo.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 25 May 2022 22:03:40 GMT
cache-control: public, max-age=31536000
expires: Tue, 04 Jul 2023 17:33:08 GMT
etag: W/"628ea7bc-32a4"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 18623054
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pW5HQSjrT9Xd4UPPoFHbtCHfXaH%2BYwkU4B7hPPcDIAXNLtu6MZ%2F904n3E0n7oBTMp2TUWn2NIw7KIFtiSEjEpHyeKFNxMoW8x7OA%2BwH1dEfdIv79sUAMkNUGl5NfneTb%2B1G8RfTpYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a319fed5b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/vcfixes.css?ver=20150401
200 OK 3.3 MB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/vcfixes.css?ver=20150401
IP
File type ASCII text, with very long lines (683)
Size 3.3 MB (3256725 bytes)
Hash fbc36fb1ded2fcf6f693ecdaf51650ae
ef59085d066dbfa614c5a6713f67512b83cbbaca
d683cf6c39d1336157b2ad80c2a9e76135cf02e0a14540ceab3846c7de7f156b
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/vcfixes.css?ver=20150401 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 22:15:01 GMT
etag: W/"5f6754da-2908"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21025341
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=un4qF6RI9c78gOtNFsSolM0OHmnt75EQQGUtVhmPXQYt3E6yYHm%2FrDp3A9tnBTn%2Fc5mHufYxc0IkbYd8M1j9xKCY0Gsg1BZlIya97sbjNT0bHJQHj3Yz5kgyu96PBE5ivx9a0nWgiw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3187d86b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/clanwars.css?ver=20160930
200 OK 5.2 MB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/clanwars.css?ver=20160930
IP
Size 5.2 MB (5161734 bytes)
Hash ee8adada11c2fca9d5064587009eafef
d399665532fd04382a3d8058c1278a5d72bd160e
638c5e9306912b1e6225936ff58b20031c76078ce43f999a19a43e3740149887
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/clanwars.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:25:15 GMT
etag: W/"62d880ff-3426"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455928
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NPrJA%2FkE%2BWmBY5PyQqonioYjrv3BJKtic9eqUUm46fU6PLVjYiaKODtJW9UiVxV9SfWMafR8ewsIY7t7NatOaOo%2B%2FDU8llHhPMbv%2BvpRubkF8VqQ7ihOt93SKLyiui%2BxnYCrSJJoiw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d72b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
200 OK 54 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
IP
File type ASCII text, with very long lines (829)
Hash af6a8e08d3d49b800de3ce091edae49a
95562cb1c350f968fd8e4e6a36a2993d2254bc7e
b77c0f78e3699a6e075c0a0e88fa5abfbeba497846cb0f476cd442bcf9abe06a
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
etag: W/"62d880ff-21d5c"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8mSw6GaibxakaSbwwLh1YolC7He69EWYeHHN37k%2BFJcM4OuNllv8A27jRj1Gk9XMI6Hc1qiMN4UT4F%2BmK%2F7JVLaxf6P55LIqzVsCevpsqvKKTt2JC8q%2FlD1FJ3N2g2ScY2EhoaxrZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d63b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/css/buttons.min.css
200 OK 5.1 MB URL HTTP/2 www.skidrowcodex.net/wp-includes/css/buttons.min.css
IP
File type ASCII text, with very long lines (5819)
Size 5.1 MB (5078890 bytes)
Hash 08b3309d20bbfab3caa8181479a3bac4
665dd8a8e9d8e33bcfbdc7c2a882341a5401724e
0b70c01c3a35210a9f6787e62784759184f790182c42ac0de7be2da9fbd548c1
GET /wp-includes/css/buttons.min.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:08 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
etag: W/"62d88100-16de"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LNII%2FKO%2BoTtlNJuAWp%2FDPRzp7f88yfbjGYfPBQA0qKKOdGnwBR3RCBg7Lo1dCi5zYZ8W%2Bhu39q9Opf7LfcGg8PpTPLg0s0E%2F2C6md2A2tzlu9boUqSc2n3sOjCyMUH3XyDSZR71vvw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d89b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/jquery.bxslider.css?ver=20150401
200 OK 36 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/jquery.bxslider.css?ver=20150401
IP
Hash 80229f0205142df9445d03bbea76efd6
ec72daa1992d9b94b1d7d935a1369fc7f6a65bca
291d5f5f41c8565e13931b7bcb82d58da75735c046c1877169e7add1b12f04c7
GET /wp-content/themes/skidrowcodex-main/css/jquery.bxslider.css?ver=20150401 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:36 GMT
etag: W/"5f6754da-1eae"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OILoZODm6DmD5DRoPSGYuyLfwMO97iuDJ2BsE5ZmbbPPJLjD0e5MNE%2Fhc9lXrPsoILU0HcpHrHw4cHvVbh%2BGKcPDMUduy6iPVacqXFCxzC6fYSH%2F93cWVwmun5nVy7USlDVln3KIEA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3187d7eb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7704
Expires: Sun, 05 Feb 2023 08:45:47 GMT
Date: Sun, 05 Feb 2023 06:37:23 GMT
Connection: keep-alive
www.google.com/recaptcha/api.js?onload=gglcptch_onload_callback&render=explicit&ver=1.70
200 OK 583 B URL HTTP/2 www.google.com/recaptcha/api.js?onload=gglcptch_onload_callback&render=explicit&ver=1.70
IP
File type ASCII text, with very long lines (919), with no line terminators
Hash 6367572d91cf501867c5b6641ff41dc0
c3b71afd5b7a44fb02f4a9ad759e259914cb62b8
e73936b9f5b60e4ab24eef9c5711799fc3bbde2c94c10e7541fadd60d536bb6e
GET /recaptcha/api.js?onload=gglcptch_onload_callback&render=explicit&ver=1.70 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Sun, 05 Feb 2023 06:37:23 GMT
date: Sun, 05 Feb 2023 06:37:23 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 05 Feb 2023 06:07:20 GMT
age: 1803
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c7d887fc3e3b7a68b7872c76802085c0
eb26f820776e7d87a00489eb14f918e5f6945835
915e873e95d8f0276f4763e5596b03cac487f6f8a36c65577c6622fc8560d929
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: vrKamKsQdowFFewOlHycgw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: k4YjMNFz657+/QPssyMOScl0IrE=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7d0ec8eb2571d3e4ea422047836d9667
7f16cc5af7444bda43562854715126ae5895eff6
f6a9e3806e892f209f965b8817411866ee875254ecbfb82c07fbe1aafc1af5ea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A9E3806E892F209F965B8817411866EE875254ECBFB82C07FBE1AAFC1AF5EA"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18391
Expires: Sun, 05 Feb 2023 11:43:55 GMT
Date: Sun, 05 Feb 2023 06:37:24 GMT
Connection: keep-alive
www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/js/jquery.animate-enhanced.min.js
200 OK 3.8 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/js/jquery.animate-enhanced.min.js
IP
File type ASCII text, with very long lines (551)
Hash ba26ec919f90d8004f614756d1e4c0ed
8f585516ab33902fb74b20f6b175f9114e0f30fb
37e41718814d61af69a27e164702afe597d14982044ca1cfd08f752b2ec4813b
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/responsive-full-width-background-slider/js/jquery.animate-enhanced.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:47 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 22:15:02 GMT
etag: W/"5f6754d7-2024"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21025340
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gRf0KygF6UsUCrLFtV1c9Kbphkw3yPgGqQX0Dz9xl7hYp6A1%2Byq78z2YaiTwx2LG9hS0PHtquSezO9NW8zlFI09JkVoNum3UZhmGjFXTBVmP63v8YPWnXu7K2KfPOL8SrHA2RuWumQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3198e5cb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/css/style.basic.css?ver=4.11
200 OK 7.7 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/css/style.basic.css?ver=4.11
IP
File type ASCII text, with CRLF line terminators
Hash 5d8380932bc1297d980d3860345563a3
98cbdbcb1f55f53d597ee98830b92fb524158e9c
ecfdf910b0ff9cb35d952e100a4b524c332ba2584fb5ebf100d509de63bdb9de
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/ajax-search-lite/css/style.basic.css?ver=4.11 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:19 GMT
etag: W/"63bdde36-4cae"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191144
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DCgz5XvzqMwmzF%2Fx%2Bzn4tu7c%2BRbu3i6kaWg6DVX2tvm5cxWXfLLnzHf1weCO8m%2FDSeadimJD7QkahHY2v3bZDfn%2BwoInwqIT2%2FVKF0Xyck%2F2%2BkZTvNdsJRmkvu6Y9qQmLnlxkaFyow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3188d99b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7d0ec8eb2571d3e4ea422047836d9667
7f16cc5af7444bda43562854715126ae5895eff6
f6a9e3806e892f209f965b8817411866ee875254ecbfb82c07fbe1aafc1af5ea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A9E3806E892F209F965B8817411866EE875254ECBFB82C07FBE1AAFC1AF5EA"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20033
Expires: Sun, 05 Feb 2023 12:11:17 GMT
Date: Sun, 05 Feb 2023 06:37:24 GMT
Connection: keep-alive
colognenobilityfrost.com/9e/55/c2/9e55c24c07205b6a363c94f4ff46ad27.js
200 OK 13 kB URL HTTP/1.1 colognenobilityfrost.com/9e/55/c2/9e55c24c07205b6a363c94f4ff46ad27.js
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with very long lines (37161), with no line terminators
Hash d0622b8ccfadb88d67f77949a97e9925
7571aaf2e5c329c5afeb68c3c7d05465163a5a48
6a137cd411ba0f1da05a6fabe9e6ce06b52cc25509fa301a4d95b13fc4667ecb
GET /9e/55/c2/9e55c24c07205b6a363c94f4ff46ad27.js HTTP/1.1
Host: colognenobilityfrost.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:24 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e8596ebdfa1425915d30444dd07f765d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
colognenobilityfrost.com/2a/a0/d7/2aa0d74e87039503a470d3942c5f7ea4.js
200 OK 21 kB URL HTTP/1.1 colognenobilityfrost.com/2a/a0/d7/2aa0d74e87039503a470d3942c5f7ea4.js
IP
ASN #39572 DataWeb Global Group B.V.
File type HTML document, ASCII text, with very long lines (60145), with no line terminators
Hash 6c0c3f0fe8f40c91db74e673097c33a0
4ada5372934786b377b422727bcefaa13275b1d2
adea2d20cbbf68863c723f4246f48c5dc8cc0fac95e5b076bb32a7bdf4e8302d
GET /2a/a0/d7/2aa0d74e87039503a470d3942c5f7ea4.js HTTP/1.1
Host: colognenobilityfrost.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:24 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e40adb5e7b2751c781eb9aff1d2c52ab
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/animate.css?ver=20150401
200 OK 391 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/animate.css?ver=20150401
IP
File type ASCII text, with very long lines (53186)
Size 391 kB (390857 bytes)
Hash 9e7f4e94d5ba7ae2b0151f650e077723
64536f6a686f3fa7a8b97c1009405a6f70f4a2e1
2c994f0fcdb86bb2efc03b4ac2df8915fdb0de67305042e7669f618cdc35a2a9
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/animate.css?ver=20150401 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:25:15 GMT
etag: W/"62d880ff-d063"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455928
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ok5RfXVKAJTsFfsgwo74%2BTWJFdxZ4KD4w3c2EPg16vAT2sCZOlcJfTBGCbxc8II0A%2F0DRktGQPQGo9Xi69y3pMsonTSUMpPnzc5j%2BDepOME3F7Kx1cLGvUq%2BmjAsY0QbfwIA8UyqMg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d84b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/dots.png
200 OK 977 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/dots.png
IP
File type PNG image data, 6 x 6, 8-bit/color RGBA, interlaced\012- data
Hash b4182163c3a6206ac2b16047c9c5728c
dfe78be5b52f41b77559972c0910f55ea0cd012a
941a6bc0a17c76ca67ecf18377953295380b4e01d544f5e6650d1c7df5d7bfe3
GET /wp-content/themes/skidrowcodex-main/img/dots.png HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: image/png
content-length: 977
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=16070400
expires: Tue, 02 May 2023 20:49:06 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2886364
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vHTiM%2FpvRqsuDnTR%2FLjPemedn3v3KIF1e4lcQq6NSXcvWnY4U5afNHQMLmHAPvK5mndlHYbVTqws0ht%2BjYxVD1mZQbECFAKQCe2gKRpdeQTyHXS63syh5P4TeJEMVPXaXCtOeGRQRw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3243d8ab512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/groups.min.css?ver=11.0.0
200 OK 24 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/groups.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (3457), with no line terminators
Hash a64713e47893f7d63170778d4a0355b4
afde9e0e03c41b0f391cfbec7690a76297d032df
f6cc22d25c7738e861df3a7f23ba88f0b09c861ab014223fa53cac1911186b76
GET /wp-content/plugins/buddypress/bp-groups/css/blocks/groups.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-d81"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P9DHIjPh5ZKDKZmBs5XVpkb3wahdMWJHumNxvW70Z5lKH0f4NNL3nHII%2BuTttsdtHLOLilPtRumeOCxxOhlIhE6rsksssxBXQ%2F6%2BIWVBlG7M9ri3FUXjCGRpmYvBuU0BtmYzy4uxTA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3184d46b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/tooltip.css?ver=20160930
200 OK 9.6 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/tooltip.css?ver=20160930
IP
Hash 23067886aee4d3b2e06ba4cc49bbf977
1131ad38ae26efed90935bc45a728725eeea0aef
9fc8c814afe0f8d9d6414ff3dd8523cd79399fa43d3bd622dd8b09794435cc1f
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/tooltip.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
etag: W/"62d880ff-8a2"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2Bi03RpfXLSqo1Obzqb%2FHOFP%2F3x0Kej29Ikn5QgbvBgGnBNiba2coyqGY7Rir8qYlU0F7ul947mUyi1cE7R06Te%2Fy1Gwuxdi%2F5X3WCTNS%2Fw7lo32FsmLtu535%2BTmRyH2a%2FHSUtpdLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3186d60b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/tip2.png
200 OK 1.5 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/tip2.png
IP
File type PNG image data, 22 x 17, 8-bit/color RGBA, non-interlaced\012- data
Hash a4fc2c7b8edaccfa51b3e4f868629561
7e57dc0a0181425e5e057a7c9b0cad0b4b330e5b
c953c054e31937a34242e5cd9616f27b52bceb547b1a872b04d600e6c4560b26
GET /wp-content/themes/skidrowcodex-main/img/tip2.png HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/tooltip.css?ver=20160930
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: image/png
content-length: 1490
last-modified: Tue, 31 Jan 2023 06:55:07 GMT
cache-control: public, max-age=16070400
expires: Thu, 01 Jun 2023 22:31:25 GMT
etag: "63d8bb4b-5d2"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 288359
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c5YgBZDi%2BbYdVqXNljGbYJ5q5a0j91SY48TTcssTgCscb91U%2BWHrIBTTrjcfp%2B3aC4h0W23SsrEuajEeJoIc%2BN7StA2nci%2FHYjSoLQv4H8yfn9z3NDxtBzVXOb4EGXz1rPGKtkBIig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3244d9ab512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/ticker_bg.jpg
200 OK 6.0 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/ticker_bg.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1170x35, components 3\012- data
Hash 94038b94f5429ac15e33a18afb5095bc
0866853c03bd768ef298f06ece3f3d3c516146d1
f2881f0e963bb5d4d3a598c589943bc451d0d3723035e870fb7f91845fd44f6d
GET /wp-content/themes/skidrowcodex-main/img/ticker_bg.jpg HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: image/jpeg
content-length: 6019
last-modified: Tue, 31 Jan 2023 06:55:07 GMT
cache-control: public, max-age=16070400
expires: Thu, 01 Jun 2023 23:19:07 GMT
etag: "63d8bb4b-1783"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 285497
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c4eTSYauPPUiEkG3nN7v0QSaiXD%2FbH%2FyDUl%2B%2F5uFUJKMg6n55A6uej4O9X5gxU5rd5Vfv7TUU%2BFsCcLP4LCzGPz5YzoioSyUcwVEMp98vbgb%2F4VttZPXr2Geo3bz5JQdCgDcTSdUQA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3244d9cb512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/members.min.css?ver=11.0.0
200 OK 5.7 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/members.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (3917), with no line terminators
Hash dc3b0e9a20dfe2c732ce7382910ab65b
573fc4382834dbee2b982926dd95c6c23123ffa8
02ed694c4210aecbe79f36e286522a237df56695cd2701504111bb08a3b31617
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-members/css/blocks/members.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-f4d"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HXeGYQVMf5928xM7UZKKJO9WQtgqmneAbB4g8GtQG5ZAaA9g31RIZTBrvf444Eev1zeQFUn5VvOZqDzsWNN70iBAEBKBCJF0KRD6zAERdqmNENwukACf2tKqjdp5tPPu5hUIUZKAeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d27b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/dark_wall.jpg
200 OK 28 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/dark_wall.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 300x299, components 3\012- data
Hash ea37dc947a83753b5f364f9bb8a84bc9
0f07a6af7aab2dc4762d22edada7b933036b36a0
7eb115351100f9724ea804954b8d3c3bde3e515fd698cca4bc930dd6101751af
GET /wp-content/themes/skidrowcodex-main/img/dark_wall.jpg HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: image/jpeg
content-length: 28089
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=16070400
expires: Wed, 01 Mar 2023 17:34:34 GMT
etag: "62d880ff-6db9"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 8254907
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uIcedH7XuZu3sYlU7rOnSC47%2BKhbT5m3ynqlKF7azS5aEF3m13ZfVqz9%2Fso0MqORzd7Sb26BXWOCFSv0gEIySIuiB2uELWWuWpaxdfIOxSTkBmA6%2FbLUKa7Gl939sbWej4cauQvl3w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3245dabb512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/fontawesome6/webfonts/fa-solid-900.woff2
200 OK 154 kB URL HTTP/2 www.skidrowcodex.net/fontawesome6/webfonts/fa-solid-900.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 154228, version 769.768\012- data
Size 154 kB (154228 bytes)
Hash 55b416a8df21f9f987aa352f10d1343b
2717f3f58271f2f2e6120d9937c7227002656d34
d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73
Analyzer Verdict Alert fortinet Malware
GET /fontawesome6/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.skidrowcodex.net/fontawesome6/css/all.css?ver=1.0.0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: font/woff2
content-length: 154228
last-modified: Tue, 31 Jan 2023 06:54:54 GMT
cache-control: max-age=16070400
expires: Fri, 03 Mar 2023 21:45:23 GMT
etag: "63d8bb3e-25a74"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 291121
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4KDfjXnOcTAw5kAWAWKMoKEzcmJMTu69KTytAdc%2BEBC2z9R1IEQLBpD6%2BFG5ICXBa%2BQFHOmkucEE15SEBzBDtKohvvCz8tCUQ0c0Rwujd3U9yFyMXM1tVv6c4JEfEdHhejzpuSrk5g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3246db7b512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/dynamic-groups.min.css?ver=11.0.0
200 OK 992 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/dynamic-groups.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (621), with no line terminators
Hash 799a8eef313575e171d6dd16783dab76
d36f7c99f8f3171c2e731a22e06de9d6a83579f7
0b9b7b59bd7ab2f466c7d14fb99a265d8ee2e365ec4c66c189de5eebd0601558
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-groups/css/blocks/dynamic-groups.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lA16G%2FhOKk%2BVEmkqraj5ClhYeQOv1hSGkl%2BLZwsdDq2B%2F1h9cjCIvbDU7z1FCwvD1ZBTpAkazsxP2qV%2BQeRuRdHV2BtMuT3nypGIShgF3m%2Bv7c0XjgemGOJDymnif%2Feyi2D9iFiRVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3184d48b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/fontawesome6/webfonts/fa-brands-400.woff2
200 OK 106 kB URL HTTP/2 www.skidrowcodex.net/fontawesome6/webfonts/fa-brands-400.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 105536, version 769.768\012- data
Size 106 kB (105536 bytes)
Hash cd2b4095e9ce66cde642c3502a4022d9
a280ecdddd14695fad22599301ab03adfe5224c0
404c746c8f7e3f9b7611a8f23d908c1a32a5c972236b9d89bb68b05d9bf4b905
Analyzer Verdict Alert fortinet Malware
GET /fontawesome6/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.skidrowcodex.net/fontawesome6/css/all.css?ver=1.0.0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: font/woff2
content-length: 105536
last-modified: Tue, 31 Jan 2023 06:54:54 GMT
cache-control: max-age=16070400
expires: Fri, 03 Mar 2023 21:45:23 GMT
etag: "63d8bb3e-19c40"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 291121
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TK3mi5xDf2GszHFuP2%2FAzkO3v30Rx1R7wsY4iEEhjKD8aMd%2FRRaSfNh%2BtEiQcpTs5XX7yLKWE4gVEgztYm2Pvb2w%2BOr3trthUj69RJOM8AeCo0p124rJYlyXetrgqh106nwbjJSkHA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a324ade1b512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/mediaelement/wp-mediaelement.min.css
200 OK 440 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/js/mediaelement/wp-mediaelement.min.css
IP
File type ASCII text, with very long lines (4186), with no line terminators
Size 440 kB (440095 bytes)
Hash cdd72af61ae8e57019d19419313ba631
56f56206cc93f5a0b2fea87a9bd7af1fe94c7f3a
9c2f699ff8970188418391589a48535d7a1baf70c2086ffde7400e1b0182b07c
GET /wp-includes/js/mediaelement/wp-mediaelement.min.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:08 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 19:54:19 GMT
etag: W/"62d88100-105a"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2457785
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uFAs4BFucjzwYc9IPGdV9Z7319KqfiimMjqQPXoIH4DDJYVWsW7nS0jz%2FxpLt9bmhfVtT8C8G8CYPT%2BfJ5brx2qjNpvJDBM5OJ00Dugx2FXOVmFuz8b74zI8kg27BX%2B52sFs1MvQmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3188d96b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-activity/css/blocks/latest-activities.min.css?ver=11.0.0
200 OK 2.1 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-activity/css/blocks/latest-activities.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (1877), with no line terminators
