3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
308 Permanent Redirect 164 B URL HTTP/1.1 3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash f23c4815ecaef1588f16ac735c0e15d6
026bf8cdd5076014b6fc822878e0086eb44da556
43a81fb3d47b34e7d42d6b8444f592ed9251b8e57db8f67d32419aa40b1480d0
Analyzer Verdict Alert quad9 Sinkholed
GET /partners/casino-reg?cid=1810302869&pid=14628&sip=0 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 308 Permanent Redirect
Server: nginx
Date: Mon, 14 Nov 2022 07:07:08 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7786cd9bd97e024b3a1d16215defaad2
786ddbb74b0b6bd9270622dbe0258d6caee407c1
9c297ccfd178eec7e472fb64a6b2e34d4c7a6dec32870f49982353e590196ba0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C297CCFD178EEC7E472FB64A6B2E34D4C7A6DEC32870F49982353E590196BA0"
Last-Modified: Mon, 14 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10490
Expires: Mon, 14 Nov 2022 10:01:59 GMT
Date: Mon, 14 Nov 2022 07:07:09 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash b1e969be0f3201087da138cbc8b89f10
d0a27f525f2b242b5dafa157f126c2ba880c8809
f7e5f39372b5adcc30c27e727eee1b19e6d13ed1b54fa1ad67235dc8ee08ac51
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6305
Cache-Control: max-age=104957
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Etag: "6370c779-1d7"
Expires: Tue, 15 Nov 2022 12:16:26 GMT
Last-Modified: Sun, 13 Nov 2022 10:31:21 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 14 Nov 2022 06:44:11 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1378
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c88bc06741ab9fb81c2544acfcc34aa2
362cab19cff5aba27f472cc00071d5dfa38192e4
314ba27975f458e13917b2be91c9d5989a3e57c9e94b5a84dd52d0e21d27ae7f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "314BA27975F458E13917B2BE91C9D5989A3E57C9E94B5A84DD52D0E21D27AE7F"
Last-Modified: Mon, 14 Nov 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7621
Expires: Mon, 14 Nov 2022 09:14:10 GMT
Date: Mon, 14 Nov 2022 07:07:09 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: RdaV0exFVHJv6GL7+NvVDZDZ2DnCyF1GRFO/jwjjB3q5cbjFU3oJVhTN7pkZ9ni2bZUkbjDiBbg=
x-amz-request-id: NF4XFCNQSC4KMF4F
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 14 Nov 2022 06:13:45 GMT
age: 3204
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 38ab4fb34e8e8ba6148a1724c842cc19
843966a0a294428e282c38e536a45f34df7709a7
f7b0772773b2903811861a790c88ffe911acb0cac80967dfdc3ea1a09da2743d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F7B0772773B2903811861A790C88FFE911ACB0CAC80967DFDC3EA1A09DA2743D"
Last-Modified: Sun, 13 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21595
Expires: Mon, 14 Nov 2022 13:07:04 GMT
Date: Mon, 14 Nov 2022 07:07:09 GMT
Connection: keep-alive
cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
200 OK 23 kB URL HTTP/1.1 cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
IP
File type C source, ASCII text, with very long lines (539)
Hash bfcc64224f8c6e43e026afb16bd0f4f8
4b1a0dbd96c3047a917ba024690ffc4d544b8b00
c87358a7c76c044147379c9415f96488045b936666093c83fd0e57e08316548e
GET /js/11DAF087E87A3DFD/scarab-v2.js HTTP/1.1
Host: cdn.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Timing-Allow-Origin: *
Cache-Control: max-age=3600,public
Date: Mon, 14 Nov 2022 07:05:13 GMT
ETag: "aa53180343ab25d32aa7294158ca3216--gzip"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 d9fb4c3794a085bb4ee2c5798c2cb1b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: GxKAsN6_EVsIW-XjJ0Qdw9zc1d8DAWfVhV39qmcg81V2frzYhRpxGw==
Age: 116
ocsp.digicert.com/
200 OK 279 B IP
Hash 68ccdcfbe736c38171b811133bd6cc58
cd3e0f1e5768392676d7318b6c43a5a38987d584
6ba355dcc23ad28df7a8b56c09b8d028fa06e7b82daf54047a0225d8c560e6cf
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1703
Cache-Control: max-age=104656
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Etag: "6370d847-117"
Expires: Tue, 15 Nov 2022 12:11:25 GMT
Last-Modified: Sun, 13 Nov 2022 11:43:03 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 68ccdcfbe736c38171b811133bd6cc58
cd3e0f1e5768392676d7318b6c43a5a38987d584
6ba355dcc23ad28df7a8b56c09b8d028fa06e7b82daf54047a0225d8c560e6cf
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2578
Cache-Control: max-age=105532
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Etag: "6370d847-117"
Expires: Tue, 15 Nov 2022 12:26:01 GMT
Last-Modified: Sun, 13 Nov 2022 11:43:03 GMT
Server: ECS (amb/6BC4)
X-Cache: HIT
Content-Length: 279
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d6dcd32d23f1840e1ed591b30b098bb6
98defcbcd3ae6d45e12b7ed0a55d7d32da675289
f7a78d0502af553972a836a0deb4a0239a3506fcf962f23f58c73fbb84c2313b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
static.scarabresearch.com/wpjs/wploader.js?ts=2758
200 OK 11 kB URL HTTP/1.1 static.scarabresearch.com/wpjs/wploader.js?ts=2758
IP
File type Unicode text, UTF-8 text, with very long lines (26064)
Hash b28fd6e04be0d5b9a7af76b83add8f63
1d72833c0d9744746a9001e04a205f7fe274401a
84b80abf9369fdcb170639101db17925418036911d62895b4dc24c661953be37
GET /wpjs/wploader.js?ts=2758 HTTP/1.1
Host: static.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 14 Nov 2022 05:21:48 GMT
Last-Modified: Mon, 10 Oct 2022 11:09:48 GMT
ETag: W/"1bb200ba7add3c5d4bfb6f3822bfe5af"
Cache-Control: max-age=86400
x-amz-version-id: DzVXMgBeksdrQfAKjc.ckmkVhMlLjwqT
Server: AmazonS3
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: vnlhxUKyggUaUMPGE2Zcf9i-ZteSe6BeYH-oX93d5agum0ucfSe42A==
Age: 6322
ocsp.digicert.com/
200 OK 279 B IP
Hash 68ccdcfbe736c38171b811133bd6cc58
cd3e0f1e5768392676d7318b6c43a5a38987d584
6ba355dcc23ad28df7a8b56c09b8d028fa06e7b82daf54047a0225d8c560e6cf
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=102954
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Etag: "6370d847-117"
Expires: Tue, 15 Nov 2022 11:43:03 GMT
Last-Modified: Sun, 13 Nov 2022 11:43:03 GMT
Server: nginx
Content-Length: 279
www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
200 OK 56 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
IP
File type Unicode text, UTF-8 text, with very long lines (13644)
Hash 3f1fd52c69b8408ae4cf840a7a3d6b76
d84ee1d2f9b058cc8e2db94137d9e632d86d1536
6d3b29f5d5ade1a9218443dcc2eda00cc89f07ba07c69225053686fe865dc6b3
GET /gtm.js?id=GTM-5PMSX62 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 14 Nov 2022 07:07:09 GMT
expires: Mon, 14 Nov 2022 07:07:09 GMT
cache-control: private, max-age=900
last-modified: Mon, 14 Nov 2022 06:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 55942
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
200 OK 17 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
IP
Hash 595ede2a7ef52f62e0453d190ab922b0
86e5cc108187f562b0a2569ebda1e94f915c4014
ba9c27a96bf04a26182d6e3e0328f00728e91dc09d5d8eaefa4140952926d613
Analyzer Verdict Alert quad9 Sinkholed
GET /partners/casino-reg?cid=1810302869&pid=14628&sip=0 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: text/html
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js
