www.lpdreamforge.com/3WBZ8F/P41FMP9/?sub1=wnnag7gha5rsl6dt215n3q26
34.117.79.165302 Found 124 B URL User Request GET HTTP/2 www.lpdreamforge.com/3WBZ8F/P41FMP9/?sub1=wnnag7gha5rsl6dt215n3q26
IP 34.117.79.165:443
Certificate IssuerStarfield Technologies, Inc.
Subjecthb6trk.com
FingerprintF3:A5:CC:5F:45:AF:8E:C7:C1:55:B3:98:4A:E1:06:71:88:93:EE:21
ValidityWed, 08 Nov 2023 16:27:20 GMT - Thu, 23 May 2024 16:00:41 GMT
File type HTML document, ASCII text
Hash fe00b56c5704fc578091045604c68180
33f066cce655dbfe2cfdacf859735ed697e475c2
c8d937cfaae426064318782ffc9067b4e5a65e4878e0305660fb1589738fd73a
GET /3WBZ8F/P41FMP9/?sub1=wnnag7gha5rsl6dt215n3q26 HTTP/1.1
Host: www.lpdreamforge.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Thu, 30 Nov 2023 14:18:09 GMT
content-type: text/html; charset=utf-8
content-length: 124
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
set-cookie: uniqueClick_P41FMP9=49d6c398-e8bd-4934-98a9-3e55beb0ac33:1701353889; Path=/; Expires=Fri, 01 Dec 2023 14:18:09 GMT; Secure; SameSite=None
transaction_id=69bcc1c8febd42b6ad9d41d2e1c6b4d7; Path=/; Expires=Wed, 28 Feb 2024 14:18:09 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 6e10196a-dc68-4c52-906f-c3936f47db0f
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
secure-winners.com/sxdgzq/style.css
172.67.162.144200 OK 13 kB URL GET HTTP/3 secure-winners.com/sxdgzq/style.css
IP 172.67.162.144:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerGoogle Trust Services LLC
Subjectsecure-winners.com
Fingerprint17:7C:2C:4D:A6:AB:BA:CD:16:E0:A1:F2:84:11:62:0A:03:A4:4C:B0
ValidityWed, 15 Nov 2023 02:33:31 GMT - Tue, 13 Feb 2024 02:33:30 GMT
File type ASCII text, with CRLF line terminators
Hash a02da37eb59e3e766820775fbd869fbb
4277e4b28ecd00595621aed8f42a1fecb2e26a0e
e19e866e7c0f1099b9748c93432936053d44022299f22caec82ef44a5c8b01c0
GET /sxdgzq/style.css HTTP/1.1
Host: secure-winners.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 30 Nov 2023 14:18:09 GMT
content-type: text/css
last-modified: Thu, 30 Mar 2023 20:30:55 GMT
etag: W/"725-5f823f83d5168-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
access-control-allow-headers: Range
cache-control: max-age=14400
cf-cache-status: HIT
age: 1957
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ikcxlQgwr%2F%2FsKcr2n%2Fqo9gLBN04eCNe9JT3yE7wtWHCXn8r5Csz3xNsnSZxmDXYN6%2BzcVS3OiWpcas6hdIOcNP7Y6NBS1sylXrIroLWNgzQjybmH7P6jbPIppCbTnTa1nqtWaHY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82e3b7d42d921bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
172.67.162.144200 OK 697 B URL User Request GET HTTP/2 secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
IP 172.67.162.144:443
Certificate IssuerGoogle Trust Services LLC
Subjectsecure-winners.com
Fingerprint17:7C:2C:4D:A6:AB:BA:CD:16:E0:A1:F2:84:11:62:0A:03:A4:4C:B0
ValidityWed, 15 Nov 2023 02:33:31 GMT - Tue, 13 Feb 2024 02:33:30 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash e023ec35a10acf7fe77595496b7970bb
ee6076eb354474a1a631a655130578fe3372bcc1
c52aee35ad65744a5b423b350fc7e3c5c7c6d0d83f0a427a281a95c4b5d82600
GET /sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7 HTTP/1.1
Host: secure-winners.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:09 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.13
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
access-control-allow-headers: Range
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LzyzNGMhsEup7yAg9LLj2dM1461Pv6TJXx6vDQG7tWt9lct%2BieU48UWmTYhifW5zLxm1JxiQ81olbGAigO8gfI495Ueyl0YdgWqbukbYoyiZPW2HGQYMUvHsnwejcutOlcmKNLo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82e3b7d1fd12712f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