Hash 1785a6193f87d939c67360bcecd08c3f
539b41e1bd36cf9833c1879dc8e1eb54fcd497c4
8dae3a05b214aa32bc3c67920f4ec962039ece9af84c0a6a2bc035d10f6e571c
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-activity/css/blocks/latest-activities.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:09 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd01-755"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NjDbeSO3uby99dxfPcg60B%2BhosP%2FIxYKErsNx3SDR%2FEFtKIAQHc%2B0ULCbADCG9y%2BUZvS9Fz9uY3yQOIpUsobdDUqMiAqOu2loenjf5XAxnW%2BQtZx3opqdLYuv3LzMHLUcJcnikWARw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d33b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/fontawesome6/webfonts/fa-regular-400.woff2
200 OK 24 kB URL HTTP/2 www.skidrowcodex.net/fontawesome6/webfonts/fa-regular-400.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 23940, version 769.768\012- data
Hash e8a1ba418ee6d897d1339ef22e6d8e60
379ca48f70f3d4f79f8bf1079881c7c5af4f44a4
6a274e7629c0d71dcf8cab1e7733687ebfe32e2c53b4ca9fad050b4f1d5471f3
Analyzer Verdict Alert fortinet Malware
GET /fontawesome6/webfonts/fa-regular-400.woff2 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.skidrowcodex.net/fontawesome6/css/all.css?ver=1.0.0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: font/woff2
content-length: 23940
last-modified: Tue, 31 Jan 2023 06:54:54 GMT
cache-control: max-age=16070400
expires: Sat, 04 Mar 2023 02:00:01 GMT
etag: "63d8bb3e-5d84"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 275843
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6QOMwLvBgQNbdyNpFz2dYJmX9l8FRFmyWWuQ2%2BfWIZVBvNHhqtURqESh6ec9r%2BWNWSs%2B2dWvRFKwmt%2FgCQA3Vhp%2Bt2aRaxzDj6QD0p%2BVz73pwduu7ZMZ6pY4Q4jOHGKyinrxnQFFOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a324ddf8b512-OSL
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=20160930
200 OK 396 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=20160930
IP
File type ASCII text, with very long lines (857)
Size 396 kB (395540 bytes)
Hash 4c3f758f3b27dc34fa09bf52c9df1df7
0989c72a3f1d475526acb40f95575f4c89ad87f5
69b06f1c487b46a63f918e36f14a5f39de08164914ccfa775003fd9ecdcf2b4d
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/buddypress.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
etag: W/"62d880ff-e393"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7UFRCMyKFJlhbgwX5s7zDvv%2FZB6OGwso5m7BYddueNeZcTlP%2BmpiKwiilZwmRVReniGGzYJtGSZaj8rb1MOtS%2FWTscVjWE9ShiKQX%2BckDU%2B%2FhOKs5E0ucxflaVwC0%2FhfA1JyzZ0qYA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d67b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/css/dashicons.min.css
200 OK 397 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/css/dashicons.min.css
IP
File type ASCII text, with very long lines (58981)
Size 397 kB (397145 bytes)
Hash 9ab89e5c99deb195e7ab80f1e175135c
a96f40d66e5378f6260ca1b405add55056a6c5d3
d2271f132b779e10f5eb381d368248803e6c7ac13b561eae6d072d6585c407a8
GET /wp-includes/css/dashicons.min.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 10 Sep 2021 02:18:46 GMT
cache-control: public, max-age=31536000
expires: Tue, 04 Jul 2023 17:33:08 GMT
etag: W/"613ac086-e688"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 18623054
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lmhBO3ic2LPvLXp%2B7bU3ZGmIys%2F9mcnDDd5uTz925M14CChvUzZTPwAzPCVFj3RwV4eTtJRzkbqV5Nhebr3y3ogh0wBSxiO5pIdsawraECBQgkvOgWkGOWWXRuuKxkctq0dgjF%2Bs2w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3188d91b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash dccebcfaad6c97d820364ec92d4a511b
a1adef127bad0f85751b5a7b47025c33d40083c4
6be12cee36873a68c71f277876470b5a3807acf44b39a92b575595e9aa95c973
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=114151
Date: Sun, 05 Feb 2023 06:37:24 GMT
Etag: "63de5e16-1d7"
Expires: Mon, 06 Feb 2023 14:19:55 GMT
Last-Modified: Sat, 04 Feb 2023 13:31:02 GMT
Server: ECS (nyb/1D0C)
X-Cache: Miss from cloudfront
Via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: NX_ULN1hn5d9Y2CbjhK6giYITx4dawalUfIC3gg7PD-HfgE2WBXtCQ==
Age: 2933
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash dccebcfaad6c97d820364ec92d4a511b
a1adef127bad0f85751b5a7b47025c33d40083c4
6be12cee36873a68c71f277876470b5a3807acf44b39a92b575595e9aa95c973
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=114713
Date: Sun, 05 Feb 2023 06:37:24 GMT
Etag: "63de5e16-1d7"
Expires: Mon, 06 Feb 2023 14:29:17 GMT
Last-Modified: Sat, 04 Feb 2023 13:31:02 GMT
Server: ECS (bsa/EB20)
X-Cache: Miss from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 16GVdIOnAZyeU8ZAvqwpIUIzFhlEDtsujpu1H6qx5JyAy1DtmI85yA==
Age: 3495
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
colognenobilityfrost.com/3d4d1ebf834071da337ca3d4ccf0aef4/invoke.js
200 OK 9.8 kB URL HTTP/1.1 colognenobilityfrost.com/3d4d1ebf834071da337ca3d4ccf0aef4/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (26951), with no line terminators
Hash 8d50f411f1c3c20de2dd475152fb1b1b
fc1257b6c4d7cba33ae0302aa1bdd27e42c28a51
39cfce50414fb8d7daea83b1a2bf0e3a86bb5582c05d9361cddbf22398279455
GET /3d4d1ebf834071da337ca3d4ccf0aef4/invoke.js HTTP/1.1
Host: colognenobilityfrost.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:24 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 914b4720efcfe4e74ba6069f8184401a
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 29 Jan 2023 22:02:00 GMT
expires: Mon, 29 Jan 2024 22:02:00 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 549324
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2
200 OK 17 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 17368, version 1.0\012- data
Hash abe083d96b58eb02ada8b7c30d7b09f2
61447d66d13a8c8f4335696777a85c438c46f749
db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9
GET /s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17368
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 Feb 2023 12:49:39 GMT
expires: Sun, 04 Feb 2024 12:49:39 GMT
cache-control: public, max-age=31536000
age: 64065
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 Feb 2023 10:26:49 GMT
expires: Sun, 04 Feb 2024 10:26:49 GMT
cache-control: public, max-age=31536000
age: 72635
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/easy-slider.css?ver=20160930
200 OK 20 kB URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/easy-slider.css?ver=20160930
IP
Hash e46ed95c06c3881c3bfc632e515a26aa
04d5466a4392a9f4ab031c05778da9f4305355cb
052be334cfaeba1aa8fc0df1c1ddb80fd7f0bd9e2b3f7b8db2ffeda1bb5e43b1
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/easy-slider.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Thu, 02 Mar 2023 03:17:53 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 29387969
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MKyTpPN98HhCZmKJ9h79cXX7HffmJZYvjD0f%2FdfNi1%2F7x5Gkr8ljcI021DrfODJbAifHofKEUNLKJLyh5wyo%2FY1oFh4LihZYRFrk9FS1ZnkOb7qHWG4xvw2M1e54V0idgXkPYU%2BZMA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3186d58b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
200 OK 17 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 16740, version 1.0\012- data
Hash e43b535855a4ae53bd5b07a6eeb3bf67
6507312d9491156036316484bf8dc41e8b52ddd9
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
GET /s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 16740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 Feb 2023 00:44:37 GMT
expires: Fri, 02 Feb 2024 00:44:37 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
content-type: font/woff2
age: 280367
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash cdd14aaef33f90bdeec6a8ec9e317468
ab051c146b7ba9dfb508b1bec57ea247c570eca8
e94dfa2d91509b8cbbabea3fa950f73b4e2b313e763049bd9e646b8c15a68928
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.skidrowcodex.net
access-control-allow-credentials: true
set-cookie: uid_id2=7e1780ca-ff09-4aa1-aae3-986250cc99b0:1:1; expires=Wed, 02 Feb 2033 06:37:24 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 31 Jan 2023 13:09:06 GMT
expires: Wed, 31 Jan 2024 13:09:06 GMT
cache-control: public, max-age=31536000
age: 408498
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/tipsy.css?ver=0.1.7
200 OK 528 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/tipsy.css?ver=0.1.7
IP
Hash 6e8bc4c0190b6e9a1abc48f9e3f25115
f5837b1b63b0536a60756b2531e64cf247a30668
9281feed41d37dc320eed310e9ed69bd071f85daafc14c75e05c5d2846141387
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/tipsy.css?ver=0.1.7 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:25:15 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455928
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QyZVkPo3Fr9c%2FrcL4F0xsfigu7kaxU6kk7UPSBqlQv1zyO7xqwF%2BfZ48m7ylGwIMOkKAYJqn8R9kFM0ihufsdE6O3rvz2390meuwXqytz2AWMKdPHhD2OU1G3%2FS6C76omzWG5edLoA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d1eb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15752, version 1.0\012- data
Hash b20371a6daf29d4a1f2e85dbbf40fb20
0355a01c1ccb45cb728e7e07c41c8ebf456f70bb
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15752
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 Feb 2023 01:50:00 GMT
expires: Sat, 03 Feb 2024 01:50:00 GMT
cache-control: public, max-age=31536000
age: 190044
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash ca7b802cb8cdfce251a5b790ecf76961
eb7ebf41a4f624a2eaf51eb8414b57365072a3f0
6a9b17a5dae86cc9447bb6aee9b8c412a3690673a09aaa1451484ddb4cf6f848
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Cookie: uid_id2=8af7fab2-6f9f-41be-ade1-ec22d02ffad7:3:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.skidrowcodex.net
access-control-allow-credentials: true
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/dist/a11y.min.js?ver=0ac8327cc1c40dcfdf29716affd7ac63
200 OK 3.2 kB URL HTTP/2 www.skidrowcodex.net/wp-includes/js/dist/a11y.min.js?ver=0ac8327cc1c40dcfdf29716affd7ac63
IP
File type Unicode text, UTF-8 text, with very long lines (2973)
Hash 18afcbceccd8e540800bff59d6c4749e
b56a38ce39095e15c8597b93f361d1acde1f0a0b
4bd42aa012ad76be37751d23feb50f57c270bd7eb1cb148f312ced451995a90a
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/dist/a11y.min.js?ver=0ac8327cc1c40dcfdf29716affd7ac63 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:49 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 03:10:46 GMT
etag: W/"6381e8bd-bc1"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1481197
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B1n4Ac5QeRfmkhboZTnn%2BO6Dw1BLBhK4K5ZbUmBgB9u1QeLswNNX6z6U0YyolNKeX%2BELD5MXQlEs0IT0c1B%2FQjTMRnf50A0UULDwwOejlWTeM4oIKFIMzHjgxKkQ9tgt%2BPoBYfDa7A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319feccb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/inc/images/overlay/overlay.png
200 OK 211 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/inc/images/overlay/overlay.png
IP
File type PNG image data, 2 x 2, 1-bit colormap, non-interlaced\012- data
Hash 0a3750e6fdb29fcd632e627e2fc34dde
7c046ea4b1669da4eb81acccd7fc58b00201543d
5ddb13e84c10a1b7a773f0580f2997c3b5e91d1c2227fc1313c5991429442657
GET /wp-content/plugins/responsive-full-width-background-slider/inc/images/overlay/overlay.png HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:24 GMT
content-type: image/png
content-length: 211
x-accel-version: 0.01
last-modified: Tue, 31 Jan 2023 06:55:07 GMT
cache-control: public, max-age=16070400
expires: Fri, 02 Jun 2023 01:54:08 GMT
vary: Accept-Encoding
x-powered-by: PleskLin
cf-cache-status: HIT
age: 276195
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dB3Z3bX92eMhjtmlWEz5yLUDrjedK2kwtLUwaK%2BHNx1mkBBqfqR6Fygp0WH93NVncHG5sO5oAqFLYk1AWFn60DnMJeZrbFLUU6w73A6Rcaoj5hdWS6znTBEN8xCtWURJLLPc%2F9%2Bj5w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3265f04b512-OSL
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash bfea74a6190e45e6b339a9ed62e59fd1
52a5787e4375d9012a8653c14cd5c66d68909ffb
f1251329302001bd0d2de99dfe1100887ff6a7b69de4ad2b9a2a718efe6c91d1
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "F1251329302001BD0D2DE99DFE1100887FF6A7B69DE4AD2B9A2A718EFE6C91D1"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8372
Expires: Sun, 05 Feb 2023 08:56:56 GMT
Date: Sun, 05 Feb 2023 06:37:24 GMT
Connection: keep-alive
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/dynamic-members.min.css?ver=11.0.0
200 OK 3.3 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-members/css/blocks/dynamic-members.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (621), with no line terminators
Hash dad2030bae2157de4fbc7b423c160f24
d1655c6621fb887d231c9f7ef864af66f97a9adf
ae8b516d6ac77e81eda07e145efa4909ef1ea105591eeb5ed9c8fadbc724d0e2
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-members/css/blocks/dynamic-members.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=971HddhBLw7tVaXIXSrsqkB9mFlOMz3oBF8rR%2BhTpV51SW7DtLsUYJrN5c1%2FquVX%2Bzlwk5c8Yo41vpguzWEQ4c8U4f6qLVZiRXtcB5fkVe3TmAnHevDDs6p5YOW6XHihAL2Pt5thXw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d28b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5383
Expires: Sun, 05 Feb 2023 08:07:08 GMT
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-friends/css/blocks/friends.min.css?ver=11.0.0
200 OK 2.5 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-friends/css/blocks/friends.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (621), with no line terminators
Hash 7782af4b16bee13bac41ce93c1715f05
46eb022a1cc15c0180147dfbc94960901a0710db
739f7e2e144aac0871a356236c8b1ebb8503bd34478bb9e4196105ae289af16d
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-friends/css/blocks/friends.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HuaeeWcIp3wWZMMkR6hJKGo8Y3C%2BF6hyBRj8MOLoLGiG9VVR8DZD5jv4grvRVFsOHoKVLiyFnEnEugD4A4ipsdELs5y4PerMpTV6HvKEY4oSbMOLXvskQus5dXVqnsf%2BlO4il4kpkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3184d3db512-OSL
content-encoding: br
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5383
Expires: Sun, 05 Feb 2023 08:07:08 GMT
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5383
Expires: Sun, 05 Feb 2023 08:07:08 GMT
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6718344-fcb4-4366-9239-8921034a7114.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6718344-fcb4-4366-9239-8921034a7114.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8e0be7db14d930d6227443314bcd1747
4e42e2ad289dfe5bd9a55d34fd768f7532bdf71d
baedfbdb08a67f9ff4c698f7e65b08d7e4c5078d0a4233e6bff529b44812735a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6718344-fcb4-4366-9239-8921034a7114.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12967
x-amzn-requestid: 38c58626-f4ad-4e2b-ad71-a628519d2ea2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fmEdHFwCoAMFhxQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d8b453-7da6d0c1093468d320caaa1e;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 06:25:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: t8dZTwod1-pZr8ACfp-6gfEu0TA3kGpfJrQeF8VgLg2tlrt03sa6Bg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 05 Feb 2023 03:40:08 GMT
age: 10637
etag: "4e42e2ad289dfe5bd9a55d34fd768f7532bdf71d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg
200 OK 6.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash bee08788da5b88dde69aeb1d4de005c9
537c7a19a9395a60452b6b0b3ae08d47f4705181
02365d88ae9ff3ace3f29509df0e436ab0838d44714ef0f25dea463d665f794a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6486
x-amzn-requestid: 544d13b9-8d45-4029-88e0-280f27cc0fa3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi4-SHN1IAMFSkw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76ec1-3f1ee84f53fe45cc01439a28;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 07:16:17 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TtyPO9j12ZpU3XdElRgCrqB4XNERrppavwJZJn5As8mqjjDLyZBmsw==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:39 GMT
age: 32026
etag: "537c7a19a9395a60452b6b0b3ae08d47f4705181"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7dbe304b5138a360ff07a9842bcf6a7f
00572f7667e322c9ef34bc35b7998c1c172dd34c
d63c58d6c96e23c61b92272de8c2aab01f4cf85f3420cc434c05447d355b1c77
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9108
x-amzn-requestid: a3bffa19-86ce-4a59-b826-551deddb3e9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fostZG2xIAMF0wQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d9c188-18acd7311c6190c9486e86ac;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 01:34:00 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mWqq5MbsWYvQmSzPw3kTdjzTkz22mNHbOoqyiHfbxv0BhNhgFfnZGw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:52 GMT
age: 32013
etag: "00572f7667e322c9ef34bc35b7998c1c172dd34c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37422a56-a7de-4ab8-ac8a-650de9dae97c.jpeg
200 OK 5.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37422a56-a7de-4ab8-ac8a-650de9dae97c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5b6c30ad03669b66bf2f63b3edd69882
e630bd132b52b965a5ade646ea8a165d1abf6d7b
f8233d879ec17fd91909655ff8881f2ebfad84272fde3ed5e5be37580378a989
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37422a56-a7de-4ab8-ac8a-650de9dae97c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5014
x-amzn-requestid: a434aae4-fe4b-4fc7-9b7e-eeb552484e8a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi3bIE0aoAMF6YQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76c47-5556d14757190c842bbc6b06;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 07:05:43 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: k6YqagXr3Wr-u1uDKojEnIGW0CxU5yvWPtlzNpzoIvmg9F-rJb9uFQ==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 14:53:45 GMT
age: 56620
etag: "e630bd132b52b965a5ade646ea8a165d1abf6d7b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 251f1a5d671fb797fb98e9a71754c341
335425603d9eec146a3c03422dbca91134272e53
74932f07561287e33302aabcf9c639e9df7ae0fbc4bf71f5467310aabafea208
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6202
x-amzn-requestid: 01b85fcd-69a0-49da-8640-32a3ef19378a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi3bUFEJoAMFapg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76c48-14817e717361e09170714e9d;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 07:05:44 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1_1mEN4j5cciWEiimz4PRjx3PNGnrSRib9oEJAdYLrrtyjqnz_zvcQ==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 13:05:46 GMT
age: 63099
etag: "335425603d9eec146a3c03422dbca91134272e53"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b1092c4dd4d9ca4d09462ae46e1dd7c1
17444ff60be1afbc40d3653fa936f9eaf9478068
ea8362c7249080b34288ee675f70333607fc3be37e716fdcf63e4901849def9f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7288
x-amzn-requestid: 1aa297f5-2f9a-45be-b823-1eb4d5887769
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f1WrwH-iIAMFyhQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ded17e-2b630b4a302b8ae118883b71;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 21:43:26 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: z2oKgp1keqEkvN6jjsUepMbrxD4JCXKAOHrMNJHcuXN0CpulUh5GLA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:39 GMT
etag: "17444ff60be1afbc40d3653fa936f9eaf9478068"
content-type: image/jpeg
age: 32026
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
withenvisagehurt.com/pixel/purst?dl=0&th=0&sc=0&rs=2514&rd=2514&fd=1876&bv=22.10.v.9&tmpl=70
200 OK 0 B URL HTTP/1.1 withenvisagehurt.com/pixel/purst?dl=0&th=0&sc=0&rs=2514&rd=2514&fd=1876&bv=22.10.v.9&tmpl=70
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2514&rd=2514&fd=1876&bv=22.10.v.9&tmpl=70 HTTP/1.1
Host: withenvisagehurt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:25 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
www.skidrowcodex.net/wp-content/uploads/2018/12/1.png
200 OK 19 kB URL HTTP/2 www.skidrowcodex.net/wp-content/uploads/2018/12/1.png
IP
File type PNG image data, 128 x 128, 8-bit/color RGBA, interlaced\012- data
Hash 700155633ff3880e5a61acd8eff30ff6
d677135c3e4492843b08b70b8e8b320e021a601e
7c260b19a9bf5b4832893c1f5db13c166cb54e964477049c4856146ad41ec9ca
GET /wp-content/uploads/2018/12/1.png HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Cookie: __unam=bb01aea-186204bcd2a-605875c-1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:25 GMT
content-type: image/png
content-length: 18576
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=16070400
expires: Tue, 02 May 2023 20:00:45 GMT
etag: "62d880ff-4890"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2889265
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8wl%2FHRoF5cr%2BUT7K8S%2BP65JvuwhB1Inab9Vl8AYs4GSIF3mVvwyI8QQ4cGmkVfTVCOWVnqvMR9%2Bd8pbt0ag0QXMORZ8TEa%2FK0vvxbuTuCZjU5aonk0eeIDpRNu5ExPxQcbp0g2nCPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a328383eb512-OSL
X-Firefox-Spdy: h2
cdn.akamai.steamstatic.com/steam/apps/256865434/movie_max_vp9.webm?_=1
206 Partial Content 5.8 MB URL HTTP/1.1 cdn.akamai.steamstatic.com/steam/apps/256865434/movie_max_vp9.webm?_=1
IP
ASN #20940 Akamai International B.V.