200 OK 80 kB URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash fc0ca81b87669802380b7a5b62c2c369
34b3a84ffed20257033386b029298a01e7a88f5e
f1e38568e267453dc380ad0176a5f6c33cdcc35f756ebb34c5eef31783a491b2
GET /spa-static/1.4.1006/static/js/main.f903f749.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: application/javascript
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-5bdb8"
expires: Mon, 14 Nov 2022 08:02:47 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 11061
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XboyHYTkcUH4otBY9wIxtuh66JCLsQmHe74BaILEnsnZRMpA2jfFMMXMifKnD89JnU4CdysNHnQowqctdmJPzRlx1ltTCTXER0jtwAofDjuGBkiayvNUl6wJf3ANUPDqgZKC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 769de898ceb8b50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash d6dcd32d23f1840e1ed591b30b098bb6
98defcbcd3ae6d45e12b7ed0a55d7d32da675289
f7a78d0502af553972a836a0deb4a0239a3506fcf962f23f58c73fbb84c2313b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 471 B IP
Hash 0a9a357f652868f9317812b8103ba15d
95a90c7a07b591dce7f39c6f9ab27974d1a1ed2a
16fd52c7ee6806455e724f30af8d58630a141a8a3823c48c20b5da3a71f066da
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1515
Cache-Control: max-age=95098
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:09 GMT
Etag: "6370b3ac-1d7"
Expires: Tue, 15 Nov 2022 09:32:07 GMT
Last-Modified: Sun, 13 Nov 2022 09:06:52 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
rstat.rockmostbet.com/lib.js
200 OK 237 kB URL HTTP/2 rstat.rockmostbet.com/lib.js
IP
ASN #24940 Hetzner Online GmbH
File type Unicode text, UTF-8 text, with very long lines (29927), with LF, NEL line terminators
Size 237 kB (236698 bytes)
Hash b5be13180dc0f26212e25857b5b67dec
3baf278b0ae6f452668b342e5b4a65684bc37055
d1a2c8d8ebf2ba993df93ec6801fd084348ebd2bf0183786d85546f9c0b57f20
GET /lib.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
date: Mon, 14 Nov 2022 07:07:09 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997817183577309184; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 1
x-xss-protection: 1
content-length: 236698
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 61 kB IP
Hash 24b68a175da12184664e0c484bd836d6
0a770b60dea65f1eadf69726ccf3c1f76ef15626
418eb8390f8ab8910e8e9956fd84152180a75cf05418301c28a91b20514afbd3
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 07:07:09 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 14 Nov 2022 06:25:20 GMT
Expires: Mon, 21 Nov 2022 06:25:19 GMT
Etag: "1a80eee05a05fe45873b20f879ed84a1610c1662"
Cache-Control: max-age=601689,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 769de89b1b21b529-OSL
3vsmdh0yz31vwcemst.com/partners/sport_logo.png
404 Not Found 12 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/partners/sport_logo.png
IP
Hash a3900ec7beb176636dd839f1fb9216ac
dcc4348c2032cce0d8a127a70a7f8f5b1bb89cdd
c68415e280cc57115fdaef28040f529f88af3da7e46bdbbe9006b55fbb963d96
Analyzer Verdict Alert quad9 Sinkholed
GET /partners/sport_logo.png HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: text/html
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash b0fb9594d73246bc257635bb49262fe7
db33e05087d58911f2d5a7b7b36c46031f25f3c2
e401d34e8dc292e47671dd476f671168661a761e76723db24c75c69978bcf551
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 746
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Mon, 14 Nov 2022 07:07:09 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997817183577309184; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 5
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
200 OK 697 B URL HTTP/2 my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
IP
Hash 6425f508eacb60db81c6d0b38ae56a58
d27caed071b054a15ab2291a11a4bfe12e097d7a
e94404dcfeb2d07ed1a6c0ad4230d5bc5754c0c965736d4ebc3224af415094d0
GET /p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kZM1f9zI94myuRpfWapiiA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: +q2J4LBRbUZWk0jnQs3rKLWsPUM=
ocsp.digicert.com/
200 OK 471 B IP
Hash 25e43ddf8623077222fd85e2e27997c5
1b92bc7e8cf6be84f02f75981a428b877fd152ac
4d91ca4a4207493951f048d0b97f9a277548b107c63ec408c340dec364808116
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4927
Cache-Control: max-age=104306
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Etag: "6370ca51-1d7"
Expires: Tue, 15 Nov 2022 12:05:36 GMT
Last-Modified: Sun, 13 Nov 2022 10:43:29 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
3vsmdh0yz31vwcemst.com/api/v1/logo
200 OK 20 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/logo
IP
File type JSON data\012- , ASCII text, with very long lines (1325)
Hash aa3908f111f6be94efc4c007903f7858
4c64b8288525115e15a1e56d55df781f59d2f351
620f38bea51cc2ee9576ee572ad2a099df3b5571354717bb7e6c019d904b03ec
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/logo HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.1.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"9dfab82e3b4ec3d36c2d3f40883172cf"
x-request-id: 1099a4836d2d1a515909822e9454823b
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:10 GMT
set-cookie: PHPSESSID=gelfgbb6gsmkp0ubme706gtfup; expires=Wed, 14-Dec-2022 07:07:10 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Tue, 15-Nov-2022 07:07:10 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Mon, 21-Nov-2022 07:07:10 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
connect.facebook.net/en_US/fbevents.js
200 OK 27 kB URL HTTP/2 connect.facebook.net/en_US/fbevents.js
IP
File type ASCII text, with very long lines (64348)
Hash 0ac10debd3a9ea8147a26d045bb93e6e
ff45f3442508e8695f2303701682ebdb6e016464
5dee7b453b2c72c07ff1d62432493a044507835a8031ea62edf2fa7cc26219b9
GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: xHKQLdbVzWQ87JrVT2wGToTHcOUbohJv/myFEs4tpjiJkra1NqJTvHFl/jAgru3UI+CLbhnM/+ojIDQQpArMUw==
content-length: 27337
x-fb-trip-id: 1904183273
date: Mon, 14 Nov 2022 07:07:10 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 25e43ddf8623077222fd85e2e27997c5
1b92bc7e8cf6be84f02f75981a428b877fd152ac
4d91ca4a4207493951f048d0b97f9a277548b107c63ec408c340dec364808116
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4927
Cache-Control: max-age=104306
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Etag: "6370ca51-1d7"
Expires: Tue, 15 Nov 2022 12:05:36 GMT
Last-Modified: Sun, 13 Nov 2022 10:43:29 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
3vsmdh0yz31vwcemst.com/favicon.ico
200 OK 3.4 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/favicon.ico
IP
Hash 6ed86c1e2e39062ad021cf0d91cbecaa
21681401b17e6dd13970b1bd3905970b169b4274
42c7509969ffe42311e7a1fd98f7557c85054b3750ed5e6b302007225e006593
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.1.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: image/x-icon
last-modified: Wed, 09 Nov 2022 13:13:39 GMT
vary: Accept-Encoding
etag: W/"636ba783-1536"
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/connection/websocket
101 Switching Protocols 0 B URL HTTP/1.1 3vsmdh0yz31vwcemst.com/connection/websocket