enrlentr.com/signup/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
163.171.128.172302 Found 0 B URL GET HTTP/2 enrlentr.com/signup/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
IP 163.171.128.172:443
ASN #54994 QUANTILNETWORKS
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerGlobalSign nv-sa
Subject*.enrlentr.com
Fingerprint84:4D:DC:70:27:5F:92:EC:78:04:1D:FC:93:FA:DE:F0:4A:DD:43:90
ValidityThu, 23 Feb 2023 21:30:08 GMT - Tue, 26 Mar 2024 21:30:07 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /signup/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7 HTTP/1.1
Host: enrlentr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://secure-winners.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 30 Nov 2023 14:18:13 GMT
content-type: text/html; charset=UTF-8
server: PWS/8.3.1.0.8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=01e954550546aac266a4a70717f4fa70; path=/; secure; SameSite=None
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://plyhnf.com/114ca72ff005a/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7&epcCID=L7G5i1J6l8gcB0a9Rcs1s0icK3b4Z8H7n&rtid=5150128837
via: 1.1 PS-LAX-01iL8141:2 (W), 1.1 PS-FRA-018SR149:9 (W), 1.1 PSdgflkfFRA1vg90:11 (W)
x-px: ms PSdgflkfFRA1vg90FRA,ms PS-FRA-018SR149FRA,ms PS-LAX-01iL8141LAX(origin)
x-ws-request-id: 656899a4_PSdgflkfFRA1vg90_29568-20799
X-Firefox-Spdy: h2
plyhnf.com/114ca72ff005a/?sitekey=75168c09c10c3487&SID=9333cd0f5712624fc88997e70ba25a78&product_id=431098
207.120.33.6200 OK 425 B URL GET HTTP/2 plyhnf.com/114ca72ff005a/?sitekey=75168c09c10c3487&SID=9333cd0f5712624fc88997e70ba25a78&product_id=431098
IP 207.120.33.6:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 4d0d5f646b7a9a6232d673816c9856d5
a86889b12821f4026b8ac0591be1755675ae5097
86716e81877794a56abf29622a659206abbef5c932e24fc4695b04549c52c5e9
GET /114ca72ff005a/?sitekey=75168c09c10c3487&SID=9333cd0f5712624fc88997e70ba25a78&product_id=431098 HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://secure-winners.com/
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:14 GMT
content-type: text/html; charset=UTF-8
content-length: 425
set-cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78; path=/; secure; SameSite=None
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-encoding: gzip
vary: Accept-Encoding
x-varnish: 7090824
age: 0
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
section-io-cache: Miss
section-io-id: 75b5052923f49c6e1c191e2d63f7727a
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
142.250.74.170200 OK 31 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP 142.250.74.170:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (65451)
Hash 220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://plyhnf.com
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 26 Nov 2023 21:54:55 GMT
expires: Mon, 25 Nov 2024 21:54:55 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 318200
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
plyhnf.com/common_tpls/images/cvv-img.png
207.120.33.6200 OK 12 kB URL GET HTTP/2 plyhnf.com/common_tpls/images/cvv-img.png
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type PNG image data, 300 x 192, 8-bit/color RGB, non-interlaced\012- data
Hash c8a66e929d7cfb0b0edf5485f98df754
3e4a68ea37f67bd51db3d3d4c9cbce6303446d5a
76404fd8bd225a482342728c97a8ea7f7f1da5f440ace5bcd23a13c679c3ac08
GET /common_tpls/images/cvv-img.png HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: image/png
content-length: 12447
last-modified: Fri, 24 Jun 2022 17:09:29 GMT
etag: "62b5efc9-309f"
section-io-cache-id: f7760c0194b2bf7f1579812ed156fdcd