File type WebM\012- EBML file, creator webmB\20\012- data
Size 5.8 MB (5812876 bytes)
Hash e8c082f57dbf2919a0b3f66ae8fab8b7
d961d9a30ef4aff000045588f659ea051abd477e
b736b2443f52ff0fb62871d31238c3bf24ee66b8b5a9f8a2dfd172023df1fd20
GET /steam/apps/256865434/movie_max_vp9.webm?_=1 HTTP/1.1
Host: cdn.akamai.steamstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 206 Partial Content
Server: nginx
Content-Type: video/webm
Last-Modified: Thu, 16 Dec 2021 16:42:23 GMT
ETag: "61bb6c6f-29c1d37"
Accept-Ranges: bytes
Date: Sun, 05 Feb 2023 06:37:24 GMT
Content-Range: bytes 0-43785526/43785527
Content-Length: 43785527
Connection: keep-alive
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/arrow-menu.png
200 OK 958 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/img/arrow-menu.png
IP
File type PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced\012- data
Hash f9c0ecfcff60768fbd06b8530b5893d8
278c5069e07702d4879e9071a6b0771dcdf52276
a67a4f1d3647720231c97244d0c0ff6dfa49b83f7191dd86d19940a3d3f96685
GET /wp-content/themes/skidrowcodex-main/img/arrow-menu.png HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/main.css?ver=20160930
Cookie: __unam=bb01aea-186204bcd2a-605875c-1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:25 GMT
content-type: image/png
content-length: 958
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=16070400
expires: Fri, 19 May 2023 05:38:31 GMT
vary: Accept-Encoding
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472336
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VLaXIxEpa2xnGgvlfW1x9TJ5X6RqQPJGMYl2kMnIFBJgrnh1Sw9DmbV83x6U7009Op2mhHqgEgis7KG9gvo5SIzwoqmgF8N4MlvfnlSL8Pr4jUmxv1GxkYkBmW23b%2FBcLWbHPSvBCA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a32968e3b512-OSL
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 153d0de36959c722c00df71ba86daca2
305f56a3134879ebf0828e169e903e560540c070
0cf533a798d42d1e97fb6619a411afadf9a68c92302ba852869b0c0555a47987
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1490)
Hash ca7fbbfd120e3e329633044190bbf134
d17f81e03dd827554ddd207ea081fb46b3415445
847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20085
date: Sun, 05 Feb 2023 05:44:08 GMT
expires: Sun, 05 Feb 2023 07:44:08 GMT
cache-control: public, max-age=7200
age: 3197
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.akamai.steamstatic.com/steam/apps/256861704/movie_max_vp9.webm?_=2
206 Partial Content 3.8 MB URL HTTP/1.1 cdn.akamai.steamstatic.com/steam/apps/256861704/movie_max_vp9.webm?_=2
IP
ASN #20940 Akamai International B.V.
File type WebM\012- EBML file, creator webmB\20\012- data
Size 3.8 MB (3806379 bytes)
Hash 5edb94b5855e3c7fda466b4cf42dfe1b
bb06925c9b23f119a1c78c3b1f338a499a873d02
e06724b821a60ceaa0fb6bdf60d570d4262250adfebd5eb5157e3d47a8ba6751
GET /steam/apps/256861704/movie_max_vp9.webm?_=2 HTTP/1.1
Host: cdn.akamai.steamstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 206 Partial Content
Server: nginx
Content-Type: video/webm
Last-Modified: Tue, 23 Nov 2021 15:12:44 GMT
ETag: "619d04ec-11b278a"
Accept-Ranges: bytes
Date: Sun, 05 Feb 2023 06:37:24 GMT
Content-Range: bytes 0-18556809/18556810
Content-Length: 18556810
Connection: keep-alive
ws.sharethis.com/button/css/buttons-secure.css
200 OK 3.9 kB URL HTTP/2 ws.sharethis.com/button/css/buttons-secure.css
IP
File type ASCII text, with very long lines (23158), with no line terminators
Hash 61da924a747e08c5f54a6cb31c724a48
8e49d971d6a667c3888a481b742e05cafcf72a43
54302324d4b6aa780466c869b9932504d0b1eaa7ef1df6c5481b35fb0625343a
GET /button/css/buttons-secure.css HTTP/1.1
Host: ws.sharethis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/css
content-length: 3851
content-encoding: gzip
date: Sun, 05 Feb 2023 05:11:47 GMT
etag: W/"63d989f4-5a76"
last-modified: Tue, 31 Jan 2023 21:36:52 GMT
server: nginx/1.20.1
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: P4lyQUsFeFRG3LtB5Pd3X1VMnIm3dJ-0Icr39cX-j9sfOfCuPmjDfA==
age: 5138
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
www.skidrowcodex.net/fontawesome6/css/all.css?ver=1.0.0
200 OK 24 kB URL HTTP/2 www.skidrowcodex.net/fontawesome6/css/all.css?ver=1.0.0
IP
File type troff or preprocessor input, ASCII text
Hash 6bcb49dacc33d2d8db89b7d15abe291f
7cb581c8a8d0df7c825bb7a670ee3b4e8b0c3bb8
39ffce5a6a953e54773683af62d2465e80cc62b66f33bf531acff348ef6d9cec
Analyzer Verdict Alert fortinet Malware
GET /fontawesome6/css/all.css?ver=1.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:25:55 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 05:38:17 GMT
etag: W/"62d880f3-21abd"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1472346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wftCa6uzp9cVoAlLjddpN5lMLE%2FaFGMZAtYlkSzOVSamKr%2FQx5qGv8sMPDJahC%2FkM0CJ%2FCDTgnPPZcjqRmERji6OQ5QMPzwCCDhdgZf5QkXdlHK3LBSAMbXb30ytkVJL%2BGGTsuhZTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318ada5b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash e1d97cd9bfec81674198add4e5d8b757
011cc732652ca46d1bb715ea58cd53514410c52a
2b38ceeebd7e9db0f009f7c9a75873d6b56e4ba066ea2579463ac3dae76ae09d
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=89772
Date: Sun, 05 Feb 2023 06:37:25 GMT
Etag: "63ddf1c1-1d7"
Expires: Mon, 06 Feb 2023 07:33:37 GMT
Last-Modified: Sat, 04 Feb 2023 05:48:49 GMT
Server: ECS (nyb/1D18)
X-Cache: Miss from cloudfront
Via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: EVfwi2KLCjdf0ugG2u4y9OZGhyTC5pRvtFN_Q2yNSWVumLMYPoiq4A==
Age: 6289
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b7d989b415697cff62370f7730b25860
434aa43f2c55020ce7b770e0115429ee5abac5b9
19fcf5229e29c08dcc880cdc79a9d595798d53a409b67fcf15f3ee2d884eeb00
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "19FCF5229E29C08DCC880CDC79A9D595798D53A409B67FCF15F3EE2D884EEB00"
Last-Modified: Thu, 02 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2545
Expires: Sun, 05 Feb 2023 07:19:50 GMT
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 58c88b34c980fa136e81f2dac9563cd1
f76f7affe7fb2a0243b2da835f45025a73728a44
9e97bb4f9c31760527104c46561ce2c7dc7ece405c660b4f16660c78cc8a892f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9E97BB4F9C31760527104C46561CE2C7DC7ECE405C660B4F16660C78CC8A892F"
Last-Modified: Sat, 04 Feb 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19010
Expires: Sun, 05 Feb 2023 11:54:15 GMT
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
withenvisagehurt.com/pixel/pure
204 No Content 0 B URL HTTP/1.1 withenvisagehurt.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
OPTIONS /pixel/pure HTTP/1.1
Host: withenvisagehurt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://www.skidrowcodex.net/
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Content-Length: 0
withenvisagehurt.com/pixel/pure
204 No Content 0 B URL HTTP/1.1 withenvisagehurt.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
OPTIONS /pixel/pure HTTP/1.1
Host: withenvisagehurt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://www.skidrowcodex.net/
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:25 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Content-Length: 0
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aeeefd2d41311d21e58a79216388b8ec
61b6224aed9721be9b600640073c26f91fe2566b
70abf72a66f3491630ee6d380cd655a33489aa411b1bac80319190f31d2a6295
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "70ABF72A66F3491630EE6D380CD655A33489AA411B1BAC80319190F31D2A6295"
Last-Modified: Sat, 04 Feb 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12991
Expires: Sun, 05 Feb 2023 10:13:57 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
banquetunarmedgrater.com/advertisers.js
200 OK 0 B URL HTTP/1.1 banquetunarmedgrater.com/advertisers.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /advertisers.js HTTP/1.1
Host: banquetunarmedgrater.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 731521e5da17ed978a754fbb1d41cfba
Strict-Transport-Security: max-age=0; includeSubdomains
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash ca7b802cb8cdfce251a5b790ecf76961
eb7ebf41a4f624a2eaf51eb8414b57365072a3f0
6a9b17a5dae86cc9447bb6aee9b8c412a3690673a09aaa1451484ddb4cf6f848
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Cookie: uid_id2=8af7fab2-6f9f-41be-ade1-ec22d02ffad7:3:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:26 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.skidrowcodex.net
access-control-allow-credentials: true
X-Firefox-Spdy: h2
withenvisagehurt.com/pixel/pure
200 OK 0 B URL HTTP/1.1 withenvisagehurt.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
POST /pixel/pure HTTP/1.1
Host: withenvisagehurt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 73
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
subscribestormyapprobation.com/sbar.json?key=9e55c24c07205b6a363c94f4ff46ad27
200 OK 4.2 kB URL HTTP/1.1 subscribestormyapprobation.com/sbar.json?key=9e55c24c07205b6a363c94f4ff46ad27
IP
File type JSON data\012- , ASCII text, with very long lines (5983), with no line terminators
Hash 36e3b8a45a8840d3633e54e8175f84da
6a94bace3b17e8f77e1de82d2cbc138cc6c4f299
491bf330d912605fe0ed76f5bf92deafa421831787dbc35db16f00f05131626b
Analyzer Verdict Alert quad9 Sinkholed
GET /sbar.json?key=9e55c24c07205b6a363c94f4ff46ad27 HTTP/1.1
Host: subscribestormyapprobation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.skidrowcodex.net
Access-Control-Allow-Origin: https://www.skidrowcodex.net
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=16905685; expires=Mon, 06 Feb 2023 06:37:25 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
uncs=1; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
pdhtkv29=true; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
uncs29=1; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a0e86cd85bb4a400fdcf8d4698240501
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
withenvisagehurt.com/pixel/pure
200 OK 0 B URL HTTP/1.1 withenvisagehurt.com/pixel/pure
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
POST /pixel/pure HTTP/1.1
Host: withenvisagehurt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 73
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
solitudearbitrary.com/watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=
307 Temporary Redirect 0 B URL HTTP/1.1 solitudearbitrary.com/watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid= HTTP/1.1
Host: solitudearbitrary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.skidrowcodex.net
Access-Control-Allow-Origin: https://www.skidrowcodex.net
Access-Control-Allow-Credentials: true
Location: https://solitudearbitrary.com/watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=&shu=de5f87bf4454b7b48db02f060e88121b2e5bd4792c6bb145f30e46f29a1454acaefdf25dd142d9b55f9faa41c9bb4581f4346b9eeda6e7069b741c12aa6e9dfde93a072e43146a23bd1e55e75d5816ff8c9ff51c5bc89ed3e498090e6f9208&pst=1675579106&rmtc=t
Set-Cookie: u_pl=16850525; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjg1MDUyNSwiayI6IjNkNGQxZWJmODM0MDcxZGEzMzdjYTNkNGNjZjBhZWY0Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNDAzNzQxLCJwaWQiOjI0Mzk3NywiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyMSwiYWlkIjoyMywicHQiOjQsInBrIjoiZnJzcHNkYWEiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly93d3cuc2tpZHJvd2NvZGV4Lm5ldC9kZWFkLWNlbGxzLXRoZS1xdWVlbi1hbmQtdGhlLXNlYS1jb2RleC8ifX0.Lg3EVt02LVcpoCEc-RsyBGD0ytri0axll8xMwm4oMiM; expires=Sun, 05 Feb 2023 06:38:26 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 404c14a107a10139a0fee04cddf9a46b
Strict-Transport-Security: max-age=0; includeSubdomains
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9a2b34a5ab39090966561af64d7a5062
61f66d0325867f7d6218de5825e10a2908ce6cbe
7e3806c006494bcdd4e242c64865357f743a5eaac7e366fade7b98251b5c7838
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7E3806C006494BCDD4E242C64865357F743A5EAAC7E366FADE7B98251B5C7838"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8920
Expires: Sun, 05 Feb 2023 09:06:06 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
subscribestormyapprobation.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSu3sSD7snFPXgQ%2B6iwTLpnujOZzWExrpHgmsTd1YAgUl1VPSmnpqup6p6ehD0EF2QvwuxJj51v8gN1kd2jB0E6XiSnjIjkYPaPED3LTAbGfdD93lffO3zfe%2B%2Br%2FfyCeMjp%2BeaHelcqRRfCmue%2BtSUTrgvrrt93fa%2FmLbtbMlkMlt3%2B%2BGd6N30vrHlvu%2B8L1tELdc%2F3PN%2Fz3VVpRKz7CxMWMn3S8mstrxbUa34YoG9exDZ3YKkD3rsg1yD56KXt355BsgpJ9%2BltYTuZTm%2B8180VzbRBjx9%2FnHQSXSTozsrYOIiT42k3tB0R8u0V6OR46gC6dzB2gEiOiPOnjyg5nspE1Du8VBopiAQRv4qiV0GoCpJWYPohJD8jAONY30DSPVrXpqA7lywdsyMy%2F%2B%2FfkMWIzP%2F1GpLujytK9t17WuWZ1IlFPy4h%2BxVku0KanyDbdSCLE7DsS0hOkHRLSF5OXEtZQcYVlBiAWgf5%2BJMO8thBnjro8nOXhq3Y85pxFDcaSwFjrNFgLFxa5CFvBEuxh5yNZQ2QpQMwNQAze0jNHjry8Vl4DSb%2FBXa7hOUObDYizkd76PEShSAoLEFBCQpJUGQERa885MrWbXnElc0jf5rr09wohzpr79NDnbVFQvbTC%2FLqeCSO888f6IhztyXCkNUD5jXrXhgt0sZig7WCOIjjYJHyehNWlpD2ysTtrhyR653PkMoRmfvpZUT0BFadgMnroPkboMWwWfdAt4fBkofd5KntSG50wTQX%2FVoiMnBdIs3mke04%2B%2BqCvD5Zz82rNyDY6a1vvt54vsw%2FBTMlUlPiC%2FkrQVs9Gt7VBTm4qwtLnm2kmezKXTpe3b2MZmLu%2Bw%2FETqENX7ttB9%2B9w8bEuHxyX9jsDk24TNqW%2FLAiORdmVRsmyM9rdktEm7ndXslNkqd3Nt9dXeumRlgrdVKByrNPHoDJEXnlweeTo3zTGUKaCiYv0c1PyTQgdQWW7sGmM%2FVWExg164lSB0VeDk09mj0qSaDEDNOohP0fjmb1vn2EtnFAs4eTU%2ByZEj1VgqoBbD43zFJzeuv3xiQQKWcYKeMcRMqox5ejtfLcFWHsxcKriyhuRXGTerwVB62ItnzRjELqI7Mj9nz96D8AAAD%2F%2FwEAAP%2F%2FkzMuSmwEAAA%3D
200 OK 7 B URL HTTP/1.1 subscribestormyapprobation.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSu3sSD7snFPXgQ%2B6iwTLpnujOZzWExrpHgmsTd1YAgUl1VPSmnpqup6p6ehD0EF2QvwuxJj51v8gN1kd2jB0E6XiSnjIjkYPaPED3LTAbGfdD93lffO3zfe%2B%2Br%2FfyCeMjp%2BeaHelcqRRfCmue%2BtSUTrgvrrt93fa%2FmLbtbMlkMlt3%2B%2BGd6N30vrHlvu%2B8L1tELdc%2F3PN%2Fz3VVpRKz7CxMWMn3S8mstrxbUa34YoG9exDZ3YKkD3rsg1yD56KXt355BsgpJ9%2BltYTuZTm%2B8180VzbRBjx9%2FnHQSXSTozsrYOIiT42k3tB0R8u0V6OR46gC6dzB2gEiOiPOnjyg5nspE1Du8VBopiAQRv4qiV0GoCpJWYPohJD8jAONY30DSPVrXpqA7lywdsyMy%2F%2B%2FfkMWIzP%2F1GpLujytK9t17WuWZ1IlFPy4h%2BxVku0KanyDbdSCLE7DsS0hOkHRLSF5OXEtZQcYVlBiAWgf5%2BJMO8thBnjro8nOXhq3Y85pxFDcaSwFjrNFgLFxa5CFvBEuxh5yNZQ2QpQMwNQAze0jNHjry8Vl4DSb%2FBXa7hOUObDYizkd76PEShSAoLEFBCQpJUGQERa885MrWbXnElc0jf5rr09wohzpr79NDnbVFQvbTC%2FLqeCSO888f6IhztyXCkNUD5jXrXhgt0sZig7WCOIjjYJHyehNWlpD2ysTtrhyR653PkMoRmfvpZUT0BFadgMnroPkboMWwWfdAt4fBkofd5KntSG50wTQX%2FVoiMnBdIs3mke04%2B%2BqCvD5Zz82rNyDY6a1vvt54vsw%2FBTMlUlPiC%2FkrQVs9Gt7VBTm4qwtLnm2kmezKXTpe3b2MZmLu%2Bw%2FETqENX7ttB9%2B9w8bEuHxyX9jsDk24TNqW%2FLAiORdmVRsmyM9rdktEm7ndXslNkqd3Nt9dXeumRlgrdVKByrNPHoDJEXnlweeTo3zTGUKaCiYv0c1PyTQgdQWW7sGmM%2FVWExg164lSB0VeDk09mj0qSaDEDNOohP0fjmb1vn2EtnFAs4eTU%2ByZEj1VgqoBbD43zFJzeuv3xiQQKWcYKeMcRMqox5ejtfLcFWHsxcKriyhuRXGTerwVB62ItnzRjELqI7Mj9nz96D8AAAD%2F%2FwEAAP%2F%2FkzMuSmwEAAA%3D
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert quad9 Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSu3sSD7snFPXgQ%2B6iwTLpnujOZzWExrpHgmsTd1YAgUl1VPSmnpqup6p6ehD0EF2QvwuxJj51v8gN1kd2jB0E6XiSnjIjkYPaPED3LTAbGfdD93lffO3zfe%2B%2Br%2FfyCeMjp%2BeaHelcqRRfCmue%2BtSUTrgvrrt93fa%2FmLbtbMlkMlt3%2B%2BGd6N30vrHlvu%2B8L1tELdc%2F3PN%2Fz3VVpRKz7CxMWMn3S8mstrxbUa34YoG9exDZ3YKkD3rsg1yD56KXt355BsgpJ9%2BltYTuZTm%2B8180VzbRBjx9%2FnHQSXSTozsrYOIiT42k3tB0R8u0V6OR46gC6dzB2gEiOiPOnjyg5nspE1Du8VBopiAQRv4qiV0GoCpJWYPohJD8jAONY30DSPVrXpqA7lywdsyMy%2F%2B%2FfkMWIzP%2F1GpLujytK9t17WuWZ1IlFPy4h%2BxVku0KanyDbdSCLE7DsS0hOkHRLSF5OXEtZQcYVlBiAWgf5%2BJMO8thBnjro8nOXhq3Y85pxFDcaSwFjrNFgLFxa5CFvBEuxh5yNZQ2QpQMwNQAze0jNHjry8Vl4DSb%2FBXa7hOUObDYizkd76PEShSAoLEFBCQpJUGQERa885MrWbXnElc0jf5rr09wohzpr79NDnbVFQvbTC%2FLqeCSO888f6IhztyXCkNUD5jXrXhgt0sZig7WCOIjjYJHyehNWlpD2ysTtrhyR653PkMoRmfvpZUT0BFadgMnroPkboMWwWfdAt4fBkofd5KntSG50wTQX%2FVoiMnBdIs3mke04%2B%2BqCvD5Zz82rNyDY6a1vvt54vsw%2FBTMlUlPiC%2FkrQVs9Gt7VBTm4qwtLnm2kmezKXTpe3b2MZmLu%2Bw%2FETqENX7ttB9%2B9w8bEuHxyX9jsDk24TNqW%2FLAiORdmVRsmyM9rdktEm7ndXslNkqd3Nt9dXeumRlgrdVKByrNPHoDJEXnlweeTo3zTGUKaCiYv0c1PyTQgdQWW7sGmM%2FVWExg164lSB0VeDk09mj0qSaDEDNOohP0fjmb1vn2EtnFAs4eTU%2ByZEj1VgqoBbD43zFJzeuv3xiQQKWcYKeMcRMqox5ejtfLcFWHsxcKriyhuRXGTerwVB62ItnzRjELqI7Mj9nz96D8AAAD%2F%2FwEAAP%2F%2FkzMuSmwEAAA%3D HTTP/1.1
Host: subscribestormyapprobation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Cookie: u_pl=16905685; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a6a01c00ac6d3d9891e82eb726962298
Strict-Transport-Security: max-age=0; includeSubdomains
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 6eac904305f0af9ac8425ba6638af743
6cc700dcc996020985e64492e8d9df7c498d861b
97a04042d25ff5aba9e8e6b99828405fc609275c375530f777a4a5d57e4cede3
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "97A04042D25FF5ABA9E8E6B99828405FC609275C375530F777A4A5D57E4CEDE3"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2248
Expires: Sun, 05 Feb 2023 07:14:54 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 Feb 2023 21:48:03 GMT
expires: Fri, 02 Feb 2024 21:48:03 GMT
cache-control: public, max-age=31536000
age: 204563
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 6eac904305f0af9ac8425ba6638af743
6cc700dcc996020985e64492e8d9df7c498d861b
97a04042d25ff5aba9e8e6b99828405fc609275c375530f777a4a5d57e4cede3
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "97A04042D25FF5ABA9E8E6B99828405FC609275C375530F777A4A5D57E4CEDE3"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2248
Expires: Sun, 05 Feb 2023 07:14:54 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 6eac904305f0af9ac8425ba6638af743
6cc700dcc996020985e64492e8d9df7c498d861b
97a04042d25ff5aba9e8e6b99828405fc609275c375530f777a4a5d57e4cede3
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "97A04042D25FF5ABA9E8E6B99828405FC609275C375530F777A4A5D57E4CEDE3"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2248
Expires: Sun, 05 Feb 2023 07:14:54 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
solitudearbitrary.com/watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=&shu=de5f87bf4454b7b48db02f060e88121b2e5bd4792c6bb145f30e46f29a1454acaefdf25dd142d9b55f9faa41c9bb4581f4346b9eeda6e7069b741c12aa6e9dfde93a072e43146a23bd1e55e75d5816ff8c9ff51c5bc89ed3e498090e6f9208&pst=1675579106&rmtc=t