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /connection/websocket HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://3vsmdh0yz31vwcemst.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 4X/VUAwhQGHriH9xBTPlzg==
Connection: keep-alive, Upgrade
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.1.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Server: nginx
Date: Mon, 14 Nov 2022 07:07:10 GMT
Connection: upgrade
upgrade: websocket
sec-websocket-accept: wqOhmXpM3nPkPdAiKqNawqdDTn8=
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash a635b6112e22763022c9bce0e9141fae
13ba9e635ad5bf7bb57c39a154eec28c4b326801
4b22d01fc2179a0a13fd70d7e80b98f0b865397af369c2dc03678b072b7f7e90
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit
200 OK 580 B URL HTTP/2 www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit
IP
File type ASCII text, with very long lines (909), with no line terminators
Hash 645839bb2a36f1b5337b8701d692b126
76f03a580d775a3dbd34f5dc4e7c2d4c18833cd5
70d059e2d878dadc8cf895cfa4dcebefbf7c7eef7771db6369f1e1a0539236d1
GET /recaptcha/api.js?onload=onloadcallback&render=explicit HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Mon, 14 Nov 2022 07:07:10 GMT
date: Mon, 14 Nov 2022 07:07:10 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 580
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 96c9e6a333b1f0fddf32f24e7b965151
647fee1eb0d6839e30115edebe8d0840e6152cdb
a2ac4ddc863a9d641d91d504db389e0116cf1699322d2391f17d5785bf5bc538
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 33d721cd326005d607c2835f67bef24e
cc9ddeb2beb2c9efe020524a43b55c35032d6386
698e848f2b2b78baa08c039d97e2d64e84d8a54dfbd97bb3ebcba6fefbd2c7e1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "698E848F2B2B78BAA08C039D97E2D64E84D8A54DFBD97BB3EBCBA6FEFBD2C7E1"
Last-Modified: Sun, 13 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11750
Expires: Mon, 14 Nov 2022 10:23:00 GMT
Date: Mon, 14 Nov 2022 07:07:10 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 33d721cd326005d607c2835f67bef24e
cc9ddeb2beb2c9efe020524a43b55c35032d6386
698e848f2b2b78baa08c039d97e2d64e84d8a54dfbd97bb3ebcba6fefbd2c7e1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "698E848F2B2B78BAA08C039D97E2D64E84D8A54DFBD97BB3EBCBA6FEFBD2C7E1"
Last-Modified: Sun, 13 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11655
Expires: Mon, 14 Nov 2022 10:21:25 GMT
Date: Mon, 14 Nov 2022 07:07:10 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 33d721cd326005d607c2835f67bef24e
cc9ddeb2beb2c9efe020524a43b55c35032d6386
698e848f2b2b78baa08c039d97e2d64e84d8a54dfbd97bb3ebcba6fefbd2c7e1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "698E848F2B2B78BAA08C039D97E2D64E84D8A54DFBD97BB3EBCBA6FEFBD2C7E1"
Last-Modified: Sun, 13 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11815
Expires: Mon, 14 Nov 2022 10:24:05 GMT
Date: Mon, 14 Nov 2022 07:07:10 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 33d721cd326005d607c2835f67bef24e
cc9ddeb2beb2c9efe020524a43b55c35032d6386
698e848f2b2b78baa08c039d97e2d64e84d8a54dfbd97bb3ebcba6fefbd2c7e1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "698E848F2B2B78BAA08C039D97E2D64E84D8A54DFBD97BB3EBCBA6FEFBD2C7E1"
Last-Modified: Sun, 13 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11730
Expires: Mon, 14 Nov 2022 10:22:40 GMT
Date: Mon, 14 Nov 2022 07:07:10 GMT
Connection: keep-alive
mostauthor.com/multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: cba21f42e4e24ad29aa44a9cc70487cb
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: b967d697cd8c44449b263746f64db2be
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mc.yandex.ru/metrika/tag.js
200 OK 73 kB URL HTTP/2 mc.yandex.ru/metrika/tag.js
IP
File type Unicode text, UTF-8 (with BOM) text, with very long lines (587)
Hash 6bb9990fc521832208f25ccf5261b719
be8acfb80dfc034d5cbd7dabb318ea8853762c10
677f03256dacdc519c12971fd422fe1afa0ecca3864f4e8f7aa0bed4eecd9c38
GET /metrika/tag.js HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-length: 73397
date: Mon, 14 Nov 2022 07:07:10 GMT
access-control-allow-origin: *
etag: "63575841-11eb5"
expires: Mon, 14 Nov 2022 08:07:10 GMT
last-modified: Tue, 25 Oct 2022 06:30:09 GMT
cache-control: max-age=3600
content-encoding: br
content-type: application/javascript
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o
200 OK 10 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash f7f86d583c92292a7025fc1f25657a1f
92659f2f702a5b18d44a58055c6cd77173630ae2
3b9de8f3bb4d65ebe964703b38c9ce2f3b40a58b33484e6eed8f92bbd5f10a4f
GET /multiauth/test_cookie_set?testcookie=7zqwiakybqrl8lr268b3o HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: b409dc72ea8446e09442fcb218665bfc
set-cookie: test_cooke_7zqwiakybqrl8lr268b3o=1; Max-Age=3600; SameSite=None; Secure
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 10
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq
200 OK 10 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash f7f86d583c92292a7025fc1f25657a1f
92659f2f702a5b18d44a58055c6cd77173630ae2
3b9de8f3bb4d65ebe964703b38c9ce2f3b40a58b33484e6eed8f92bbd5f10a4f
GET /multiauth/test_cookie_set?testcookie=v6b8f6uagrdfav61e12gjq HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: 6fc9a53470974d53a835027f048b5e25
set-cookie: test_cooke_v6b8f6uagrdfav61e12gjq=1; Max-Age=3600; SameSite=None; Secure
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 10
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/currency-specific-settings/BDT.json
200 OK 224 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/currency-specific-settings/BDT.json
IP
Hash cb79a45431c0104ef0ab28e89c004aab
43b976d13775aba105222a0235edecdc9b719257
615e686ce0b1915463d31147883942145698239f9cef88ada9d77495ddd9bf28
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/currency-specific-settings/BDT.json HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=3600, private
etag: W/"f62f3a14a21eec1626541cbc2e78a9c1"
x-request-id: 53bdb937821a686125280ee68e55ba3a
vary: Accept-Encoding, Accept-Language
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
my.rtmark.net/img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0
200 OK 43 B URL HTTP/2 my.rtmark.net/img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=648b6531a36b48f0afc405d796f83e96; expires=Tue, 14 Nov 2023 07:07:10 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 35ad471bf7f157abedbe322e59bb00ae
6f8c57f1c20377b6a1f74fd06849705a6370e291
b51251f347677a52f08a4a7c0d9ff0effed121992b6dc7fa709e33c400042e63
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
region1.google-analytics.com/g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=621152744&cid=409372843.1668409629&ul=en-us&sr=1280x1024&_s=1&sid=1668409628&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&dt=mostbet_title&en=page_view&_fv=1&_nsi=1&_ss=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=621152744&cid=409372843.1668409629&ul=en-us&sr=1280x1024&_s=1&sid=1668409628&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&dt=mostbet_title&en=page_view&_fv=1&_nsi=1&_ss=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=621152744&cid=409372843.1668409629&ul=en-us&sr=1280x1024&_s=1&sid=1668409628&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&dt=mostbet_title&en=page_view&_fv=1&_nsi=1&_ss=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