x-varnish: 10261074 10203867
age: 4321
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
accept-ranges: bytes
section-io-cache: Hit
section-io-id: d70ed095d8a3b7bdfa9bdab0b6b6ded3
X-Firefox-Spdy: h2
plyhnf.com/acct/trk/?rtid=5150128837
207.120.33.6200 OK 10 B URL GET HTTP/2 plyhnf.com/acct/trk/?rtid=5150128837
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash dc0f01fffdaf321f88bb09834b6f586f
f20e9b9668b3827ddefac09fa93f0ef40a69dff7
7b7f065e8be677aa8faee71e729879d4901e7f10ae37683a64056a6efd473cf7
GET /acct/trk/?rtid=5150128837 HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=307facae41f15f831f95799b657e8b23
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: text/json;charset=UTF-8
content-length: 10
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
x-varnish: 10100801
age: 0
via: 1.1 varnish-84f56c8bcd-dg8mz (Varnish/7.2)
section-io-cache: Miss
section-io-id: 359ec4ba194091bc9b5c9786b5c6b15b
X-Firefox-Spdy: h2
plyhnf.com/join/images/48/rc13/sprite.webp
207.120.33.6200 OK 12 kB URL GET HTTP/2 plyhnf.com/join/images/48/rc13/sprite.webp
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type RIFF (little-endian) data, Web/P image\012- data
Hash 3809ba88982561804ec43f672bf7fd0d
3fc5987413d2667fe79929cb80f0a63b60f8f5c8
22d206eb4acfc9c2c8bf1c4d9e5c273a8384485e87ddb861637fd7070ba6b3db
GET /join/images/48/rc13/sprite.webp HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/join/css/48/rc13/style.css
Cookie: PHPSESSID=307facae41f15f831f95799b657e8b23
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'none'
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
x-varnish: 10364262
age: 0
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
section-io-cache: Miss
section-io-id: c2bd2c155ebbdc315097267f1557261e
X-Firefox-Spdy: h2
plyhnf.com/114ca72ff005a/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7&epcCID=L7G5i1J6l8gcB0a9Rcs1s0icK3b4Z8H7n&rtid=5150128837
207.120.33.6302 Found 602 B URL GET HTTP/2 plyhnf.com/114ca72ff005a/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7&epcCID=L7G5i1J6l8gcB0a9Rcs1s0icK3b4Z8H7n&rtid=5150128837
IP 207.120.33.6:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /114ca72ff005a/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7&epcCID=L7G5i1J6l8gcB0a9Rcs1s0icK3b4Z8H7n&rtid=5150128837 HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://secure-winners.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 30 Nov 2023 14:18:14 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: ./?sitekey=75168c09c10c3487&SID=9333cd0f5712624fc88997e70ba25a78&product_id=431098
set-cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78; path=/; secure; SameSite=None
x-varnish: 5097613
age: 0
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
section-io-cache: Miss
section-io-id: 176ac2d4c820ea1dab9a351960f980fe
X-Firefox-Spdy: h2
plyhnf.com/114ca72ff005a/?_gl=
207.120.33.6200 OK 35 kB URL POST HTTP/2 plyhnf.com/114ca72ff005a/?_gl=
IP 207.120.33.6:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /114ca72ff005a/?_gl= HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 72
Origin: https://plyhnf.com
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?sitekey=75168c09c10c3487&SID=9333cd0f5712624fc88997e70ba25a78&product_id=431098
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:14 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78; path=/; secure; SameSite=None
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-encoding: gzip
vary: Accept-Encoding
x-varnish: 9495088
age: 0
via: 1.1 varnish-84f56c8bcd-dg8mz (Varnish/7.2)
section-io-cache: Miss
section-io-id: 637b1bcb43aa12bfcc999703564ee9a4