200 OK 635 B URL HTTP/1.1 solitudearbitrary.com/watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=&shu=de5f87bf4454b7b48db02f060e88121b2e5bd4792c6bb145f30e46f29a1454acaefdf25dd142d9b55f9faa41c9bb4581f4346b9eeda6e7069b741c12aa6e9dfde93a072e43146a23bd1e55e75d5816ff8c9ff51c5bc89ed3e498090e6f9208&pst=1675579106&rmtc=t
IP
File type HTML document text\012- HTML document, ASCII text, with very long lines (581)
Hash e3d30eb705a6a2d594214d9a929cb73f
58b3444eeb83e7bb6d28a385d63d3fca033eab31
e6061433f6d8b279705f977cd64cf43e75b801df3446c4ea07745b4c9fa88188
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.626279849734.js?key=3d4d1ebf834071da337ca3d4ccf0aef4&kw=%5B%22dead%22%2C%22cells%22%2C%22the%22%2C%22queen%22%2C%22and%22%2C%22the%22%2C%22sea-codex%22%2C%22-%22%2C%22skidrow%22%2C%22codex%22%5D&refer=https%3A%2F%2Fwww.skidrowcodex.net%2Fdead-cells-the-queen-and-the-sea-codex%2F&tz=0&dev=e&res=12.1055&uuid=&shu=de5f87bf4454b7b48db02f060e88121b2e5bd4792c6bb145f30e46f29a1454acaefdf25dd142d9b55f9faa41c9bb4581f4346b9eeda6e7069b741c12aa6e9dfde93a072e43146a23bd1e55e75d5816ff8c9ff51c5bc89ed3e498090e6f9208&pst=1675579106&rmtc=t HTTP/1.1
Host: solitudearbitrary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Referer: https://www.skidrowcodex.net/
Connection: keep-alive
Cookie: u_pl=16850525; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjg1MDUyNSwiayI6IjNkNGQxZWJmODM0MDcxZGEzMzdjYTNkNGNjZjBhZWY0Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNDAzNzQxLCJwaWQiOjI0Mzk3NywiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyMSwiYWlkIjoyMywicHQiOjQsInBrIjoiZnJzcHNkYWEiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly93d3cuc2tpZHJvd2NvZGV4Lm5ldC9kZWFkLWNlbGxzLXRoZS1xdWVlbi1hbmQtdGhlLXNlYS1jb2RleC8ifX0.Lg3EVt02LVcpoCEc-RsyBGD0ytri0axll8xMwm4oMiM
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.skidrowcodex.net
Access-Control-Allow-Origin: https://www.skidrowcodex.net
Access-Control-Allow-Credentials: true
Set-Cookie: iprc776bfb8f1d183381925b4bcfbd02d85d=2717343; expires=Mon, 06 Feb 2023 08:37:26 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
uncs=1; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
pdhtkv23=true; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
uncs23=1; expires=Mon, 06 Feb 2023 06:37:26 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8df422b0830149472d086fc480b3f1ea
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 98f0950ed03ec36f411e972a9c167b2a
f5da8f3faa05536769ce459ed3028a1f0bec4fb0
9db298b3908012b0310ffc50ae948424d0ec38a8f1f9b6ae09c36a64f596e91b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9DB298B3908012B0310FFC50AE948424D0EC38A8F1F9B6AE09C36A64F596E91B"
Last-Modified: Fri, 03 Feb 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21389
Expires: Sun, 05 Feb 2023 12:33:55 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fee867d660e7db4f404f9d19666d1a06
db98da7eacd4966c62c7f688e10921fc71579bce
6d54bae814fa49d7b9f10b42371f23af095338193032f711af9eef02dd814534
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6D54BAE814FA49D7B9F10B42371F23AF095338193032F711AF9EEF02DD814534"
Last-Modified: Thu, 02 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2288
Expires: Sun, 05 Feb 2023 07:15:34 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fee867d660e7db4f404f9d19666d1a06
db98da7eacd4966c62c7f688e10921fc71579bce
6d54bae814fa49d7b9f10b42371f23af095338193032f711af9eef02dd814534
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6D54BAE814FA49D7B9F10B42371F23AF095338193032F711AF9EEF02DD814534"
Last-Modified: Thu, 02 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2288
Expires: Sun, 05 Feb 2023 07:15:34 GMT
Date: Sun, 05 Feb 2023 06:37:26 GMT
Connection: keep-alive
cdn.creative-bars1.com/sb/notifications/dating/default/us/universal/white/ssp/css/style.css
200 OK 1.7 kB URL HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/universal/white/ssp/css/style.css
IP
Hash f68534e7293b05e0162dce67af1798be
2175563377f3e2c368bcf2939197d786e8cd8f75
92419c3627807c9b6dcd3c2473efb5d4c2933df8057334a131b2c985102f6d35
GET /sb/notifications/dating/default/us/universal/white/ssp/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:26 GMT
content-type: text/css
last-modified: Fri, 27 Aug 2021 12:48:43 GMT
etag: W/"6128df2b-112c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 141295
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qECBSqUoIFhKZ2DuvIPPzJ9p%2B64SER9F1V3MNjW3PDMCsN%2FjBJpFAg2nu3jUB7xYnxq7khDqCuSyGBakMfA7MZvwTw3iydu64DjvJDtPHZ6avZT%2BHGwnOYT3L2XMPbRb4ukH5buPhlIy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3307de97531-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
subscribestormyapprobation.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz28bVRd90%2BZbfHRFRRcsEF6CVDkznpnYbhYVoQRFlCS0hUhICL15743z8PO80XszHifqIqIS6gbJXcFycpwfAirULlkgoQkblFWMEMqC9I9AsEZ2LBmuNHPveecuzrn3frGfXxAXOT3ffF%2FvSqXoYlh3a29syYTrwtbWH9Q8t%2B4u17ZkshQs1waTn%2Bnf8tyw7r5Ze1ewrl5suJ7req5XW5VGxHqwOGUh06dtr95260Gj7oUBBua%2F2OYOLHXA%2BxfkOiQf%2F2%2F7l%2BeQrELSe3ZH2G6m05vv9HJFM23Q58cfJt1EFwl68zI2DuLkeNYNbceEfH0FOjmeOYDuH0wcIJJj4vzuIUqOZzIR9Q8vlUYKIkHEr6HoVxCqgqQVmH4Eyc8IwDjWN5D0jta1KejOJUsn7Jgs%2FP0nZDEmC3%2B8gqT3%2FYqSg9p9rfJM6sRiEJeQgwqyUyHNT5DtOpDFCVj2OSQnSHolJC%2BnrqWsIOMKSgxBrYN88kkHeewgTx30%2BHmNhu3YdZtxFPt%2BK2CM%2BT5jYWuJh9wPWrGLnE1kDZGlQzA1BDN7SM0euvLJWXgdJv8JdruE5Q5sNibOB3vo8xKFICgsQUEJCklQZARFvzzkyjZsecSVzSNvlhuz7JcjnXX26aHOOiIh%2B%2BkFeXkyEsf56zd0xXmtLcKQNQLmNhtuGC1Rf8ln7SAO4jhYorzRhJUlpL0ydbsrx%2BRG9xOkckyu%2FvB%2FRPQEVp2AyRug%2BWugxajZcEG3R0HLxW7yzHYlN7pgmotBPREZuC6RZgvIdpx9dUFena7n1rWbEOz09ldfbrxY5h%2BDmRKpKfGZ%2FJmgox6P7umCHNzThSXPN9JM9uQunazufkYzcfXb98ROoQ1fu2OH37zFJsSkfPpA2OwuTbhMOpZ8tyI5F2ZVGybIj2t2S0Sbud1eyU2Sp3c3315d66VGWCt1UoHKs48egskxeenhp9OjfN0ZQZoKJi%2FRy0%2FJLCB1BZbuwaZz9VYTGDXviVIHRV6OTCOaPypJoMQc06iE%2FReO5vW%2BfYyOcUCzR9NT7JsSfVWCqiFsfnWUpeb09q%2F%2BNBApZxQp4xxEyqgnl6O18rwWeoFoRa0m4zwSjHvNht%2FyXbfBedBsC6%2BNzI7Zi%2FWjfwAAAP%2F%2FAQAA%2F%2F%2BHO6CsbAQAAA%3D%3D
200 OK 7 B URL HTTP/1.1 subscribestormyapprobation.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz28bVRd90%2BZbfHRFRRcsEF6CVDkznpnYbhYVoQRFlCS0hUhICL15743z8PO80XszHifqIqIS6gbJXcFycpwfAirULlkgoQkblFWMEMqC9I9AsEZ2LBmuNHPveecuzrn3frGfXxAXOT3ffF%2FvSqXoYlh3a29syYTrwtbWH9Q8t%2B4u17ZkshQs1waTn%2Bnf8tyw7r5Ze1ewrl5suJ7req5XW5VGxHqwOGUh06dtr95260Gj7oUBBua%2F2OYOLHXA%2BxfkOiQf%2F2%2F7l%2BeQrELSe3ZH2G6m05vv9HJFM23Q58cfJt1EFwl68zI2DuLkeNYNbceEfH0FOjmeOYDuH0wcIJJj4vzuIUqOZzIR9Q8vlUYKIkHEr6HoVxCqgqQVmH4Eyc8IwDjWN5D0jta1KejOJUsn7Jgs%2FP0nZDEmC3%2B8gqT3%2FYqSg9p9rfJM6sRiEJeQgwqyUyHNT5DtOpDFCVj2OSQnSHolJC%2BnrqWsIOMKSgxBrYN88kkHeewgTx30%2BHmNhu3YdZtxFPt%2BK2CM%2BT5jYWuJh9wPWrGLnE1kDZGlQzA1BDN7SM0euvLJWXgdJv8JdruE5Q5sNibOB3vo8xKFICgsQUEJCklQZARFvzzkyjZsecSVzSNvlhuz7JcjnXX26aHOOiIh%2B%2BkFeXkyEsf56zd0xXmtLcKQNQLmNhtuGC1Rf8ln7SAO4jhYorzRhJUlpL0ydbsrx%2BRG9xOkckyu%2FvB%2FRPQEVp2AyRug%2BWugxajZcEG3R0HLxW7yzHYlN7pgmotBPREZuC6RZgvIdpx9dUFena7n1rWbEOz09ldfbrxY5h%2BDmRKpKfGZ%2FJmgox6P7umCHNzThSXPN9JM9uQunazufkYzcfXb98ROoQ1fu2OH37zFJsSkfPpA2OwuTbhMOpZ8tyI5F2ZVGybIj2t2S0Sbud1eyU2Sp3c3315d66VGWCt1UoHKs48egskxeenhp9OjfN0ZQZoKJi%2FRy0%2FJLCB1BZbuwaZz9VYTGDXviVIHRV6OTCOaPypJoMQc06iE%2FReO5vW%2BfYyOcUCzR9NT7JsSfVWCqiFsfnWUpeb09q%2F%2BNBApZxQp4xxEyqgnl6O18rwWeoFoRa0m4zwSjHvNht%2FyXbfBedBsC6%2BNzI7Zi%2FWjfwAAAP%2F%2FAQAA%2F%2F%2BHO6CsbAQAAA%3D%3D
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert quad9 Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz28bVRd90%2BZbfHRFRRcsEF6CVDkznpnYbhYVoQRFlCS0hUhICL15743z8PO80XszHifqIqIS6gbJXcFycpwfAirULlkgoQkblFWMEMqC9I9AsEZ2LBmuNHPveecuzrn3frGfXxAXOT3ffF%2FvSqXoYlh3a29syYTrwtbWH9Q8t%2B4u17ZkshQs1waTn%2Bnf8tyw7r5Ze1ewrl5suJ7req5XW5VGxHqwOGUh06dtr95260Gj7oUBBua%2F2OYOLHXA%2BxfkOiQf%2F2%2F7l%2BeQrELSe3ZH2G6m05vv9HJFM23Q58cfJt1EFwl68zI2DuLkeNYNbceEfH0FOjmeOYDuH0wcIJJj4vzuIUqOZzIR9Q8vlUYKIkHEr6HoVxCqgqQVmH4Eyc8IwDjWN5D0jta1KejOJUsn7Jgs%2FP0nZDEmC3%2B8gqT3%2FYqSg9p9rfJM6sRiEJeQgwqyUyHNT5DtOpDFCVj2OSQnSHolJC%2BnrqWsIOMKSgxBrYN88kkHeewgTx30%2BHmNhu3YdZtxFPt%2BK2CM%2BT5jYWuJh9wPWrGLnE1kDZGlQzA1BDN7SM0euvLJWXgdJv8JdruE5Q5sNibOB3vo8xKFICgsQUEJCklQZARFvzzkyjZsecSVzSNvlhuz7JcjnXX26aHOOiIh%2B%2BkFeXkyEsf56zd0xXmtLcKQNQLmNhtuGC1Rf8ln7SAO4jhYorzRhJUlpL0ydbsrx%2BRG9xOkckyu%2FvB%2FRPQEVp2AyRug%2BWugxajZcEG3R0HLxW7yzHYlN7pgmotBPREZuC6RZgvIdpx9dUFena7n1rWbEOz09ldfbrxY5h%2BDmRKpKfGZ%2FJmgox6P7umCHNzThSXPN9JM9uQunazufkYzcfXb98ROoQ1fu2OH37zFJsSkfPpA2OwuTbhMOpZ8tyI5F2ZVGybIj2t2S0Sbud1eyU2Sp3c3315d66VGWCt1UoHKs48egskxeenhp9OjfN0ZQZoKJi%2FRy0%2FJLCB1BZbuwaZz9VYTGDXviVIHRV6OTCOaPypJoMQc06iE%2FReO5vW%2BfYyOcUCzR9NT7JsSfVWCqiFsfnWUpeb09q%2F%2BNBApZxQp4xxEyqgnl6O18rwWeoFoRa0m4zwSjHvNht%2FyXbfBedBsC6%2BNzI7Zi%2FWjfwAAAP%2F%2FAQAA%2F%2F%2BHO6CsbAQAAA%3D%3D HTTP/1.1
Host: subscribestormyapprobation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Cookie: u_pl=16905685; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d23b3fec4844d018243f1c983856f8e5
Strict-Transport-Security: max-age=0; includeSubdomains
jennyvisits.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=16850525
200 OK 1.3 kB URL HTTP/1.1 jennyvisits.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=16850525
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 1b03e5da59e427f4a2704f121cc3899b
58705fa6836459312f34fa0905fce5d48e634a0e
c51b7649156e85104fb78dfbcbc50a4b6577e906a02c732e87b1da23ada3cc65
Analyzer Verdict Alert quad9 Sinkholed
GET /dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=16850525 HTTP/1.1
Host: jennyvisits.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=16122660; expires=Mon, 06 Feb 2023 06:37:26 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTY4NTA1MjUiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly93d3cuc2tpZHJvd2NvZGV4Lm5ldC8ifX0.t5pFp7qIevwtGYw0GdHbsqRWc0WPsw7WI58UBYiuoVg; expires=Sun, 05 Feb 2023 06:38:26 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2b1df54758d43c8e8b3a614674f11283
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
jennyvisits.com/dyfc1k09?shu=0f8de39b0d633ee15e53c749e0b46ac7ef8fee2a4d55fedf51561d9c7de48bde59bfbaf341ed0e51d2f0e331b6a540d395ba5afc4e075d5050a2b5839534a5b7105e1378af06c068c28b79cc8868cb8c98129ff7c03099b1a76b322410689cc6&pst=1675579106&rmtc=t&uuid=&pii=&in=false&key=863705bcbb4b6a554ddb359665395a6f&refer=https%3A%2F%2Fwww.skidrowcodex.net%2F&psid=16850525
302 Found 0 B URL HTTP/1.1 jennyvisits.com/dyfc1k09?shu=0f8de39b0d633ee15e53c749e0b46ac7ef8fee2a4d55fedf51561d9c7de48bde59bfbaf341ed0e51d2f0e331b6a540d395ba5afc4e075d5050a2b5839534a5b7105e1378af06c068c28b79cc8868cb8c98129ff7c03099b1a76b322410689cc6&pst=1675579106&rmtc=t&uuid=&pii=&in=false&key=863705bcbb4b6a554ddb359665395a6f&refer=https%3A%2F%2Fwww.skidrowcodex.net%2F&psid=16850525
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /dyfc1k09?shu=0f8de39b0d633ee15e53c749e0b46ac7ef8fee2a4d55fedf51561d9c7de48bde59bfbaf341ed0e51d2f0e331b6a540d395ba5afc4e075d5050a2b5839534a5b7105e1378af06c068c28b79cc8868cb8c98129ff7c03099b1a76b322410689cc6&pst=1675579106&rmtc=t&uuid=&pii=&in=false&key=863705bcbb4b6a554ddb359665395a6f&refer=https%3A%2F%2Fwww.skidrowcodex.net%2F&psid=16850525 HTTP/1.1
Host: jennyvisits.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jennyvisits.com/dyfc1k09?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=16122660
Cookie: u_pl=16122660; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTY4NTA1MjUiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly93d3cuc2tpZHJvd2NvZGV4Lm5ldC8ifX0.t5pFp7qIevwtGYw0GdHbsqRWc0WPsw7WI58UBYiuoVg; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 302 Found
Server: nginx/1.19.5
Date: Sun, 05 Feb 2023 06:37:27 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: http://adpointrtb.com/script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304
Set-Cookie: pdhtkv=true; expires=Mon, 06 Feb 2023 06:37:27 GMT
uncs=1; expires=Mon, 06 Feb 2023 06:37:27 GMT
pdhtkv28=true; expires=Mon, 06 Feb 2023 06:37:27 GMT
uncs28=1; expires=Mon, 06 Feb 2023 06:37:27 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 98ebd1bd64bd1c87397fd3beff2e7e3f
Strict-Transport-Security: max-age=0; includeSubdomains
adpointrtb.com/script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304
200 OK 1.9 kB URL HTTP/1.1 adpointrtb.com/script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (710)
Hash 16412ee4e88472b0ef99d834ff8e9097
ffcc1012fe3dd16144199af09bd87f4acb182120
fd803c6e3a6ec61adf0cb925a0a64bfc47528645572ea4117d29993a30420f5d
GET /script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304 HTTP/1.1
Host: adpointrtb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: openresty
Date: Sun, 05 Feb 2023 06:37:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 google
adpointrtb.com/script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304&treqn=42346345&rpn=1&cbrandom=0.040801782154876065&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref=
302 Moved Temporarily 1 B URL HTTP/1.1 adpointrtb.com/script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304&treqn=42346345&rpn=1&cbrandom=0.040801782154876065&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref=
IP
File type very short file (no magic)
Hash 68b329da9893e34099c7d8ad5cb9c940
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
GET /script/s2iurl.php?stamat=m%7C%2C%2CAiKmIjI-tGU3Bv-GH0dEdHP3xP.f08%2Ck6KYXHRURsFongsgb88aoNDz-54Yc1i2Wp6fXiAYIASwbKwkwIQD4E21dSuM-B0ImJitQqyH_j9t3xa5AJIvYmN9Q32WA0vJrouUl4CeJWKrvjhpJfWtgH7FWg7U80QUkF8lMMw2Qs6OpZti164vPUane5-6zFSY41wqHo_mooTewA7TKVMIA0O7BXfIHnkwGbFH6SKywDYrmt-q-JifA3IgbytrZZdPte_IRyZdP-SzXYPeLo1pkoO1bWV9Z2a9vy3FWd3XkzBcuNNZnV2g-NgF5UdJr33_eZFrZdX-pM_h_G4kQ2YLZsLpUauB_jZ28ukDbYiKPMLRGgHKfr0KWGvcbq8A4s9427yGn1LqPHPHOAHRm8avQrh2ZFl_HjoExYvmjrosQlrlCzrgpGvGoU1xGxH_BcbAO4apPbQwmFTiFZScALLoAXzEUugrQgIW2PigfYSZj_X5gTKhSG943d3GM-4EhvmDtJiI0M4t43SMdF2ceQGbXMRRLzh-IsCy&csid=1506755&s1=16122660&md=0&crid=23364304&treqn=42346345&rpn=1&cbrandom=0.040801782154876065&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref= HTTP/1.1
Host: adpointrtb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Moved Temporarily
Server: openresty
Date: Sun, 05 Feb 2023 06:37:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Access-Control-Allow-Origin: *
Location: https://adserving.unibet.com/redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=1506755-640691165-0_Adsterra
Via: 1.1 google
adpointrtb.com/favicon.ico
200 OK 0 B URL HTTP/1.1 adpointrtb.com/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: adpointrtb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Server: openresty
Date: Sun, 05 Feb 2023 06:37:27 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Thu, 10 Dec 2020 09:27:58 GMT
ETag: "5fd1ea1e-0"
Accept-Ranges: bytes
Via: 1.1 google
adserving.unibet.com/redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=1506755-640691165-0_Adsterra
307 Temporary Redirect 0 B URL HTTP/2 adserving.unibet.com/redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=1506755-640691165-0_Adsterra
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=1506755-640691165-0_Adsterra HTTP/1.1
Host: adserving.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 307 Temporary Redirect
content-type: text/html
content-length: 0
location: https://www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953
p3p: CP="This is not a P3P policy! It is used to bypass IEs problematic handling of cookies"
x-aspnet-version: 4.0.30319
request-context: appId=cid-v1:83ffbda4-9458-475e-90ec-4427cfb5c3b0
access-control-expose-headers: Request-Context
expires: Sun, 05 Feb 2023 06:37:28 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Sun, 05 Feb 2023 06:37:28 GMT
set-cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a74340067%2c%22BID%22%3a37953%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1675579048260)%5c%2f%22%2c%22CookieTag%22%3a%223795374340067451240919C202325637%22%7d%5d; SameSite=None;; domain=.unibet.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure
NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%228783754362%7c1%22%7d%5d; domain=.unibet.com; expires=Tue, 05-Feb-3022 06:37:28 GMT; path=/; secure; SameSite=Strict
server-timing: cdn-cache; desc=MISS, edge; dur=21, origin; dur=62
X-Firefox-Spdy: h2
www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953
301 Moved Permanently 0 B URL HTTP/2 www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953 HTTP/1.1
Host: www.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Sun, 05 Feb 2023 06:37:28 GMT
content-length: 0
location: https://www.mariacasino.nu:443/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953
set-cookie: JSESSIONID=node075libcvb1mwu1gtm4w4nsq5ia2340396.node0; Path=/stan; Secure; HttpOnly; SameSite=Strict
__ucbt=node075libcvb1mwu1gtm4w4nsq5ia; Path=/; Domain=.mariacasino.nu; Expires=Tue, 04-Feb-2025 06:37:28 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr=ST.0.T; Path=/; Domain=.mariacasino.nu; Expires=Tue, 04-Feb-2025 06:37:28 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr_ref=; Path=/; Domain=.mariacasino.nu; Expires=Tue, 04-Feb-2025 06:37:28 GMT; Max-Age=63072000; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
affid=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
netwid=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
CLAIM_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
campaignId=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Sun, 05-Feb-2023 06:37:43 GMT; Max-Age=15; Secure; SameSite=None
affiliateId=1; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BID=37953; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
PID=74340067; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
CHID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REFERER=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_ACCEPTED=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_DECLINED=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BOCAID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