date: Mon, 14 Nov 2022 07:07:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/upload/spa/olympics.json?1668409628536
200 OK 487 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/upload/spa/olympics.json?1668409628536
IP
File type JSON data\012- , ASCII text, with very long lines (65491)
Size 487 kB (487053 bytes)
Hash 4c2b6555373c2eaad5a37baccd4a85bd
c9e738d983b1cfcf1154bf19d917909174af727d
7d89b24a959a15c622f29e5237314922f31d7f7b9071963890f72d7d35bd9c0a
Analyzer Verdict Alert quad9 Sinkholed
GET /upload/spa/olympics.json?1668409628536 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.1.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
last-modified: Sat, 05 Feb 2022 09:22:38 GMT
vary: Accept-Encoding
etag: W/"61fe41de-2d"
expires: Mon, 21 Nov 2022 07:07:10 GMT
cache-control: max-age=604800, public
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 35ad471bf7f157abedbe322e59bb00ae
6f8c57f1c20377b6a1f74fd06849705a6370e291
b51251f347677a52f08a4a7c0d9ff0effed121992b6dc7fa709e33c400042e63
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mostauthor.com/multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: cccc1873b96f457a90404ec2dd32e252
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_get?testcookie=7zqwiakybqrl8lr268b3o
200 OK 21 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=7zqwiakybqrl8lr268b3o
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash caf33483167cc6a28994a501b478f8df
8b80faf52bdfda242a8a7c2d2cff45a26c43d031
070bf1d4556043cf533cca3e374c72481fb31525f9254c46a37031fb35f69f0e
GET /multiauth/test_cookie_get?testcookie=7zqwiakybqrl8lr268b3o HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_7zqwiakybqrl8lr268b3o=1; test_cooke_v6b8f6uagrdfav61e12gjq=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: d012d7ea139247299efd356884b32711
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 21
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq
200 OK 21 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash caf33483167cc6a28994a501b478f8df
8b80faf52bdfda242a8a7c2d2cff45a26c43d031
070bf1d4556043cf533cca3e374c72481fb31525f9254c46a37031fb35f69f0e
GET /multiauth/test_cookie_get?testcookie=v6b8f6uagrdfav61e12gjq HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_7zqwiakybqrl8lr268b3o=1; test_cooke_v6b8f6uagrdfav61e12gjq=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: 896f445540e24a38af57e80a365f7945
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 21
date: Mon, 14 Nov 2022 07:07:10 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
www.facebook.com/tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668409629408&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668409629407.1438755398&it=1668409628749&coo=false&rqm=GET
200 OK 0 B URL HTTP/2 www.facebook.com/tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668409629408&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668409629407.1438755398&it=1668409628749&coo=false&rqm=GET
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668409629408&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668409629407.1438755398&it=1668409628749&coo=false&rqm=GET HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/plain
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Mon, 14 Nov 2022 07:07:10 GMT
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29
200 OK 419 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29
IP
File type JSON data\012- , ASCII text, with very long lines (419), with no line terminators
Hash 0a8a7abcfe44fabc80ff4e58d64cd275
93283ffb08f3224c1de60d277f25098ffdf50978
2ad01d2789fe03771b5518ee04d68f8c102fa30e513e064eba84619109381c61
GET /watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29 HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Referer: https://3vsmdh0yz31vwcemst.com/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 419
date: Mon, 14 Nov 2022 07:07:10 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:10 GMT
last-modified: Mon, 14-Nov-2022 07:07:10 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: application/json; charset=utf-8
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/metrika/advert.gif
200 OK 43 B URL HTTP/2 mc.yandex.ru/metrika/advert.gif
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /metrika/advert.gif HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Mon, 14 Nov 2022 07:07:10 GMT
access-control-allow-origin: *
etag: "63575841-2b"
expires: Mon, 14 Nov 2022 08:07:10 GMT
accept-ranges: bytes
last-modified: Tue, 25 Oct 2022 06:30:09 GMT
cache-control: max-age=3600
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c1abc90e3b0a3418b27aa617d9e6f6eb
ec09eabd2f48a4013c6ae13d0145d5cd5823aa96
57905b7c1951f7340d51107297e02bd848abecfcf701ea8bc1befa105ee0178f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c1abc90e3b0a3418b27aa617d9e6f6eb
ec09eabd2f48a4013c6ae13d0145d5cd5823aa96
57905b7c1951f7340d51107297e02bd848abecfcf701ea8bc1befa105ee0178f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&uid=0&gjid=428252232&_gid=1318375477.1668409629&_u=YADAAEABAAAAACAEK~&z=2062386253
200 OK 4 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&uid=0&gjid=428252232&_gid=1318375477.1668409629&_u=YADAAEABAAAAACAEK~&z=2062386253
IP
File type ASCII text, with no line terminators
Hash 48c0473b7821185d937e685216e2168b
3743e47f8a429a5e87b86cb582d78940733d9d2e
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&uid=0&gjid=428252232&_gid=1318375477.1668409629&_u=YADAAEABAAAAACAEK~&z=2062386253 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 14 Nov 2022 07:07:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&uid=0&gjid=1267793178&_gid=1318375477.1668409629&_u=YADAAEAAAAAAACAEK~&z=1091788260
200 OK 4 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&uid=0&gjid=1267793178&_gid=1318375477.1668409629&_u=YADAAEAAAAAAACAEK~&z=1091788260
IP
File type ASCII text, with no line terminators
Hash 48c0473b7821185d937e685216e2168b
3743e47f8a429a5e87b86cb582d78940733d9d2e
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&uid=0&gjid=1267793178&_gid=1318375477.1668409629&_u=YADAAEAAAAAAACAEK~&z=1091788260 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 14 Nov 2022 07:07:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 14 kB IP
Hash e4d09acf581b739c612cc740f60fa656
4cb245292e55375e87457a688890d0ee840fe003
a4f767fceb6ae5992f192204fe4dab9d9d6d72f41eda9eb3a7f53c89c2fde079
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b2d6aeeb303eaefc4cc6900e30da3b1b
4c3c027013211aa1b987006d0eb6c72f18c6a657
f542eab7c032d6c5f59710ee8993a01537e0fa2bf3882a6a699de85bba020999
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b2d6aeeb303eaefc4cc6900e30da3b1b
4c3c027013211aa1b987006d0eb6c72f18c6a657