X-Firefox-Spdy: h2
plyhnf.com/common_tpls/js/validate_form_v2.js?jsv=35
207.120.33.6200 OK 26 kB URL GET HTTP/2 plyhnf.com/common_tpls/js/validate_form_v2.js?jsv=35
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /common_tpls/js/validate_form_v2.js?jsv=35 HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 19 Oct 2023 00:24:58 GMT
etag: W/"6530775a-6590"
section-io-cache-id: 19f7d6f687f05a675dba3bde383403ed
x-varnish: 9562979 10421967
age: 5089
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
section-io-cache: Hit
content-encoding: gzip
section-io-id: 1dcd90e80d4ad9454ff5694b447ec454
X-Firefox-Spdy: h2
cdn.secure-winners.com/assets/sxdgzq/bg.webp
172.67.162.144200 OK 12 kB URL GET HTTP/3 cdn.secure-winners.com/assets/sxdgzq/bg.webp
IP 172.67.162.144:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerGoogle Trust Services LLC
Subjectsecure-winners.com
Fingerprint17:7C:2C:4D:A6:AB:BA:CD:16:E0:A1:F2:84:11:62:0A:03:A4:4C:B0
ValidityWed, 15 Nov 2023 02:33:31 GMT - Tue, 13 Feb 2024 02:33:30 GMT
File type RIFF (little-endian) data, Web/P image\012- data
Hash 543bace134b34dbb5d6695b062c51f4f
77237013635e1e90aa36326cb48332b9415c0327
882e5cbcc3b2dcce71a1471bfa4a64bf69c4de615793d6c53bee5f781c3551b2
GET /assets/sxdgzq/bg.webp HTTP/1.1
Host: cdn.secure-winners.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure-winners.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 30 Nov 2023 14:18:10 GMT
content-type: image/webp
content-length: 12414
last-modified: Thu, 30 Mar 2023 17:37:17 GMT
etag: "307e-5f8218b3a0d40"
access-control-allow-origin: *
access-control-allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
access-control-allow-headers: Range
cache-control: max-age=14400
cf-cache-status: HIT
age: 1958
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NSk%2FQLtHnYB3YxlbbVJKwo2ijMlvEEr7vyd3d9qXY6ZEoi1p0Kjx9fWfuAN6pw2rYgFvvamvRhJx5LckPujSlXRHIaUyTWxzfHlK1Y%2BzZJnSPEmsDeASM%2F2ogXyACv%2BWOHG95u7KKd6%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82e3b7d49dd31bfe-OSL
alt-svc: h3=":443"; ma=86400
plyhnf.com/common_tpls/js/form_support.js?v=1101202201
207.120.33.6200 OK 3.8 kB URL GET HTTP/2 plyhnf.com/common_tpls/js/form_support.js?v=1101202201
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type ASCII text, with very long lines (4261), with no line terminators
Hash bd72340aa5a6ac08cf9a0fdbd650579c
c0550503cbb35b4abcc5618fc78a0cb18c26c89c
783abe18fe8132421d19b383088f95e95a9ee6ac64b85bd2e2b178b481ab2ca4
GET /common_tpls/js/form_support.js?v=1101202201 HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 21:23:38 GMT
etag: W/"6377f7da-ed7"
section-io-cache-id: 4adbf37b32bdd87e11a3e57d322d80e6
x-varnish: 9755386 9516473
age: 5039
via: 1.1 varnish-84f56c8bcd-dg8mz (Varnish/7.2)
section-io-cache: Hit
content-encoding: gzip
section-io-id: 72b5b3ea210992198e1f5c4404805b26
X-Firefox-Spdy: h2
fastlnd.com/ep.php/prment:79596/69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
34.212.184.247302 Found 602 B URL GET HTTP/2 fastlnd.com/ep.php/prment:79596/69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
IP 34.212.184.247:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerAmazon
Subjectlndtrkr.com
Fingerprint40:69:DD:FD:28:66:10:69:8F:26:F9:C8:06:20:DE:00:0A:5C:3A:BA
ValiditySat, 07 Oct 2023 00:00:00 GMT - Mon, 04 Nov 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ep.php/prment:79596/69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7 HTTP/1.1
Host: fastlnd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure-winners.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 30 Nov 2023 14:18:10 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://enrlentr.com/signup/?epcVIP=48.1938.rc13&ci_qcksub2=1&act=epc69708.47737-143049.64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