PRODUCT_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Sun, 05-Feb-2023 06:37:43 GMT; Max-Age=15; Secure; SameSite=None
campaignId=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=31162891; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Sun, 05-Feb-2023 06:37:43 GMT; Max-Age=15; Secure; SameSite=None
clientId=browser_desktop; Domain=www.mariacasino.nu; Path=/; SameSite=None; Secure
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT, Sun, 05 Feb 2023 06:37:28 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
X-Firefox-Spdy: h2
www.mariacasino.nu/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953
301 Moved Permanently 0 B URL HTTP/2 www.mariacasino.nu/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&sref=ADC&ADC=1506755-640691165-0_Adsterra&affiliateId=1&pid=74340067&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953 HTTP/1.1
Host: www.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; clientId=browser_desktop
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 301 Moved Permanently
date: Sun, 05 Feb 2023 06:37:28 GMT
content-length: 0
location: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Sun, 05 Feb 2023 06:37:28 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-prereq.js?ver=4756
200 OK 6.8 kB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-prereq.js?ver=4756
IP
File type ASCII text, with very long lines (580)
Hash da2a2f912d2c49bb4faf293d4ef2cc28
4f1613cef73539708d8424de36e473523ee27171
3bb0091d8803229761816f9d250eb477dc8198355d6d63e7add5888ba07dbf75
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-prereq.js?ver=4756 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:20 GMT
etag: W/"63bdde36-4e74"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191143
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSk1T5eHHc2vQigAB7QjS6ZRdCKoxtVdJDBjXfySMfSo8DGjDxVnWkaeLSgcuS7qtwM8a7WiaCGEcUonYTLkDLRXUYGzKQSnJ6oCWYLPSQQ1q6V6kvM2nr3FZAEmNLQ8j%2Bc859yLWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319fed6b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/slots.png
200 OK 6.3 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/slots.png
IP
File type PNG image data, 151 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 6be047bdf3d103b2414f7f6ab64d96b8
57818bdfe16383abe584b5c30de5f35eb55ebf20
38e2d3e7f261032cf0c558e28555c6425c30aa14014f31bbaad7d5176b7d4449
GET /no/pop/casino/2022/slots.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: image/png
content-length: 6303
cache-control: public, max-age=900, immutable
content-md5: a+BHvfPRA7JBT39qtk2WuA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4ED5BA7"
x-ms-request-id: da131072-401e-003f-7bf7-03daa1000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e8cc8b511-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/livecasino.png
200 OK 21 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/livecasino.png
IP
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 87dc3fc9a40a9b0e8fd7c0519ac24f54
908b0ca475f8da1d0380a6cb5caabafce2466aec
a0fd031aa160b2679253c5952576a692e002c6be963c5935af3692ff50206eb4
GET /no/pop/casino/2022/livecasino.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: image/png
content-length: 20783
cache-control: public, max-age=900, immutable
content-md5: h9w/yaQKmw6P18BRmsJPVA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4DF7B00"
x-ms-request-id: 2a37beda-301e-0078-10f7-03b1fa000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e8ccab511-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/games.png
200 OK 8.8 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/games.png
IP
File type PNG image data, 234 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash fbd364c184d1c2af246dd5a3079ce9ed
5c572431ced831a518e0c4adfed4372254f1eac1
2a09f891fb138e893fbc2fe522761e47307376143582e41016bf8aa54c4fdb77
GET /no/pop/casino/2022/games.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: image/png
content-length: 8838
cache-control: public, max-age=900, immutable
content-md5: +9NkwYTRwq8kbdWjB5zp7Q==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4D87720"
x-ms-request-id: 56be89e7-801e-0020-22f7-0369a5000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e8ccbb511-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/mga.png
200 OK 1.5 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/mga.png
IP
File type PNG image data, 152 x 60, 8-bit colormap, non-interlaced\012- data
Hash f34e781d7ad22dc774b98ac82a2b46f6
b66cb9753b0f76a7590f62d3c6b8f645bdbae786
7898ba2cec328d50a75400c1e5a6f1f23974f4c0cc433472a24f28a82c7d01c7
GET /no/pop/casino/2022/mga.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: image/png
content-length: 1454
cache-control: public, max-age=900, immutable
content-md5: 8054HXrSLcd0uYrIKitG9g==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4FEBE45"
x-ms-request-id: aeb20fbe-701e-0034-08f7-0321ca000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e8cccb511-OSL
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 98be7fe21d059e46146a43d20c4eea92
1ec58129fea75085588be7b8baec05b0874b5274
7bb2eb5ffcd88a3b6ba7b210bdbcd4469134c9708f06befb6c616beebf8dae46
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/css/rfwbs_slider.css
200 OK 2.2 MB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/responsive-full-width-background-slider/css/rfwbs_slider.css
IP
Size 2.2 MB (2167542 bytes)
Hash 68d4499de9547c42f1d3867ac7f8ecad
3f3be4eca68dd93c4b910855e3b1edf1f2d14abb
1f09913186bc24bd39c82ab4f7aa81235fc4f1c349cc768e0e357387610071e0
GET /wp-content/plugins/responsive-full-width-background-slider/css/rfwbs_slider.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:47 GMT
cache-control: public, max-age=31536000
expires: Wed, 07 Jun 2023 00:33:02 GMT
etag: W/"5f6754d7-840"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21017060
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwp0VBXkQdVAqIyI5yJhf%2B6S9FtQ7uvvvyF%2BoxO5Xi9WTNYPckGVMdgwXYKkJ3DrK5ScVtL8T4yVJfc2Te5bzYCAvh0MgRsGZV7UNKXdENwkvbKgJlgLZ7kFYIXNg32aw8L4AkioOg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3185d4eb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 98be7fe21d059e46146a43d20c4eea92
1ec58129fea75085588be7b8baec05b0874b5274
7bb2eb5ffcd88a3b6ba7b210bdbcd4469134c9708f06befb6c616beebf8dae46
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
File type ASCII text, with very long lines (32030)
Hash 04ba0252a9f264db106d4eaab8df4ccb
cf52d9b3df7839c5c64fbf33aafeced74b3db750
397852429e768ffbd12a78ce4b94f14e3ab4afabf84acb07c0bb5b7798e6e0b2
GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30244
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 Feb 2023 13:13:42 GMT
expires: Fri, 02 Feb 2024 13:13:42 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 235426
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
200 OK 228 B URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
IP
Hash f9f61cf08520dbe652f9085c0c5e1a43
f9333020f4b2f0446c5ce4fd69f14433102a71c5
b27cb6d5a43aa222ba4bb45dfeec4211d1ed558d1d552ec160660c01db213782
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "accfdd9d5be1d7142fabad440365d15f:1554112916"
last-modified: Mon, 01 Apr 2019 10:01:56 GMT
server: AkamaiNetStorage
unused62: 8096267
vary: Accept-Encoding
content-encoding: gzip
content-length: 228
cache-control: max-age=3600
expires: Sun, 05 Feb 2023 07:37:28 GMT
date: Sun, 05 Feb 2023 06:37:28 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
200 OK 13 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
IP
File type ASCII text, with very long lines (558)
Hash fbdf335868cbf423af02de87750c1a45
8405d2f9b1b98d830e1b5bb2d8b9cf31460a9cc4
ddc30198d101ed4d7f85eb14fcc0331154807320fe2b2443b814bedc43c4ace4
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "18eab16a639a4773572307713440a929:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 12666
cache-control: max-age=3600
expires: Sun, 05 Feb 2023 07:37:28 GMT
date: Sun, 05 Feb 2023 06:37:28 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
200 OK 156 kB URL HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
IP
File type ASCII text, with very long lines (55386)
Size 156 kB (156075 bytes)
Hash 013e9070031bb9b874277b7ac7057edd
8547d58735560a50bb68a47b8027159aee68f9d1
847a426ce5f4d35c955b35ba3bc94b883ceeff92a8cacad7148f0a18e14fb9f8
GET /css?family=Roboto:300,400,500,700,900 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 05 Feb 2023 06:37:28 GMT
date: Sun, 05 Feb 2023 06:37:28 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
welcome.mariacasino.nu/custom.js
200 OK 1.5 kB URL HTTP/2 welcome.mariacasino.nu/custom.js
IP
Hash 4834ebf16d3528a8aea95fd9575c6390
6427585ca52bd16c0320c717242c4769c4cdc44a
61c631f467cca19b49d582c0e98afe4b47a4f0f0ac24e880d4cf82acd089cdb4
GET /custom.js HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: application/javascript
content-md5: AaOIILzruhXFCZo/dsUAMw==
last-modified: Tue, 31 May 2022 08:03:43 GMT
etag: W/"0x8DA42DC14A64A3D"
x-ms-request-id: 56b93167-801e-0020-39f6-0369a5000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 407309
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e7cc5b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
dpm.demdex.net/id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1675579088024
200 OK 498 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1675579088024
IP
File type JSON data\012- , ASCII text, with very long lines (791), with no line terminators
Hash 42652f3b06c6a839847be605a2da9903
42073b1419ae0512044438f2fe03e79e1f5f3ed3
28c5437add5f2d0704a2178efce82ec4420d045c19befd50f142d60cc96ce644
GET /id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1675579088024 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v045-0780584f2.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=62739580129362084601901832147210893770; Max-Age=15552000; Expires=Fri, 04 Aug 2023 06:37:29 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: VAaaiOipSWs=
Content-Length: 498
Connection: keep-alive
service.maxymiser.net/cdn/unibet/js/mmcore.js
404 Not Found 10 B URL HTTP/2 service.maxymiser.net/cdn/unibet/js/mmcore.js
IP
Hash 7605968e79d0ca095ab1231486d2b814
a007b420d19ceefa840f0373e050e3b51a4ab480
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
GET /cdn/unibet/js/mmcore.js HTTP/1.1
Host: service.maxymiser.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
accept-ranges: bytes
content-length: 10
server: AkamaiNetStorage
cache-control: max-age=1800
date: Sun, 05 Feb 2023 06:37:29 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/background.jpg
200 OK 162 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/background.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x800, components 3\012- data
Size 162 kB (161606 bytes)
Hash aa279ee357b415f50a16127d5c1a7c4d
d1375a6cb87e60f31f609769044af9e6d47775cd
6aa6656d951b443674e2795a2174f6ba5fa711a0f2943830eab9f07cb1e1a809
GET /no/pop/casino/2022/background.jpg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19394%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1675579088251r0.34888098510351984
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: image/jpeg
content-length: 161606
access-control-allow-origin: *
cache-control: public, max-age=900, immutable
cf-bgj: h2pri
content-md5: qiee41e0FfUKFhJ9XBp8TQ==
etag: "0x8DAD20EA4B90CD2"
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 5e1e980c-701e-001b-01f7-032c01000000
x-ms-version: 2014-02-14
cf-cache-status: HIT
age: 406758
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a341ff54b511-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-MediumWeb.woff
200 OK 49 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-MediumWeb.woff
IP
File type Web Open Font Format, TrueType, length 48766, version 3.6\012- data
Hash f62793caeb7e5b111d7508b00c0826c2
d003c52a07685156de00186014c777b7dde81573
bac888a26184354a6038eb4ba3d87fdc3315c6e7fe0c19ec7cd1737f1720fc5a
GET /no/pop/casino/2022/BlenderPro-MediumWeb.woff HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19394%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1675579088251r0.34888098510351984
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: application/font-woff
content-length: 48766
cache-control: public, max-age=900, immutable
content-md5: 9ieTyut+WxEddQiwDAgmwg==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: "0x8DAD20EA49C613A"
x-ms-request-id: d866c426-a01e-0018-6bf7-03cd65000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406440
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3420f5bb511-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-ThinWeb.woff
200 OK 50 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-ThinWeb.woff
IP
File type Web Open Font Format, TrueType, length 49636, version 3.6\012- data
Hash 37ba84aebad11c2e0acd496eedb0bb76
42942446e1cfab8d0eaf7d23899203b2b2b64fe7
2d7cc2c9c9fef717010fcfa8fa6518079eaec1e63975a74b4fb78afb14d6ee5e
GET /no/pop/casino/2022/BlenderPro-ThinWeb.woff HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19394%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1675579088251r0.34888098510351984
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: application/font-woff
content-length: 49636
cache-control: public, max-age=900, immutable
content-md5: N7qErrrRHC4KzUlu7bC7dg==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4AE38F0"
x-ms-request-id: aeb213ea-701e-0034-5af7-0321ca000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406440
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a341ff57b511-OSL
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
200 OK 30 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
IP
File type ASCII text, with very long lines (543)
Hash d994c7b5e7b348492e630f9e201eed6c
927a06e00f5a9c23d2f9348c013cec4b459effac
7ca2a3f0bb133f07fb5c826b58e48089d90b0ce6e5ab0dce5de73550c5110d80
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "9c4992909a83d52617e9948d1d1c4141:1554112914"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
unused62: 8096267
content-length: 29629
cache-control: max-age=3600
expires: Sun, 05 Feb 2023 07:37:29 GMT
date: Sun, 05 Feb 2023 06:37:29 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
200 OK 1.2 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
IP
File type ASCII text, with very long lines (502)
Hash 0fc50fe0077c2d091ca05aa91daba75f
6a05d944d25fe2dbf36c1fb33a5096bcb1ada25c
4b469a08c52c411065253103c02ea37609c225f2b4c7c3842d90d0c6caa694f3
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "5e8dc588959123c3ee5de9ac168d5c74:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1199
cache-control: max-age=3600
expires: Sun, 05 Feb 2023 07:37:29 GMT
date: Sun, 05 Feb 2023 06:37:29 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-messages/css/blocks/sitewide-notices.min.css?ver=11.0.0
200 OK 1.9 MB URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-messages/css/blocks/sitewide-notices.min.css?ver=11.0.0
IP
File type ASCII text, with very long lines (1406), with no line terminators
Size 1.9 MB (1882799 bytes)
Hash 15531deb06d895c2a23b874732a35f5c
9bca798aab5847adb07fab2e5b41947be148aaa0
47942196fb7fd1a2b68ff9fc774031b340ebbe951e8f6c86ef8c07e7dee41009
GET /wp-content/plugins/buddypress/bp-messages/css/blocks/sitewide-notices.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-57e"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BbKnO4JuWhahS5UNXJLc4u9EliWSmSnn%2BUzYA5NEfkWQTA46mhNneGf7Nv97%2BOKshnRTRNW10%2FBhuoJdqFVzZNeQWqa7JSv4c8gEc7nllK4Cke88uOcDjoCjR5ggOZBTSR%2Bt0b6%2BsA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3184d49b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 29 Jan 2023 22:02:00 GMT
expires: Mon, 29 Jan 2024 22:02:00 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 549329
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 Feb 2023 10:26:49 GMT
expires: Sun, 04 Feb 2024 10:26:49 GMT
cache-control: public, max-age=31536000
age: 72640
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 01 Feb 2023 07:51:59 GMT
expires: Thu, 01 Feb 2024 07:51:59 GMT
cache-control: public, max-age=31536000
age: 341130
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
200 OK 81 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
IP
File type ASCII text, with very long lines (62112)
Hash 46ef186de9342efb3a56bfc39e9c5132
aeede5ec81b1a4396a8b58c7f8622d3e17fdea6e
7f2ea5a5ae33720ec09b4855e865bedecb24263ac083b3675fc7f21214a1c3ee
GET /gtm.js?id=GTM-PF2RVHC HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 05 Feb 2023 06:37:29 GMT
expires: Sun, 05 Feb 2023 06:37:29 GMT
cache-control: private, max-age=900
last-modified: Sun, 05 Feb 2023 06:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81013
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
a10682170820.cdn.optimizely.com/client_storage/a10682170820.html
200 OK 1.0 kB URL HTTP/2 a10682170820.cdn.optimizely.com/client_storage/a10682170820.html
IP
File type HTML document, ASCII text, with very long lines (1979)
Hash 742e155d16b153b32a6122e0a1f9ff2f
b2d28881ba6a69f7e2f6800fba5619d1637ba982
45937bb143dc3304ec902f390a76756c9b0f0c6767e56d91d18e51c969256853
GET /client_storage/a10682170820.html HTTP/1.1
Host: a10682170820.cdn.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 0J2P5mmYXmY5DMElGOlDFe7Kq4tjTxISiTjWuRrqwMV87ZSZJ3WL4lmthaWemyCOxSmEjF8QRgw=
x-amz-request-id: ZRGZEPYWRA11KSBC
x-amz-replication-status: COMPLETED
last-modified: Fri, 03 Feb 2023 21:29:05 GMT
etag: "2be9e732fb8dd542e5774d31acd25f1a"
x-amz-server-side-encryption: AES256
x-amz-meta-pci_enabled: False
x-amz-version-id: sIq4FhM3xCsbT0Ee274fscA2aeaGDBzO
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
vary: Accept-Encoding
cache-control: max-age=120
x-akamai-transformed: 9 - 0 pmb=mRUM,2
content-encoding: gzip
date: Sun, 05 Feb 2023 06:37:29 GMT
content-length: 1041
server-timing: cdn-cache; desc=HIT, edge; dur=1, cdn;desc="AkamaiION";dur=0,rtt;desc="2";dur=0,cdnip;desc="104.110.8.48";dur=0,cdnmap;desc="a4728.x.akamaiedge.net";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash de0607ba9d87be807379e771a4644aed