f542eab7c032d6c5f59710ee8993a01537e0fa2bf3882a6a699de85bba020999
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mostauthor.com/multiauth/ping
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/ping
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/ping HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: d620957c60f14b98acf99a7adcd34ade
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Mon, 14 Nov 2022 07:07:11 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Nov 2022 14:07:32 GMT
expires: Thu, 09 Nov 2023 14:07:32 GMT
cache-control: public, max-age=31536000
age: 406779
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
mostauthor.com/multiauth/ping
401 Unauthorized 35 B URL HTTP/2 mostauthor.com/multiauth/ping
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash 0d996c3fba12286419cc5490ecc262f2
8d763a6d6dc7b73504e259d6755a91215cc90a77
89ee31619ad837c48dfe0eeb3bd1e65d8c372d8b73c1f1e345c6dd91aca7f25f
GET /multiauth/ping HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_7zqwiakybqrl8lr268b3o=1; test_cooke_v6b8f6uagrdfav61e12gjq=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 401 Unauthorized
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: a9702efae90840888287e04637bad914
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 35
date: Mon, 14 Nov 2022 07:07:11 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 29b1503232a9cf0843bd9f0d01c0a9a5
620b3b98a58cd32175d40534dca81ef4a26d880f
1f54c0fa57ea62f131e173d4a365d6d2d4d10e0993eb69eaf9e27d3788a5daf8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F54C0FA57EA62F131E173D4A365D6D2D4D10E0993EB69EAF9E27D3788A5DAF8"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5643
Expires: Mon, 14 Nov 2022 08:41:14 GMT
Date: Mon, 14 Nov 2022 07:07:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 29b1503232a9cf0843bd9f0d01c0a9a5
620b3b98a58cd32175d40534dca81ef4a26d880f
1f54c0fa57ea62f131e173d4a365d6d2d4d10e0993eb69eaf9e27d3788a5daf8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F54C0FA57EA62F131E173D4A365D6D2D4D10E0993EB69EAF9E27D3788A5DAF8"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5643
Expires: Mon, 14 Nov 2022 08:41:14 GMT
Date: Mon, 14 Nov 2022 07:07:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 29b1503232a9cf0843bd9f0d01c0a9a5
620b3b98a58cd32175d40534dca81ef4a26d880f
1f54c0fa57ea62f131e173d4a365d6d2d4d10e0993eb69eaf9e27d3788a5daf8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F54C0FA57EA62F131E173D4A365D6D2D4D10E0993EB69EAF9E27D3788A5DAF8"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5643
Expires: Mon, 14 Nov 2022 08:41:14 GMT
Date: Mon, 14 Nov 2022 07:07:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 29b1503232a9cf0843bd9f0d01c0a9a5
620b3b98a58cd32175d40534dca81ef4a26d880f
1f54c0fa57ea62f131e173d4a365d6d2d4d10e0993eb69eaf9e27d3788a5daf8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F54C0FA57EA62F131E173D4A365D6D2D4D10E0993EB69EAF9E27D3788A5DAF8"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5643
Expires: Mon, 14 Nov 2022 08:41:14 GMT
Date: Mon, 14 Nov 2022 07:07:11 GMT
Connection: keep-alive
3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials
200 OK 12 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials
IP
Hash 2a3a1e703e3488450a6c5dbe4326ef73
43fff05212a95cc72673a60fb07fbbc382a0327c
d722db810a329534d2aabaf6579bf9796df3822ad51874323afbd08c4ffb11ea
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/websocket/credentials HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 55fd9a1c7bcd040c7baf5d5a997187a0
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:10 GMT
set-cookie: PHPSESSID=ng3c90859ui09m9in8a3ffdiah; expires=Wed, 14-Dec-2022 07:07:10 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Tue, 15-Nov-2022 07:07:10 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Mon, 21-Nov-2022 07:07:10 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg
200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ac5583760066002adcbba078f6dd1be4
39ca30395586cf1a0a0fa739f7279af807f548a3
cb5986e3330858716cd290297a81d77e371b838637fc57eece94810211715a7c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9921
x-amzn-requestid: 933f6aa6-3bec-4f71-aba8-ef9e77942ae9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjycgGB-oAMFsDQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371644f-47d26359464b62b7276316e6;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:40:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: cl4CvcuSz4XqydcANekLjl49PkkKUuMs_EsPwEK0pu_VF57S3szecA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 21:52:20 GMT
age: 33291
etag: "39ca30395586cf1a0a0fa739f7279af807f548a3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F11024ab6-70a0-4537-b976-642a32f8a125.jpeg
200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F11024ab6-70a0-4537-b976-642a32f8a125.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash de6b8d945685fcbd3b58522e10370c90
234bccdfc13730502e4c1ed2fdefd18f6e755819
f4b8aa1afeffd037e199a46290d16e9145815f6d0eb07ff9778c7f279005ca7c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F11024ab6-70a0-4537-b976-642a32f8a125.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9944
x-amzn-requestid: 00690925-6754-46e2-aa9e-e1c70dd8058d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bhzYBE88IAMFTyw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637098ff-5ab1f32a12f1366146c0e86c;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 07:13:03 GMT
x-amz-cf-pop: SFO20-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: hMdY-OxJEaeuh3jP7eiShmumpDGUJTNGcnb-GB7FWeTnixd1wo8oaQ==
via: 1.1 34d694cee116d42560f77448eb932ac8.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 07:19:01 GMT
age: 85690
etag: "234bccdfc13730502e4c1ed2fdefd18f6e755819"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/countries.json
200 OK 14 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/countries.json
IP
Hash 9c4193dc568fe8d3559e5d6b95582d61
8018c8730a292867a6827507993a2bdff108e6e7
188430e7b7b8b8df52a0d288cb45c74f467801d68b6cecd6f3506f05bc803cff
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/countries.json HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.1.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"58a790f0aa559332c92cfe0386c08e2f"
x-request-id: e87e52f55771f9c192b6c0e85a3a8724
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:10 GMT
set-cookie: PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; expires=Wed, 14-Dec-2022 07:07:10 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Tue, 15-Nov-2022 07:07:10 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Mon, 21-Nov-2022 07:07:10 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e7a51c-5de3-477d-928f-95ab858d7616.jpeg
200 OK 5.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e7a51c-5de3-477d-928f-95ab858d7616.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 32cd1a339ce2c05c0d0e57e0d706068f
9d223cfd46c57e901a892dbdb10d9be5a33017b3
a98f05d589d44c9d03e785253c9655f846a283425a84f9282ae96bc3e0487d95