server: Apache
set-cookie: vip_id=69708.47737-143049; expires=Sun, 03-Dec-2023 14:18:10 GMT; Max-Age=259200; path=/
X-Firefox-Spdy: h2
secure-winners.com/favicon.ico
172.67.162.144404 Not Found 209 B URL GET HTTP/3 secure-winners.com/favicon.ico
IP 172.67.162.144:443
Requested by https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Certificate IssuerGoogle Trust Services LLC
Subjectsecure-winners.com
Fingerprint17:7C:2C:4D:A6:AB:BA:CD:16:E0:A1:F2:84:11:62:0A:03:A4:4C:B0
ValidityWed, 15 Nov 2023 02:33:31 GMT - Tue, 13 Feb 2024 02:33:30 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Hash 8ace35f18ab1832bacfde13597767517
22e4ee51bbdba11b19a2d6879bc60126dc89eecd
f87134d32dc903f27ed9c905bfd824f31192dac9e05887b2dedbb1ca416d1280
GET /favicon.ico HTTP/1.1
Host: secure-winners.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure-winners.com/sxdgzq/?sin=prment:79596&act=69708:64.69bcc1c8febd42b6ad9d41d2e1c6b4d7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Thu, 30 Nov 2023 14:18:10 GMT
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ogOW3l65GMbNcSXi%2FhYBKFXxhvhTLWQxKxxk9eGFyJ94l6NPsUl%2FWoasD1V6zSrQ7BZwtUZe7jH7U%2FBLXtMZ9lKuMKcmv4jyRK1CEGo5eywDSPcMUbHZd7wBFjKNQVub9QlCibs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82e3b7d4bdf51bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
plyhnf.com/join/css/48/rc13/style.css
207.120.33.6200 OK 30 kB URL GET HTTP/2 plyhnf.com/join/css/48/rc13/style.css
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type ASCII text, with very long lines (2819), with CRLF line terminators
Hash 2b79559f5ba7e53f2d64a8dbc0f838e7
1584cfe628fffc015e98dd292abe6a4c306bc020
77b54221f8e36331217a66ebefa768d50e09bf754ab6cfb02bbd092ef852dba0
GET /join/css/48/rc13/style.css HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: text/css;charset=UTF-8
set-cookie: PHPSESSID=307facae41f15f831f95799b657e8b23; path=/; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'none'
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-encoding: gzip
vary: Accept-Encoding
x-varnish: 6516876
age: 0
via: 1.1 varnish-84f56c8bcd-vlnhn (Varnish/7.2)
accept-ranges: bytes
section-io-cache: Miss
section-io-id: c5ff67ec407505334dd3892ac20f1fd8
X-Firefox-Spdy: h2
plyhnf.com/common_tpls/js/iframeResizer.contentWindow.min.js
207.120.33.6200 OK 13 kB URL GET HTTP/2 plyhnf.com/common_tpls/js/iframeResizer.contentWindow.min.js
IP 207.120.33.6:443
Requested by https://plyhnf.com/114ca72ff005a/?_gl=
Certificate IssuerLet's Encrypt
Subjectplyhnf.com
Fingerprint4A:24:21:4D:80:01:F1:42:8E:A3:50:F0:9B:1A:1B:A5:96:32:B6:F4
ValiditySun, 05 Nov 2023 14:38:01 GMT - Sat, 03 Feb 2024 14:38:00 GMT
File type ASCII text, with very long lines (12990)
Hash 2cf9df789476bc39b9906030f639660d
de708b4a0fe32f3d77505675eb119b671327a6b4
7d5f5d0fe842536e512b4ca0cac0b48a66577ea091f3a6840365ff6124be034b
GET /common_tpls/js/iframeResizer.contentWindow.min.js HTTP/1.1
Host: plyhnf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://plyhnf.com/114ca72ff005a/?_gl=
Cookie: PHPSESSID=9333cd0f5712624fc88997e70ba25a78
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 30 Nov 2023 14:18:15 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 04 Feb 2016 15:06:03 GMT
etag: W/"56b368db-3445"
section-io-cache-id: e6b8ba330f146e42c2a693dda01ac458
x-varnish: 8704808 9592981
age: 5039
via: 1.1 varnish-84f56c8bcd-dg8mz (Varnish/7.2)
section-io-cache: Hit
content-encoding: gzip
section-io-id: bb50fd0aa0610846eb006d79ebfb07cd
X-Firefox-Spdy: h2