d8e8758d49c850bb5f08c2b6ed3286fdbe3f6777
2ec7a9a03e64a5906cd3b2f2d833f3286bd6285d821cb7902c900f242f6d771f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4777
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:29 GMT
Last-Modified: Sun, 05 Feb 2023 05:17:52 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 280 B IP
Hash 65c98088e4701014b92506dce1294521
2728ac1aa32724299e3f282f02be669a3df42085
b58b7b23a78d96332728d470affdbc38a6e6b69a3b3c8688c2ad468dfd7afa48
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5598
Cache-Control: max-age=104541
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 06:37:29 GMT
Etag: "63de2e28-118"
Expires: Mon, 06 Feb 2023 11:39:50 GMT
Last-Modified: Sat, 04 Feb 2023 10:06:32 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 280
unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=62778401892925598311903447817915925585&ts=1675579088528
200 OK 2 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=62778401892925598311903447817915925585&ts=1675579088528
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=62778401892925598311903447817915925585&ts=1675579088528 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://welcome.mariacasino.nu
access-control-allow-credentials: true
date: Sun, 05 Feb 2023 06:37:29 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
unibet.demdex.net/dest5.html?d_nsid=0
200 OK 2.8 kB URL HTTP/1.1 unibet.demdex.net/dest5.html?d_nsid=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Hash ccbdcb1e84c241950763ec4cd516cdfc
55dfa8d4b09c5c3a80fcd101152f6ebed3d27a2c
de9ccb9b168945a24f20edc28c39be4135b328129ba8ee378401a7aedc925d12
GET /dest5.html?d_nsid=0 HTTP/1.1
Host: unibet.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Sun, 5 Feb 2023 06:37:29 GMT
DCS: dcs-prod-irl1-1-v045-073c16f88.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 28 Oct 2022 11:07:22 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: EGy93LAVQow=
Content-Length: 2791
Connection: keep-alive
script.crazyegg.com/pages/data-scripts/0012/9242/site/welcome.mariacasino.nu.json?t=1
200 OK 365 B URL HTTP/2 script.crazyegg.com/pages/data-scripts/0012/9242/site/welcome.mariacasino.nu.json?t=1
IP
File type JSON data\012- , ASCII text, with very long lines (704), with no line terminators
Hash 9698936df85dda37c1579ed35e7a0ff2
cf1ee80ae352502c5e68f5957354d357e187501e
f552d71d4a260103d8ab648216fc989bfecadd54397018c530212cd6c9262dc9
GET /pages/data-scripts/0012/9242/site/welcome.mariacasino.nu.json?t=1 HTTP/1.1
Host: script.crazyegg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: application/json
content-length: 365
access-control-expose-headers: CE-Version
ce-version: 11.5.22
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
last-modified: Fri, 03 Feb 2023 18:01:50 GMT
content-encoding: gzip
access-control-allow-origin: *
cf-cache-status: HIT
age: 131739
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a344493ffabc-OSL
X-Firefox-Spdy: h2
unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s61685065199744?AQB=1&ndh=1&pf=1&t=5%2F1%2F2023%206%3A38%3A8%200%200&mid=62778401892925598311903447817915925585&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=6%3A38%20AM%7CSunday&v6=6%3A38%20AM%7CSunday&v11=GBP&c14=New&v14=New&c16=1675579089&v21=Not%20Logged-In&c73=maria&c74=62778401892925598311903447817915925585&v99=62778401892925598311903447817915925585&v120=popunder&v121=1%3A81750185%3A74340067-37953&v122=NONE&v124=2397257&v125=81750185_5E4F679F73FA4B5E9144F8B21663F641&v126=74340067&v127=37953&v134=1675579088&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
200 OK 43 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s61685065199744?AQB=1&ndh=1&pf=1&t=5%2F1%2F2023%206%3A38%3A8%200%200&mid=62778401892925598311903447817915925585&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=6%3A38%20AM%7CSunday&v6=6%3A38%20AM%7CSunday&v11=GBP&c14=New&v14=New&c16=1675579089&v21=Not%20Logged-In&c73=maria&c74=62778401892925598311903447817915925585&v99=62778401892925598311903447817915925585&v120=popunder&v121=1%3A81750185%3A74340067-37953&v122=NONE&v124=2397257&v125=81750185_5E4F679F73FA4B5E9144F8B21663F641&v126=74340067&v127=37953&v134=1675579088&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
IP
File type GIF image data, version 89a, 2 x 2\012- data
Hash ad480fd0732d0f6f1a8b06359e3a42bb
a544538683a2dfe574eeb2e358ac8fcc78289d50
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
GET /b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s61685065199744?AQB=1&ndh=1&pf=1&t=5%2F1%2F2023%206%3A38%3A8%200%200&mid=62778401892925598311903447817915925585&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A74340067-37953%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26bid%3D37953%26campaignId%3D2397257%26pid%3D74340067&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=6%3A38%20AM%7CSunday&v6=6%3A38%20AM%7CSunday&v11=GBP&c14=New&v14=New&c16=1675579089&v21=Not%20Logged-In&c73=maria&c74=62778401892925598311903447817915925585&v99=62778401892925598311903447817915925585&v120=popunder&v121=1%3A81750185%3A74340067-37953&v122=NONE&v124=2397257&v125=81750185_5E4F679F73FA4B5E9144F8B21663F641&v126=74340067&v127=37953&v134=1675579088&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
date: Sun, 05 Feb 2023 06:37:29 GMT
expires: Sat, 04 Feb 2023 06:37:29 GMT
last-modified: Mon, 06 Feb 2023 06:37:29 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3598278609606311936-4619649079232044479
vary: *
content-type: image/gif;charset=utf-8
content-length: 43
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
tapi.optimizely.com/api/targeting/10682170820/11101493565/oeu1675579088251r0.34888098510351984
200 OK 2.6 kB URL HTTP/1.1 tapi.optimizely.com/api/targeting/10682170820/11101493565/oeu1675579088251r0.34888098510351984
IP
File type JSON data\012- , ASCII text, with very long lines (27797), with no line terminators
Hash 7e7becb693b5b2d6099390a34d8fdb14
54e99cc457e752183080e7c93b3be77b0a2182e1
a6fe9437a570e0d2b827e043b84aadcd8e2ab3855c46f2cb7fc861e6db5814c6
GET /api/targeting/10682170820/11101493565/oeu1675579088251r0.34888098510351984 HTTP/1.1
Host: tapi.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Server: nginx/1.15.12
X-Powered-By: Express
Content-Encoding: gzip
Cache-Control: max-age=1200
Date: Sun, 05 Feb 2023 06:37:29 GMT
Content-Length: 2621
Connection: keep-alive
Vary: Origin
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 0d7bf1dd02dbcbee5beadae06bb776c8
6af719afe7dd51caf308c41faf324c6f1d18209c
0cf617ea6cd878b09c899e69043558cea823f1537fb0aad51e0af74b2ecca4d8
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 05 Feb 2023 06:37:29 GMT
Last-Modified: Sun, 05 Feb 2023 05:46:27 GMT
Server: ECS (nyb/1D2A)
X-Cache: Miss from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: UEEU4qYtfxgKJlJ9a6ziSrbIrpH71wwAxT15qG-6TbvZLD7RRvHudA==
Age: 3062
cm.everesttech.net/cm/dd?d_uuid=62739580129362084601901832147210893770
302 0 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=62739580129362084601901832147210893770
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cm/dd?d_uuid=62739580129362084601901832147210893770 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302
Date: Sun, 05 Feb 2023 06:37:29 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~Y99OqQAAAJL18ANn; Domain=.everesttech.net; Expires=Mon, 05-Feb-2024 06:37:29 GMT; Path=/
everest_session_v2=Y99OqQAAAJL18QNn; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y99OqQAAAJL18ANn
Server: AMO-cookiemap/1.1
dpm.demdex.net/ibs:dpid=411&dpuuid=Y99OqQAAAJL18ANn
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/ibs:dpid=411&dpuuid=Y99OqQAAAJL18ANn
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ibs:dpid=411&dpuuid=Y99OqQAAAJL18ANn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.mariacasino.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-2-v045-0df7a788e.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y99OqQAAAJL18ANn
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=35760428477990343741191150695687412222; Max-Age=15552000; Expires=Fri, 04 Aug 2023 06:37:29 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: d9hYXQqRTEo=
Content-Length: 0
Connection: keep-alive
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y99OqQAAAJL18ANn
200 OK 59 B URL HTTP/1.1 dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y99OqQAAAJL18ANn
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y99OqQAAAJL18ANn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.mariacasino.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-1-v045-09e3db1c5.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: FQ7klRHQRCI=
Content-Length: 59
Connection: keep-alive
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
200 OK 1.4 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
IP
Hash ab8cdc21adb95a3014aae857022fdce6
c90f3f115de66b8809a88a667225fa5746ca3dfa
2e3db22559903bd6ba695a18b440ff7eeb0a645dc4ab9257c3605f22d144ca51
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "6444bceb1b767bea75b4f47d793f7b05:1554112917"
last-modified: Mon, 01 Apr 2019 10:01:57 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1388
cache-control: max-age=3600
expires: Sun, 05 Feb 2023 07:37:30 GMT
date: Sun, 05 Feb 2023 06:37:30 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
unibet.demdex.net/event?_ts=1675579089169
200 OK 28 B URL HTTP/1.1 unibet.demdex.net/event?_ts=1675579089169
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash e5bd7bffaebc3b6f39a51600d7d98448
3126b0beaa77359162cadfebc3ae83b4cf5d04f8
3f4e5ede55abc3d3c77d99cdc5019ccfaf8107ac33328b1e4d3b022cb10b15d8
POST /event?_ts=1675579089169 HTTP/1.1
Host: unibet.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v045-03c381005.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=00751893489245393600301151041886071366; Max-Age=15552000; Expires=Fri, 04 Aug 2023 06:37:30 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: ecRNmkhKSH4=
Content-Length: 28
Connection: keep-alive
tapi.optimizely.com/api/js/odds/project/10682170820?project=10682170820
200 OK 168 B URL HTTP/1.1 tapi.optimizely.com/api/js/odds/project/10682170820?project=10682170820
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7b92c056eea084fe960d8794d6c70a77
79318285c26c4220bbaa81aefbca57f091a20461
cc75a166bb638f022304459d8a9060c384b03bdb1892e7e9f15b6cd6f17fd4d3
GET /api/js/odds/project/10682170820?project=10682170820 HTTP/1.1
Host: tapi.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Server: nginx/1.15.12
X-Powered-By: Express
Content-Length: 168
Expires: Sun, 05 Feb 2023 06:37:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 05 Feb 2023 06:37:30 GMT
Connection: keep-alive
X-Uncacheable: WTF
Vary: Origin
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 87018f2954c75d156b0a95b3bc76afd0
4c3ad53a07c88840cc7df325f9a732a9b76df54e
8d02c197cfd865370531e846f600625b47491a3dce3bf45d5c65a5b8d93f4aae
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 05 Feb 2023 06:37:30 GMT
Last-Modified: Sun, 05 Feb 2023 05:11:13 GMT
Server: ECS (nyb/1D05)
X-Cache: Miss from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: o2GtmBRhPkYqkXAH4fS5fpI-wa3PnNiUyLKZ5RG7u1rpIhUWoIcb3Q==
Age: 5177
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 87018f2954c75d156b0a95b3bc76afd0
4c3ad53a07c88840cc7df325f9a732a9b76df54e
8d02c197cfd865370531e846f600625b47491a3dce3bf45d5c65a5b8d93f4aae
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=169527
Date: Sun, 05 Feb 2023 06:37:30 GMT
Etag: "63df2e39-1d7"
Expires: Tue, 07 Feb 2023 05:42:57 GMT
Last-Modified: Sun, 05 Feb 2023 04:19:05 GMT
Server: ECS (bsa/EB1D)
X-Cache: Miss from cloudfront
Via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 2igha6N4e8CHtYgu5hji3u-7eKxyShATlm3JaODm3i2rSWUqsG8vXA==
Age: 5032
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 87018f2954c75d156b0a95b3bc76afd0
4c3ad53a07c88840cc7df325f9a732a9b76df54e
8d02c197cfd865370531e846f600625b47491a3dce3bf45d5c65a5b8d93f4aae
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 05 Feb 2023 06:37:30 GMT
Last-Modified: Sun, 05 Feb 2023 05:10:29 GMT
Server: ECS (nyb/1D0C)
X-Cache: Miss from cloudfront
Via: 1.1 4bbc14b5834fc74ccd249b954b43a08c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: rPPQQNcPYSLRe-CXJ8lyKDRqF07Aecjrq4oPrZ2446pQloOAML3RrQ==
Age: 5221
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 87018f2954c75d156b0a95b3bc76afd0
4c3ad53a07c88840cc7df325f9a732a9b76df54e
8d02c197cfd865370531e846f600625b47491a3dce3bf45d5c65a5b8d93f4aae
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 05 Feb 2023 06:37:30 GMT
Last-Modified: Sun, 05 Feb 2023 05:16:21 GMT
Server: ECS (bsa/EB22)
X-Cache: Miss from cloudfront
Via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: LQwxTM0qGVikD3qclhnb7YXldqwXgCPGnJ_spqXi54xA6DYLdvFh7w==
Age: 4869
errors.client.optimizely.com/log
200 OK 13 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
File type ASCII text, with no line terminators
Hash 1424eb76249899d757e4d168341a50dc
42101e71440abd46c8112a96d4d5c0dd445120ce
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
OPTIONS /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://welcome.mariacasino.nu/
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Max-Age: 1800
Allow: POST,OPTIONS
Content-Type: text/plain
Date: Sun, 05 Feb 2023 06:37:30 GMT
Content-Length: 13
Connection: keep-alive
errors.client.optimizely.com/log
200 OK 13 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
File type ASCII text, with no line terminators
Hash 1424eb76249899d757e4d168341a50dc
42101e71440abd46c8112a96d4d5c0dd445120ce
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
OPTIONS /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://welcome.mariacasino.nu/
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Max-Age: 1800
Allow: POST,OPTIONS
Content-Type: text/plain
Date: Sun, 05 Feb 2023 06:37:30 GMT
Content-Length: 13
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 0bd80dd6d6170bce19caacdf69b4ec07
8a47987b4cf420996a47c496973e3b3f35667ec6
bd2d67ae663a40c6472a709404a804e05b14ef924f8ea977c28f3958d3accebe
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=94829
Date: Sun, 05 Feb 2023 06:37:30 GMT
Etag: "63de0593-1d7"
Expires: Mon, 06 Feb 2023 08:57:59 GMT
Last-Modified: Sat, 04 Feb 2023 07:13:23 GMT
Server: ECS (nyb/1D2B)
X-Cache: Miss from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 1cG6Kh0OcyhWuXx8BJmsiPjUVGsCgd51uc458y9nCMyXDxx0Vz7fzQ==
Age: 6276
errors.client.optimizely.com/log
204 No Content 0 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 435
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers:
Content-Type: text/plain
Date: Sun, 05 Feb 2023 06:37:30 GMT
Connection: keep-alive
errors.client.optimizely.com/log
204 No Content 0 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 480
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers:
Content-Type: text/plain
Date: Sun, 05 Feb 2023 06:37:30 GMT
Connection: keep-alive
logx.optimizely.com/v1/events
204 No Content 0 B URL HTTP/1.1 logx.optimizely.com/v1/events
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/events HTTP/1.1
Host: logx.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 741
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers: X-Results-Data-Source
Content-Type: text/plain
Date: Sun, 05 Feb 2023 06:37:30 GMT
Server: nginx/1.21.0
Timing-Allow-Origin: *
X-Request-Id: 21872118-03e9-42d1-b1ef-597c565b67cc
Connection: keep-alive
www.skidrowcodex.net/wp-content/plugins/bbpressmoderation/style.css
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/bbpressmoderation/style.css
IP
GET /wp-content/plugins/bbpressmoderation/style.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Sat, 30 Apr 2022 22:50:15 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:35 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022547
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DxW%2FOZwUkinIlFV6rxNj7POtrhzXe6hHrTl81Es78K4j6ZAMu3fp4q%2B9dP7AAWMZD7KSZoRS7jhK5ldRfqfNEHAf38gGXc9%2BtuA7kVlDN1bCdv%2BGVDKdjZPdSnYTtxSdHlgGR8hKIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3185d4bb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/favicon.ico
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/favicon.ico
IP
GET /no/pop/casino/2022/favicon.ico HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19394%7CMCMID%7C62778401892925598311903447817915925585%7CMCAAMLH-1676183888%7C6%7CMCAAMB-1676183888%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1675586288s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1675579088251r0.34888098510351984; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1; sessionPageNumber=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: image/x-icon
cache-control: public, max-age=900, immutable
content-md5: dUZ66nye8JES1X2nEnkvHA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA4D12531"
x-ms-request-id: 1b22010b-f01e-0058-65f7-03ca5d000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406487
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a343e882b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tabs.js?ver=1.5.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tabs.js?ver=1.5.5
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tabs.js?ver=1.5.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=31536000
expires: Sat, 20 Jan 2024 01:26:31 GMT
vary: Accept-Encoding
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1401053
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2F4Qzvh424vR777RSWJLj4VxFecCaQCcdKrDHY%2Bn5Co8tOkbgb8KenkIlxprJ%2FPXE9fDNH%2B5GKSXXYMbOsDxX3cBIOpBdodWWH5hWxcpwRsBKyImpm3wtEk9%2BW7SVnPjEy%2B7lPw54A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318adb1b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/utils.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/utils.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/utils.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:49 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 19:12:10 GMT