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e7a51c-5de3-477d-928f-95ab858d7616.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5401
x-amzn-requestid: 45142688-ad31-425c-9391-c7a8c8c74a1f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bhz-5FKyIAMFYDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637099f8-71be2fa256fd345c5f3436c6;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 07:17:12 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: InAofPuyHHjnQpW1oK5EwPMe5jOpGLq8HoCVTGRU_157FHD-SBnA2A==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 07:40:47 GMT
age: 84384
etag: "9d223cfd46c57e901a892dbdb10d9be5a33017b3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff08b5706-5917-455d-96fa-e56fe4670cf6.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff08b5706-5917-455d-96fa-e56fe4670cf6.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b5a6c04c4c8c28100a69ac8e3969fe0c
1ad175acb910577e70c46149005ee5a70599518b
188e715bb141598dc890a3b55807b1f7e04f4a1e8b1870147411c32de2225926
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff08b5706-5917-455d-96fa-e56fe4670cf6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11323
x-amzn-requestid: 1455b668-15d1-4a9c-a3b6-8e1b15ea9009
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjyDvFzaoAMFxQQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637163b1-2783642c5cfcd69e672131a1;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:37:53 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: MCmix3JMuBtn98wae7Ek9dfEi4v4914Mlg4ZE3aEyfoD1cFt9aAfyw==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 21:53:45 GMT
age: 33206
etag: "1ad175acb910577e70c46149005ee5a70599518b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash f5563b8eaa8bbe5076e53dcb10e434a5
ce068739a71489f4991632ce5c6cd0943267a91a
c917e4ff0251bc6bbe67aab3858e5d3421fa743fe8e4e612a0938c2d2bb19e53
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash f5563b8eaa8bbe5076e53dcb10e434a5
ce068739a71489f4991632ce5c6cd0943267a91a
c917e4ff0251bc6bbe67aab3858e5d3421fa743fe8e4e612a0938c2d2bb19e53
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
200 OK 31 kB URL HTTP/2 fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Hash ac0d2859ea5f8fd6bcb3c305c08ec184
7f6c17e3e592cd8bd346b9cc261d8dd961b8aef7
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
GET /s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 30928
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Nov 2022 16:40:18 GMT
expires: Fri, 10 Nov 2023 16:40:18 GMT
cache-control: public, max-age=31536000
age: 311213
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&_u=YADAAEAAAAAAACAEK~&z=1708147185
200 OK 42 B URL HTTP/2 www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&_u=YADAAEAAAAAAACAEK~&z=1708147185
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=694065476&_u=YADAAEAAAAAAACAEK~&z=1708147185 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 14 Nov 2022 07:07:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash f5563b8eaa8bbe5076e53dcb10e434a5
ce068739a71489f4991632ce5c6cd0943267a91a
c917e4ff0251bc6bbe67aab3858e5d3421fa743fe8e4e612a0938c2d2bb19e53
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 07:07:11 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&_u=YADAAEABAAAAACAEK~&z=901463357
200 OK 42 B URL HTTP/2 www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&_u=YADAAEABAAAAACAEK~&z=901463357
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=409372843.1668409629&jid=1329444513&_u=YADAAEABAAAAACAEK~&z=901463357 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 14 Nov 2022 07:07:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 12 Nov 2022 12:31:58 GMT
expires: Sun, 12 Nov 2023 12:31:58 GMT
cache-control: public, max-age=31536000
age: 153313
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15340, version 1.0\012- data
Hash 19b7a0adfdd4f808b53af7e2ce2ad4e5
81d5d4c7b5035ad10cce63cf7100295e0c51fdda
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
GET /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15340
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 12 Nov 2022 01:26:23 GMT
expires: Sun, 12 Nov 2023 01:26:23 GMT
cache-control: public, max-age=31536000
age: 193248
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Nov 2022 21:46:16 GMT
expires: Fri, 10 Nov 2023 21:46:16 GMT
cache-control: public, max-age=31536000
age: 292855
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/currencies.json
200 OK 886 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/currencies.json
IP
Hash f403715ac3aa3ffa43c0724c3936ed55
5c1e0716f9d81ca21757775a45b101300e0d3c13
f4ee9108e76a8df49e7a8133fe1902e4f7f91b2b9c526489a215a7f2f3524bb6
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/currencies.json HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=166840962925061717; _ym_d=1668409629; _fbp=fb.1.1668409629407.1438755398; _ym_isad=2; multiAuthThirdPartyEnabled=true; _ym_visorc=b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:11 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"9a06c38e7d784277059aaa21439f7869"
x-request-id: 348561914af474463fbfc1f68526b839
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
code.jivosite.com/widget/3bcOoG4MqH
200 OK 13 kB URL HTTP/2 code.jivosite.com/widget/3bcOoG4MqH
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (19711)
Hash 3976a53059e780b2bec157b09afba851
91e74d68da6bf37b744aea75f953fb5929865e27
cb6a11c6242c14fb46965a468aa613ee9342a88d404d9690e7297a159d25143a
GET /widget/3bcOoG4MqH HTTP/1.1
Host: code.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:12 GMT
content-type: application/javascript
content-length: 5938
access-control-allow-origin: *
cache-control: max-age=7200
content-encoding: br
etag: "636cf1b8-1732"
expires: Fri, 11 Nov 2022 11:26:24 GMT
last-modified: Thu, 10 Nov 2022 12:42:32 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-14T06:54:01+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
node-sber1-az1-6.jivosite.com/widget/status/561276/3bcOoG4MqH?rnd=0.37041773978696213
200 OK 4.5 kB URL HTTP/2 node-sber1-az1-6.jivosite.com/widget/status/561276/3bcOoG4MqH?rnd=0.37041773978696213
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (3732), with no line terminators
Hash d44b1fc4fd73ac15728b206363e75519
9588ac4496edb6dfff2930878e30c0f70f28a451
72919839eb7b6147545604a091556a6852843edaa85e75adb9208a62e0c50806
GET /widget/status/561276/3bcOoG4MqH?rnd=0.37041773978696213 HTTP/1.1
Host: node-sber1-az1-6.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-max-age: 1728000
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: X-Geoip, X-Botmode
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors 'none';
content-type: application/json; charset=utf-8
pragma: no-cache
server: foxy/2.0.1
x-botmode: no
x-frame-options: DENY
x-geoip: NO;03;Oslo (Alna District)
date: Mon, 14 Nov 2022 07:07:12 GMT
X-Firefox-Spdy: h2
code.jivosite.com/script/widget/config/3bcOoG4MqH
200 OK 3.5 kB URL HTTP/2 code.jivosite.com/script/widget/config/3bcOoG4MqH
IP
ASN #199524 G-Core Labs S.A.