etag: W/"6381e8bd-748"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2460313
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J5E0%2F%2BYFVzHAL98hexX05ys2LnMA2sFSnIFasBJwua08nqhK97nGujOelKjioPZlyIw9xTQZdRyMGKUhEGD%2BukgE6BxOo6wDItJPKrYIyJk64x8KKs9izdrKoEqlj6pAgQnvPoQOMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdc0b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/group.min.css?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-groups/css/blocks/group.min.css?ver=11.0.0
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-groups/css/blocks/group.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-7ed"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=46yfQ2nzL7nUWGGbno1jWTfusZ4hZkbmPV7xI7PtD8tHQa1NELIR9n9NflnLXUa2gfPc%2BqWJDeiiO9juPuoAcukV%2FJ284wWD%2BVbeEsHY2XzVwyqDIEjxd59aXlC9y3uQ64daI%2F8yEg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3184d45b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
200 OK 0 B URL HTTP/2 c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
IP
GET /v1.0/cmp/portal.html HTTP/1.1
Host: c.sharethis.mgr.consensu.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Sun, 05 Feb 2023 05:42:29 GMT
cache-control: max-age=3600, public
etag: W/"3a06-5IC5GomJdIO1QMFFecGlooy3O1I"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: Z8bNS5_pTWYs-p6avCPj2GFJUw47HwmxECSqecGTGFdGOV2weAbTyA==
age: 3444
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/comment-reply.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/comment-reply.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/comment-reply.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 31 Jan 2023 06:55:09 GMT
cache-control: public, max-age=31536000
expires: Wed, 31 Jan 2024 07:12:47 GMT
etag: W/"63d8bb4d-ba8"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 429875
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UWAepVOK3CYZ7ruPoizVmu%2BDhHRBV0s6W%2Bvij1rPXXAKq%2BuO8iZl3%2FPJJy92Oztj%2BQH%2FHCJENTjMtBKZt16bNnTXKlyo4%2BxPcc4Ac3WuCGJ0%2FctPpqimKHIgLlQh3StmJVV8FNMpRA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3198e50b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/countdown-timer/js/webtoolkit.sprintf.js?ver=3.0.7
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/countdown-timer/js/webtoolkit.sprintf.js?ver=3.0.7
IP
GET /wp-content/plugins/countdown-timer/js/webtoolkit.sprintf.js?ver=3.0.7 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 05 Jan 2022 14:58:08 GMT
cache-control: public, max-age=31536000
expires: Wed, 07 Jun 2023 00:33:02 GMT
etag: W/"61d5b200-864"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21017060
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ov8tkI5TXHwdAemD9X%2FGrVIFsIWGM1C3UxS7HkgsviwNS7ichLiPa7hEI%2FgPbe2NR5i8Y7P4qQzJNSYfGXnKikIl0U8q57JallY93iD4XxkB%2FjC%2BCYvO6222Av5dmrMgBC4qYT%2B2Zw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318cdc6b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/media-editor.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/media-editor.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/media-editor.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 25 May 2022 22:03:40 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 22:15:02 GMT
etag: W/"628ea7bc-2a9d"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21025340
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DFLWlrDIVAFY%2FKc73EBR3jfvBl94HFPHU0PCTrIoREAZxXEOZWbCAGRdYZxee3%2FCv3Kia3zu8lPc%2BoODWDlm%2BoHuSTCewCSlyxUlg5ZELe3lJFeHpWPQ8%2FckhTJqD9KA2InjYifMyg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a319fed4b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/css/blocks/login-form.min.css?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/css/blocks/login-form.min.css?ver=11.0.0
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-core/css/blocks/login-form.min.css?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:09 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WtSHj4564MCJW33oG222%2BTIGROT4R9W82jr72dKBBPJxoNGamnIDThR%2BqSUB0vNamRs9%2BocnbCVdOm65KV5uazIE%2B4xSpbiUtLTnSw%2BPdkJpAOQ60DYtqbk6KVApKFmPC%2FHxEKp4tg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d21b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/bbpress/templates/default/css/bbpress.min.css?ver=2.6.9
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/bbpress/templates/default/css/bbpress.min.css?ver=2.6.9
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/bbpress/templates/default/css/bbpress.min.css?ver=2.6.9 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 30 Apr 2022 22:47:23 GMT
cache-control: public, max-age=31536000
expires: Sun, 30 Apr 2023 22:56:51 GMT
etag: W/"626dbc7b-761c"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 24219631
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JhFuma%2F73SxNT6PO7Yj5HGolhJL3Glnkb0T%2BG55Dy4lU8l4MNNdytGZCmH26Jcr3pZZhg7NRTzMiiA0nd6q1EIw6H95EwMPFqfLJGSk1gLA7l%2B4aGsl8p1nG6mvgjI%2F2USRskwliEw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3185d4ab512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-core.js?ver=4756
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-core.js?ver=4756
IP
GET /wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-core.js?ver=4756 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:20 GMT
etag: W/"63bdde36-9b34"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191143
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x4ZWVqVC6Dd4xHiTpnj7BO9cks0FXgOp6gwn1xe%2BgViDTutCh7VAEh84DMftUwudUfQzZ76Ig%2BCnbP%2BD6stfo3aGaSX6YkSbN6yWIHSnh5CYZIT3FTr7lTXBkQk8Pj5vqmAU9%2FxN0w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a0edab512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/woocommerce.css?ver=20160930
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/woocommerce.css?ver=20160930
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/css/woocommerce.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:36:01 GMT
etag: W/"62d880ff-79a9"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455282
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FYG%2F2sGCwOLhOR25j2ld6gXrqIPmlVgbPY3yehRDSXJKi9F9SSU9s703Xyx52TzojSZDsNsOu6%2B6%2Bl%2BMSRhe5tAvn7l6kqLFMzD6kySQToLytU6Toay5PIc6v19o0njFTlquSGkxxA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3187d65b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-templates/bp-legacy/js/buddypress.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-templates/bp-legacy/js/buddypress.min.js?ver=11.0.0
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-templates/bp-legacy/js/buddypress.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 31 Jan 2023 06:55:07 GMT
cache-control: public, max-age=31536000
expires: Sat, 03 Feb 2024 23:32:59 GMT
etag: W/"63d8bb4b-853a"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 111863
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MzE81dnFCm7KdCE%2BR5XsQx0Jtll8Hz7Bm241g4FUo1MFMwzy%2BwOqsQ5qu9E6BOJGbPRSMukagT%2Bg%2B%2BJdoHoXjD9hYD7yjCI4JHaMRF8d9sUmikLcNlSzio8s8PPuP%2Fn7AQcSSk%2BoDA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318bdbfb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/wp-embed.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/wp-embed.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/wp-embed.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 23 Nov 2022 08:38:23 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 26 Nov 2023 02:54:06 GMT
etag: W/"637ddbff-5f6"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 6147704
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOdDPv4aqAjjzVe4uzNFsdGAITVFiKHBjFVV55xuNLzIxauLHrGrpryvhip5xZuCgCKLWbx5PHluqSZrCs%2Byu5kob0W7I%2Bdv6pPDymrI%2BgHSQ5B%2BiDOGSMGb7g2b7ymhZQ9FnSlB%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a1ee5b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/no-payments.svg
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/no-payments.svg
IP
GET /no/pop/casino/2022/no-payments.svg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19394%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1675579088251r0.34888098510351984
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:29 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: eFf1+jVlHZeVusUSI4yq9A==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA5185D10"
x-ms-request-id: 6aee9ace-401e-005d-3bf7-031886000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406720
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3430ff9b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-cookie.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-cookie.min.js?ver=11.0.0
IP
GET /wp-content/plugins/buddypress/bp-core/js/vendor/jquery-cookie.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-4cd"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NuakPX0a%2FIhWVNTrfzHYusFQLUWR0yKfaziXQ1OWA6zLYUozwUz%2F18FEvYlXjep0d2zdhUNXRlwAqUVq5%2BgNGmnO%2BxdxJm1OHKodO0w95JiSmOO7UDFBjV3xraQKCSLLFeNCls765g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdbcb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/styles.css
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/styles.css
IP
GET /no/pop/casino/2022/styles.css HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: text/css; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: nHGY+uZf3VZaIBaHkSPKCQ==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: W/"0x8DAD20EA45DDAAB"
x-ms-request-id: 4ad10bc9-001e-002e-3ef7-034015000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e7cc0b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/css/dist/block-library/style.min.css
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/css/dist/block-library/style.min.css
IP
GET /wp-includes/css/dist/block-library/style.min.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:48 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 19:54:19 GMT
etag: W/"6381e8bc-13abe"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2457784
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KlV6jqwbPsmd86bWAM2F1SMpLPp3b6sW83DBmbnIp0TkDWBL7L%2FPIVzuwbXfH5P6Hs3WfjLaR6X9yiGfD1KviPmwPYCFLCcOYqij%2FDR6z11ZHAVxMEG%2BUQhtReu43J6bFMPR3MoP8A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3183d1fb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
IP
GET /wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 11 Dec 2020 23:33:05 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 22:15:02 GMT
etag: W/"5fd401b1-5c79"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21025340
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWE6u2U6HxilGvNV%2Fipg6s%2FuBKoQGvOOLj3w4dBocCC0lq5stVAFZEsDkTHjcTlKU3yHsPMTJesPERa9TYoMJVzC7fQWCWkujYVVQL58w%2BTN4%2BF09SEyxi82yIRkrw131o3zoHVSkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318adaeb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddy-bbPress-Support-Topic-master/css/bpbbpst-bbpress-widget.css?ver=2.1.4
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddy-bbPress-Support-Topic-master/css/bpbbpst-bbpress-widget.css?ver=2.1.4
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddy-bbPress-Support-Topic-master/css/bpbbpst-bbpress-widget.css?ver=2.1.4 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 30 Apr 2022 22:49:15 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 22:15:01 GMT
etag: W/"626dbceb-41c"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21025341
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qkf4uq5uvKFp%2Fqa6UBbbwJduvhjyH0P5kAgvJYYCacYO94fTKl0jR%2FU6rUh5yb2494kAol3R7UbhExhhirT63UfSacJ%2B3Qf8TjxBI9PMh1Rwmebu33BIHqQI2sw0IEhslYAIejYa%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3188d9bb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/dist/hooks.min.js?ver=a7edae857aab69d69fa10d5aef23a5de
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/dist/hooks.min.js?ver=a7edae857aab69d69fa10d5aef23a5de
IP
GET /wp-includes/js/dist/hooks.min.js?ver=a7edae857aab69d69fa10d5aef23a5de HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:48 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 26 Nov 2023 10:22:34 GMT
etag: W/"6381e8bc-1540"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 6120796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SClhKOx9v9Gabv7xpeDBeqdjegqgmsdE6R3l08jwx6QXErhAYhTgEaYYSeXwnwnrfNnz1gPN1oU6a5ny5hFC20tfHil%2FlOCmGGaxjRW7TD6F8baowW6RjrM1ym1H%2BikdKNTb%2B78TvA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319eebdb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/main.js
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/main.js
IP
GET /no/pop/casino/2022/main.js HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: HUKMSjGdEVR6I7ylcruk3g==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA4F7BA6F"
x-ms-request-id: 5a127d26-401e-0062-37f7-03d025000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 268190
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e7cc4b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/google-captcha/css/gglcptch.css?ver=1.70
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/google-captcha/css/gglcptch.css?ver=1.70
IP
GET /wp-content/plugins/google-captcha/css/gglcptch.css?ver=1.70 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Sun, 11 Dec 2022 10:09:58 GMT
cache-control: public, max-age=31536000
expires: Mon, 11 Dec 2023 10:10:15 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 4825518
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=smNzpk1hCqxrqru8aln3gc6E65vVwV%2F0Rza0HG71U8NbR3RMIEsX9oCgqgN2jef7aFzjllw40Qn3%2BFuS%2B3FjfDxN%2FP914CCp3GVFA90ruf1fE38c6%2BhKzMeSqMXTGrVrj8CsWJ76Vg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3198e4db512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/clipboard.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/clipboard.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/clipboard.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Nov 2022 10:21:49 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 26 Nov 2023 10:22:34 GMT
etag: W/"6381e8bd-296f"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 6120796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QiHnJexuVhbL70VpGgMt6e5BPH4qEYmX53jYowEsNAVZEno0vnaBHgLuBwcbss3WQRh7HbRyPCHrrqeeMfudgcJdPzi22cD6vsJsz550A%2BrIF0YOepVXQoDYud7WjQsONGz8UUq1PQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319fecfb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/dating/default/us/universal/white/ssp/js/script.js
200 OK 0 B URL HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/universal/white/ssp/js/script.js
IP
GET /sb/notifications/dating/default/us/universal/white/ssp/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.skidrowcodex.net
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:26 GMT
content-type: application/javascript
last-modified: Mon, 05 Oct 2020 09:08:48 GMT
etag: W/"5f7ae2a0-182"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 141295
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N5Nhe5GWXcTq7unO7G%2BuuD0EarFJGVfSswDnEWBMRIy4CvgqPbqtZfBZ1L%2FoCCFT%2FCaRExipzc6aQ0vFyKGCajxuCnAIugcfWLEBv%2BN9O7V9fb%2BXk38%2FHNlLGMoH6LBiFJjm144ybFnk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3307dea7531-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/css/site.css?ver=1.5.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/css/site.css?ver=1.5.5
IP
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/css/site.css?ver=1.5.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:35 GMT
etag: W/"5f6754da-1548"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022547
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PqD62yeo1F5lNlAIKvLuZHYz0RRpTvqwoh8OpMwHgkbWvlXVA4i%2BmiGVkRKeDzNkObFqUbVUhSWRPIK5SrtEQlX6MgnVe0clEydMCmW%2FT1z1lhSV3VL75Y65Sni778uC8VRQY1IFMw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3185d50b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/public.js?ver=1.5.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/public.js?ver=1.5.5
IP
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/js/public.js?ver=1.5.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:36:01 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455282
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uAx%2FEc1SeC9fvCIlyn0IxEoolwAmfsBuKXAzUJe%2FD3DZbngvavJJmLtGLoaOZXJ%2BmZL%2BLPdt04jb8XVwqWKCFlEdmo%2BIdYQ3fV9DaB6WrPSqAGiGOblXkx12hF7eFlJn%2BHPqCbsH6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdb4b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-scroll-to.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-scroll-to.min.js?ver=11.0.0
IP
GET /wp-content/plugins/buddypress/bp-core/js/vendor/jquery-scroll-to.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-8e1"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gQxFdkftN6Jz7IFEK0fPJ3PVSQdXCcTE%2BaReu1TcshmJTCJchLySHDR9xIZZyRjmCVBPXtYGljKgEJvY338WqlZWA4JKOMW97UQajBLyTesH97zCs3NRI%2FzGo1t6kHWIP2dmnN9jpw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdbeb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/google-captcha/js/script.js?ver=1.70
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/google-captcha/js/script.js?ver=1.70
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/google-captcha/js/script.js?ver=1.70 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 11 Dec 2022 10:09:58 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Mon, 11 Dec 2023 10:10:15 GMT
etag: W/"6395ac76-23a9"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 4825518
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FLK8GpUcXw39h%2F2Riszxu%2FQaBxk95QqdbxYjw9x2FjCLsPirqsS%2FqzIHHDxEm00U0WPbaoLJc00abpc4YDhirmHpCMtf722gcjdVBu9kiEsnHCPCTOJUUE0hjsWp87VCmj6oEr9Tig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a1ee8b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
IP
GET /no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067 HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: text/html; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: L2akXslp2trAwResQfYe7w==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
x-ms-request-id: 94d4715d-d01e-0012-732c-3969d2000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: MISS
vary: Accept-Encoding
set-cookie: btag=81750185_5E4F679F73FA4B5E9144F8B21663F641;max-age=2592000; domain=.mariacasino.nu;path=/;secure;samesite=none;httponly
server: cloudflare
cf-ray: 7949a33dbc11b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/maria-logo.svg
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/maria-logo.svg
IP
GET /no/pop/casino/2022/maria-logo.svg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:74340067-37953&btag=81750185_5E4F679F73FA4B5E9144F8B21663F641&bid=37953&campaignId=2397257&pid=74340067
Cookie: __ucbt=node075libcvb1mwu1gtm4w4nsq5ia; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_5E4F679F73FA4B5E9144F8B21663F641; BID=37953; PID=74340067; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_5E4F679F73FA4B5E9144F8B21663F641%26sref%3DADC%26ADC%3D1506755-640691165-0_Adsterra%26affiliateId%3D1%26pid%3D74340067%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_5E4F679F73FA4B5E9144F8B21663F641
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: A/evXSZJMSEi63VEXU58wA==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: W/"0x8DAD20EA476B63E"
x-ms-request-id: 5a1280b9-401e-0062-10f7-03d025000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 406692
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a33e7cc6b511-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/css/style-simple-red.css?ver=4.11
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/css/style-simple-red.css?ver=4.11
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/ajax-search-lite/css/style-simple-red.css?ver=4.11 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:19 GMT
etag: W/"63bdde36-29c1"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191144
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g0n3QauwJqH84I5DqeIXgA%2FH4Cl678YrM6sfa9e4OO%2BWkgKmCX%2BpwZfUfqiytRgUDR%2F7TpDqTVeHnDxAycZpr1He2uGud%2BTrnd9NBNwRAGChwRNTQxcJjC8urIKWuGoZUrLzjDCNSA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3188d9ab512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-results-vertical.js?ver=4756
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-results-vertical.js?ver=4756
IP
GET /wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-results-vertical.js?ver=4756 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:20 GMT
etag: W/"63bdde36-566"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191143
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NE5DnOg4Oq8sImpOZj5iRTeKn8LR8ZT4XjFDbc2JiE6XPqtwQR3Vta%2FRMZ8M%2B%2Bs32n8ayLHb4s7hKw8ELj9ckzbqBVeKLCYTfonmeoYLw3OonXBPgqpYWCkv1%2F2P0zTtdptNX%2FdDFw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a0edbb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/jquery.cookie.pack.js?ver=1.5.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/jquery.cookie.pack.js?ver=1.5.5
IP
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/js/jquery.cookie.pack.js?ver=1.5.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 20:37:25 GMT
etag: W/"62d880ff-421"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2455199
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ocXmyx1cUA%2F6agMPc1ESJSi8bT1oWM%2FN3a4guBLrLBfhRG9fDWHupMB3389q0iTg1%2B%2Fo5z6O%2FE3HPwrgwgSKrA3NzIx%2F%2B6kRLGdcmM%2FvSeZJq1q%2Fh0hqbg73Xa6gfgrTuBJ6cHdHYA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318adb0b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/plupload/moxie.min.js?ver=1.3.5
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/plupload/moxie.min.js?ver=1.3.5
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/plupload/moxie.min.js?ver=1.3.5 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 31 Jan 2022 17:44:17 GMT
cache-control: public, max-age=31536000
expires: Thu, 02 Mar 2023 03:17:52 GMT
etag: W/"61f81ff1-15666"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 29387969
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDPaAkWBDhk2HqgtBsVoalMWAwqMyOeKg1jb1MbDp2V0TK2QhiAFHU%2BSD%2Fcoem%2BlnxOBbaAt4owTY1uKxdrfnwm39iK0UB%2Fanh0h6tq6XWJlw5%2FFjRBJaLiK1QmMQYp3CkgxRzjI3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318bdc1b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/js/jquery-ui.min.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/js/jquery-ui.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/js/jquery-ui.min.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 04:17:15 GMT
etag: W/"62d880ff-d6cb"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1477209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLpZEZ3crtTFWjGyAmc%2B5xiHj2IvyomFJOsIm7JaHimthmaBl41gcJnkEuzHRHgc3Pm%2BtZpGFiiLvznAWVWcNx3%2Fpip2NDTYbo9o8GFhUV%2FcE8f0pmWMVqIpqCih8mVzBnaS82kgiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3199e6eb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-wrapper.js?ver=4756
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-wrapper.js?ver=4756
IP
GET /wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-wrapper.js?ver=4756 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 04:17:15 GMT
etag: W/"63bdde36-13c9"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1477209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8MpzrZgtebNrqGWjL9ixuisptZxnlV8BjJ4fO%2FiuD4mwj9y7ofgfS%2FH5yUcZOz%2Fe3TpcW%2FXX9xoybgexwVI40xjvuTZfW%2B%2FnrHfoRjX0ogkHPvffcvBNvGWaY476N5JkNqC0ac81g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a0ee0b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
IP
Analyzer Verdict Alert fortinet Malware
GET /dead-cells-the-queen-and-the-sea-codex/ HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.33, PleskLin
last-modified: Sun, 05 Feb 2023 01:46:54 GMT
vary: Accept-Encoding
cache-control: max-age=0
expires: Sun, 05 Feb 2023 06:37:21 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WFYQ5i6x8SSbwyEec%2B%2BTsDLLPFnlBmrzOIsaG%2B38PQn%2BxnVIgjUzrgXGmToZrZu9GTpTUkLEmd8TfYfGwfELUbfSIoPM7Y4b%2FaxL1AsAIGYU08CsxFiZJ2DtSKZqs%2F%2BKyp4zWrz6Rg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3162be3b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/confirm.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/confirm.min.js?ver=11.0.0
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-core/js/confirm.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5OT%2FKnxhsraQBHIdA7H33e6Z%2FmmyT2BfBJ51IDeqYDMOAa7qTmlbZ2LPeDhrIWxvmzA55j%2BTul77wIcBCNCjdSuVxKOfPkvaKM8jOLwPyE8K20Zt1KDA%2FagqBYPt9vf28VtZtm1Egg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdb6b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/plupload/plupload.min.js?ver=2.1.9
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/plupload/plupload.min.js?ver=2.1.9
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/plupload/plupload.min.js?ver=2.1.9 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 25 May 2022 22:03:40 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:36 GMT
etag: W/"628ea7bc-3cfc"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uAhnWbJvxqqJfkhb%2B%2BY7yIRTP0BvjruyX1IPdqSVDxipoZC1vSQGjIInukRtpH81N%2BuEbMI5oG4SjT1br9tIytmgOWPxMWBVkgr%2BwkbAoN976cj1Qh4O02fcBtQ%2BeSVbdcj2kDwjMw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318cdc4b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/countdown-timer/js/fergcorp_countdownTimer_java.js?ver=3.0.7
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/countdown-timer/js/fergcorp_countdownTimer_java.js?ver=3.0.7
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/countdown-timer/js/fergcorp_countdownTimer_java.js?ver=3.0.7 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 05 Jan 2022 14:58:08 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:37 GMT
etag: W/"61d5b200-12da"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HQ0kH9hWKYHuxk8qB843f%2FOQlB2xPvAP3IvTRdddqRjijEEYiKNUBhGCcXcjI2sS33sYdg%2Bry7uedMLHAwtB84PF5QxMgwM7UPTuimZ1I%2FzK7jAQQMDW%2FViCw4n7XhRmS2ZPHw5oSw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a31a0ee4b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/bootstrap.css?ver=20160930
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/css/bootstrap.css?ver=20160930
IP
GET /wp-content/themes/skidrowcodex-main/css/bootstrap.css?ver=20160930 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 21:32:27 GMT
etag: W/"5f6754da-1fbf3"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21027895
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7klLVFJoPAXonFJWXKH510eeANbpUUWcdJzTB7PlpIGrj%2F6zVQ2pJGU9P4DW2la9VMMOOaM2m%2FRuA56GsvkEzDeTWswP6n6E1v5b%2BFRRLu0QQX%2BVVML%2B1gj6zE2oQpx%2BjizEvRYVXA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3187d62b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/jquery-query.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/jquery-query.min.js?ver=11.0.0
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/buddypress/bp-core/js/jquery-query.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8VSSGVUDoGfCf1TlRdrkB%2BHFGPNrCkhPHzvlV0q%2BPUYnnR1OUGE5Mrg3MU8zvUA6mLQFca3RIrzhrkTSlp72Q9Ifv9tFAMsyeydAYhkFK992wzw2su%2FGdFqaaxINIIdhKBeU6klyjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdbbb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-child/style.css?ver=20150401
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-child/style.css?ver=20150401
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-child/style.css?ver=20150401 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Fri, 20 May 2022 17:10:46 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 23:01:35 GMT
etag: W/"6287cb96-679a"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21022546
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2FmYYE0xq%2FkrE1X8TBxWCdN9%2FjB1%2FxiFbZRdj90TVo6E1RGrgF78ZlIZ7WL1XMcqb7KAR2Jj0SqEGIMAKfPAtY96h7COsAQ4h3fDZ4u8E%2FPqLjG3KjAc6CSYc0WDIE8%2BIiYuqAcTLw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a3185d4fb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-child/style.css
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-child/style.css
IP
GET /wp-content/themes/skidrowcodex-child/style.css HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 31 Jan 2023 06:55:07 GMT
cache-control: max-age=31536000, public
expires: Mon, 05 Feb 2024 06:37:22 GMT
etag: W/"63d8bb4b-6871"
x-powered-by: PleskLin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FpT%2BEPOXplP72xFeGpVK6EtRCSU1MqHSLI5fFbMoAZ%2BGm6GuvQR13aXurCzUcZciQhTdmIud4YvYuK0ePl3JG8rd4EQDn8v5xtoqmCwMCv7Ao4LedjEakO7IyXsZVcTq1KQ9pBytcw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318ada9b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:08 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 26 Nov 2023 10:22:34 GMT
etag: W/"62d88100-2bf8"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 6120796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8gV%2BxJz1oGlHoOzqpMX73jNdkv%2BfAIiEb%2B8mjffRE4uCZyBO0zPfY9AALW13kzj%2B2QM%2BH2fqlQM39wqSarOaaLgNlwjPqQjCG6cb%2FLQmUambOz8x4GuI7buqqBc0jATQIZnrVN9m9g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a3188d93b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/widget-members.min.js?ver=11.0.0
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/buddypress/bp-core/js/widget-members.min.js?ver=11.0.0
IP
GET /wp-content/plugins/buddypress/bp-core/js/widget-members.min.js?ver=11.0.0 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 06 Jan 2023 08:34:10 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 09:01:19 GMT
etag: W/"63b7dd02-4ae"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2583225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dY8xJgD0%2FuR18cz8ozI3nvSK81IMi%2FbCejxnAXhohTUO7D7f0CBzWnIaNxfQzlHanh9yngMSuYL52PsDVNSnEiprW6%2B7E62YBYorIjIVpCF2l5T0QjB1qVvJpZ3ps1%2FD8ymIw4PdDw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318bdbab512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/js/transit.js
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/js/transit.js
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/themes/skidrowcodex-main/js/transit.js HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:07 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 19:54:19 GMT
etag: W/"62d880ff-1d53"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2457784
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kwMkfOKr%2FUVoWhP%2B3rpIklGOK8%2FweIRkOdASohIGjUuWQvqRrANh3cBlQsHrSe2Tby4hbdoLSakK0f%2BDCxyRpRO9Kkm7Vceky8VoBp1rMzh6KxoRM6lFmKl0cD0Y3VkWnE1REH7dNA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a319be89b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
IP
GET /wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:06 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Fri, 19 Jan 2024 03:10:29 GMT
etag: W/"62d880fe-17a56"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 1481215
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RyKM7BmmmHzeK6ZHu9P8g5oHu78LTLCnmyFOt8%2B2ibgOmKQTrZB07KTDREQK9g1x%2FLXaYEIY4Zu49vFhBROVmYGYb%2FA2BToXsojUNnFoa5zN3WVuroPxL0IgwmFaz%2Fs9YkAoOt6I4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a318adacb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/jquery.tipsy.js?ver=0.1.7
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/jquery.tipsy.js?ver=0.1.7
IP
GET /wp-content/themes/skidrowcodex-main/addons/clan-wars/js/tipsy/jquery.tipsy.js?ver=0.1.7 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 20 Sep 2020 13:10:50 GMT
cache-control: public, max-age=31536000
expires: Tue, 06 Jun 2023 21:32:26 GMT
etag: W/"5f6754da-1113"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 21027896
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zdyfBRHBnfnI8ylxDJD26uTr7%2FmzO8XRZm4vg%2BCwKdMAmDT0qlgW4VngIi5zeMvg1fbUoHbs0cp3ohVLwzf7VZ0WjSWyWMa7laQTnm%2FZh%2F2Xgb9wV3EfFuSoHbNKA0%2BqLVPekWjykQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7949a318adb2b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-load.js?ver=4756
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-load.js?ver=4756
IP
GET /wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-load.js?ver=4756 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-accel-version: 0.01
last-modified: Tue, 10 Jan 2023 21:52:54 GMT
cache-control: public, max-age=31536000
expires: Wed, 10 Jan 2024 21:58:20 GMT
x-powered-by: PleskLin
cf-cache-status: HIT
age: 2191143
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lioyVpSTg7IDgL%2FgeZjVyQea2BctP0UubBva09b5wecPTD9l8WyqEBixwRXlDjJvpX80ARKjCFoE0w9AukZqGhIBIGZrn0%2Bq1N9YSr9xSrW58%2BBGifxusdNfEO2xrPRnHep%2Bduc6A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a0edcb512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-content/plugins/google-captcha/js/pre-api-script.js?ver=1.70
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-content/plugins/google-captcha/js/pre-api-script.js?ver=1.70
IP
Analyzer Verdict Alert fortinet Malware
GET /wp-content/plugins/google-captcha/js/pre-api-script.js?ver=1.70 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 11 Dec 2022 10:09:58 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Mon, 11 Dec 2023 10:10:15 GMT
etag: W/"6395ac76-6fc"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 4825518
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fK397Pxk66NbUmhQ8n8XrPUKFdVZPkN0trPPtzrB3c%2FX39TDFolky1aZaq627TmFJI3ycZC4Mg30tnSYcxpQMAUwspVdbcdeMbvAC6jJhokuhSetTfkzwvsLQHW7b7EHEU3wsseMsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a1ee7b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.skidrowcodex.net/wp-includes/js/mediaelement/renderers/vimeo.min.js?ver=4.2.16
200 OK 0 B URL HTTP/2 www.skidrowcodex.net/wp-includes/js/mediaelement/renderers/vimeo.min.js?ver=4.2.16
IP
GET /wp-includes/js/mediaelement/renderers/vimeo.min.js?ver=4.2.16 HTTP/1.1
Host: www.skidrowcodex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/dead-cells-the-queen-and-the-sea-codex/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Jul 2022 22:26:08 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
expires: Sun, 26 Nov 2023 10:22:34 GMT
etag: W/"62d88100-1940"
x-powered-by: PleskLin
cf-cache-status: HIT
age: 6120796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3usRIq3AlU8ZZFtCFdLxEZgzwgDyq46VAeYeNFnQvKyP%2BaYjf1xI4dyRW0RN4BhrEm1s3LNWd0Kx%2B0oVQd%2F40tMqlvr9U%2BAsYb1yOkoKX5fBlMXthN6nxoQqDmDeBcBTcZPxA7SGg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7949a31a1ee6b512-OSL
content-encoding: br
X-Firefox-Spdy: h2
a1s.unibet.com/orval/tracking/lastclick.min.js
200 OK 0 B URL HTTP/2 a1s.unibet.com/orval/tracking/lastclick.min.js
IP
ASN #47171 Unibet Services Limited
GET /orval/tracking/lastclick.min.js HTTP/1.1
Host: a1s.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 05 Feb 2023 06:37:28 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 05 Aug 2022 12:55:24 GMT
etag: W/"705-5e57dfac7ede0"
cache-control: max-age=1800, public, must-revalidate
content-encoding: gzip
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s.unibet.com; Path=/; SameSite=None; Secure
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Oswald%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7COpen%2BSans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COpen%20Sans&display=swap
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Oswald%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7COpen%2BSans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COpen%20Sans&display=swap
IP
GET /css?family=Oswald%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%20%20%20%20%20%20%20%20%7COpen%2BSans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COpen%20Sans&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.skidrowcodex.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 05 Feb 2023 06:37:22 GMT
date: Sun, 05 Feb 2023 06:37:22 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
188.114.97.1
35.241.9.150
93.184.220.29
23.36.76.226
52.16.89.208
3.120.47.42
85.184.96.5
15.236.125.10
104.19.147.8
95.100.12.199