Hash d7040d77f95ec7c513f7f5b685703f09
3d8162d3a1f772b86bfff5ee5a4e0e7ce708dab0
84b237270527a0d6359e0232c220008be540d6efe58a628a2f0c17240aa0dd87
GET /script/widget/config/3bcOoG4MqH HTTP/1.1
Host: code.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:12 GMT
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=7200
content-encoding: gzip
expires: Mon, 14 Nov 2022 07:17:38 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-14T05:17:38+00:00
x-id: am3-up-gc95
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A650662727%3Arqn%3A2%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3632%2C3632%2C%2C%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A650662727%3Arqn%3A2%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3632%2C3632%2C%2C%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A650662727%3Arqn%3A2%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3632%2C3632%2C%2C%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 69
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Mon, 14 Nov 2022 07:07:12 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:12 GMT
last-modified: Mon, 14-Nov-2022 07:07:12 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A704296533%3Arqn%3A5%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A704296533%3Arqn%3A5%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A704296533%3Arqn%3A5%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Mon, 14 Nov 2022 07:07:12 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:12 GMT
last-modified: Mon, 14-Nov-2022 07:07:12 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A188288520%3Arqn%3A3%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A188288520%3Arqn%3A3%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A188288520%3Arqn%3A3%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 187
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Mon, 14 Nov 2022 07:07:12 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:12 GMT
last-modified: Mon, 14-Nov-2022 07:07:12 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A385127092%3Arqn%3A4%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A385127092%3Arqn%3A4%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668409630_a538747db7b45ea10087a07bd693cdbe33fa43fc93edae5bb43b1dc999825c32&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070710%3Aet%3A1668409631%3Ac%3A1%3Arn%3A385127092%3Arqn%3A4%3Au%3A166840962925061717%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668409627340%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668409631&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Mon, 14 Nov 2022 07:07:12 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:12 GMT
last-modified: Mon, 14-Nov-2022 07:07:12 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/favicon.png
200 OK 2.8 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/favicon.png
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash f8cbfde8f3484f7a5f02189742f0f110
3eb0cec3e65d6cb0cc2744b5fa57ded1afb6e4d4
70504d4dc047aeac702b31e9290e9f5553e901d07d3844269cd966042988159a
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.png HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=166840962925061717; _ym_d=1668409629; _fbp=fb.1.1668409629407.1438755398; _ym_isad=2; multiAuthThirdPartyEnabled=true; _ym_visorc=b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:13 GMT
content-type: image/png
content-length: 2810
last-modified: Wed, 09 Nov 2022 13:13:39 GMT
etag: "636ba783-afa"
accept-ranges: bytes
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2c13a10c32acfdcd9c08f3deecb1bfcc
22200cffaf219bf959bd2bdb469da18df5eff981
be04d27c45f2a8c75bdb603ce7d2272da4dcd961ac24bad20bb7372d8326d13e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE04D27C45F2A8C75BDB603CE7D2272DA4DCD961AC24BAD20BB7372D8326D13E"
Last-Modified: Sat, 12 Nov 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15481
Expires: Mon, 14 Nov 2022 11:25:16 GMT
Date: Mon, 14 Nov 2022 07:07:15 GMT
Connection: keep-alive
webchannel-content.eservice.emarsys.net/customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false
200 OK 513 B URL HTTP/2 webchannel-content.eservice.emarsys.net/customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false
IP
Hash 5a761153cb7bf523561753613415c48d
9ce298daffb9e5905a9cb86b87062ee2c03f9611
e6d730aaf546643aa0743d56e48afdfba75b1442fa21080bd5be5f45462a994e
GET /customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false HTTP/1.1
Host: webchannel-content.eservice.emarsys.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 07:07:15 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: *
content-type: application/json
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash c17ba432f7b8fd12f55ad92f426e7a06
09eab2b0a0bbbd39080bd8cf3b87b566df7f7b46
37c2f50cbcde67f756c0e0d213fd189eda6a45882d9d8d56e80ba7c5fcabf8fc
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Mon, 14 Nov 2022 07:07:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 13 Nov 2022 19:34:14 GMT
Expires: Mon, 14 Nov 2022 19:34:14 GMT
ETag: "09eab2b0a0bbbd39080bd8cf3b87b566df7f7b46"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 5e7ed907590da4082cbdaa33033d8b1d
a9621d1bf84fde43dc6fb5d3f65b2f57ecab5bb6
f2c60e82765918c328b69bce82a05ccc5153e6bc8bfa7856f5779ee5f0468731
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 07:07:17 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Fri, 18 Nov 2022 05:50:44 GMT
ETag: "a9621d1bf84fde43dc6fb5d3f65b2f57ecab5bb6"
Last-Modified: Mon, 14 Nov 2022 05:50:45 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1860
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 769de8cbbc76b4f1-OSL
code.jivo.ru/js/bundle_ru_RU.js?rand=1668155689
200 OK 313 kB URL HTTP/2 code.jivo.ru/js/bundle_ru_RU.js?rand=1668155689
IP
ASN #199524 G-Core Labs S.A.
File type Unicode text, UTF-8 text, with very long lines (61072), with no line terminators
Size 313 kB (313381 bytes)
Hash cf0ef636b81a8f3645f3479b66d38be2
166fbf64584df44f003a7ea78bddb536026b76af
1e55701c5b7114e8b10d722d86dd6b3931e7d4179fabc6637fb9308ca18d5162
GET /js/bundle_ru_RU.js?rand=1668155689 HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:17 GMT
content-type: application/javascript
content-length: 313381
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: br
etag: "636cf212-4c825"
last-modified: Thu, 10 Nov 2022 12:44:02 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-13T08:35:02+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/css/ff9b6aa/widget.css
200 OK 55 kB URL HTTP/2 code.jivo.ru/css/ff9b6aa/widget.css
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (65536), with no line terminators
Hash 1d0e2e9ca558df4902c4a3b074b31c4d
db7ad6ee6ec1b81b0c20a10a01ebd0ee311673e7
961550e51d443bcbbe4deb9cfabe6632093f0a22418efd333fe4d4754acc1bc9
GET /css/ff9b6aa/widget.css HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: text/css
content-length: 54697
cache-control: max-age=864000
content-encoding: br
etag: "636cf1fb-d5a9"
expires: Sun, 20 Nov 2022 13:27:23 GMT
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-10T13:27:23+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8e07f52c-038a-455c-999e-d73d0eb46026.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8e07f52c-038a-455c-999e-d73d0eb46026.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 558f53737293f89e6ac57744a92fa0af
f943dc15ce5f4b1810d81cb35d03e8961b990abb
33a031ace07e6918493684847ba4b4596ce8cfcd3740d62cc8cc85021f3788e6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8e07f52c-038a-455c-999e-d73d0eb46026.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 7362
x-amzn-requestid: eee8797a-33b0-43a5-9ea6-d5678b166289
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bZ3beEiPoAMFfJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636d6c49-48ad19f870be15bd639da9f6;Sampled=0
x-amzn-remapped-date: Thu, 10 Nov 2022 21:25:29 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NEcQPx96kXLJqkXtFVFDQSNk7fwKILrF74unksphlcSHRbfbdNyLiQ==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 22:56:20 GMT
age: 29458
etag: "f943dc15ce5f4b1810d81cb35d03e8961b990abb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
code.jivo.ru/css/ff9b6aa/omnichannelMenu.widget.css
200 OK 946 B URL HTTP/2 code.jivo.ru/css/ff9b6aa/omnichannelMenu.widget.css
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (3072), with no line terminators
Hash 54aae6819ea34eec8a760164a2687ec1
3d0f31f6358c3e64070c13f96986c5c7be2a140c
24dd4132e43f4ec35621fc382eb561b97160f4e8094c4eece6a716a0dfaa4d22
GET /css/ff9b6aa/omnichannelMenu.widget.css HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: text/css
content-length: 946
cache-control: max-age=864000
content-encoding: gzip
etag: "636cf1fb-3b2"
expires: Sun, 20 Nov 2022 13:27:24 GMT
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-10T13:27:24+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/js/ff9b6aa/omnichannelMenu.js
200 OK 3.1 kB URL HTTP/2 code.jivo.ru/js/ff9b6aa/omnichannelMenu.js
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (11729), with no line terminators
Hash 9f217604f6d2c5d8e28693a122c0d843
ec45d51615cde7b96de2c3baa4c47f8c24a82fb4
4922ceb0b72ca8ec25b06d8cbc681cc2c4f290f1eb83f05373a4bb002b5ecb2f
GET /js/ff9b6aa/omnichannelMenu.js HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: application/javascript
content-length: 3110
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: br
etag: "636cf1fb-c26"
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-13T13:27:32+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/sounds/agent_message.mp3
206 Partial Content 3.8 kB URL HTTP/2 code.jivo.ru/sounds/agent_message.mp3
IP
ASN #199524 G-Core Labs S.A.
File type MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo\012- data
Hash 8e9a165c4cb185ffd0b2658fa088e43b
195873e5e8bbb2f5ecc32d95f90d6fb75817a649
ff81aad05612f90cf97c238f219765884e5cbf49351d8dc96a4a063c598c3f43
GET /sounds/agent_message.mp3 HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: audio/mpeg
content-length: 3760
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: max-age=2592000
etag: "636381a0-eb0"
expires: Sat, 03 Dec 2022 12:20:30 GMT
last-modified: Thu, 03 Nov 2022 08:53:52 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-03T12:20:30+00:00
x-id: am3-up-gc95
content-range: bytes 0-3759/3760
X-Firefox-Spdy: h2
code.jivo.ru/sounds/notification.mp3
206 Partial Content 5.8 kB URL HTTP/2 code.jivo.ru/sounds/notification.mp3
IP
ASN #199524 G-Core Labs S.A.
File type Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural\012- data
Hash 9aa341af370c4e59155717260ba0f282
0c1216ecead8d1409557c843d96202c063f3f252
1112436abea08c851302bba4d4e37a27e25e5ec26b20474667a3369d41154bab
GET /sounds/notification.mp3 HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: audio/mpeg
content-length: 5808
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: max-age=2592000
etag: "636381a0-16b0"
expires: Sat, 03 Dec 2022 12:10:40 GMT
last-modified: Thu, 03 Nov 2022 08:53:52 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-03T12:10:40+00:00
x-id: am3-up-gc95
content-range: bytes 0-5807/5808
X-Firefox-Spdy: h2
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash e4c9a4a29621f2dad371f791bc9270aa
f9c7fc8a3b2f4026b37e784a823cc7016d6d87ab
d4e8e0c31963ac03f2138c94e4eff3e9ab80c3359aa9e8d633ab9749e9833e58
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 910
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Mon, 14 Nov 2022 07:07:18 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997817183577309184; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 3
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
code.jivo.ru/sounds/outgoing_message.mp3
206 Partial Content 5.0 kB URL HTTP/2 code.jivo.ru/sounds/outgoing_message.mp3
IP
ASN #199524 G-Core Labs S.A.
File type MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo\012- data
Hash 7bf3e4962a5ecf1f8cbcc2ff3428f531
f75c694461a643d2e096ae8d0f6c1a9d19602eee
d44244617bf21df7a137694fa762d5cab3b82cb9fae8f33de5917977b02b2a11
GET /sounds/outgoing_message.mp3 HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Mon, 14 Nov 2022 07:07:18 GMT
content-type: audio/mpeg
content-length: 5014
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: max-age=2592000
etag: "636381a0-1396"
expires: Sat, 03 Dec 2022 12:20:30 GMT
last-modified: Thu, 03 Nov 2022 08:53:52 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-03T12:20:30+00:00
x-id: am3-up-gc95
content-range: bytes 0-5013/5014
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/css/main.687ea28c.chunk.css
200 OK 0 B URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/css/main.687ea28c.chunk.css
IP
GET /spa-static/1.4.1006/static/css/main.687ea28c.chunk.css HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: text/css
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-54"
expires: Mon, 14 Nov 2022 08:02:15 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 11094
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2BQPbWhbSzHxSZCzngv%2BM%2Bh2LTvEij4MOSDSbKN0f9XaLVYUBPTa8NjvDb00A2h5NfyqOjSoTjPTBHIdnaHgrfCKuxc7mY7nFxFNadBM8p0sIbec1v9hdq3Ytc%2BKLBvmI%2BJ2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 769de898fefcb50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/footer_links
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/footer_links
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/footer_links HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=166840962925061717; _ym_d=1668409629; _fbp=fb.1.1668409629407.1438755398
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:11 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 82347d4c167b819638056c1f2d850377
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/settings
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/settings
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/settings HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 38b07d834149ad1dd7b47a677b62b6ec
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:10 GMT
set-cookie: PHPSESSID=rhih7n3j82rvvui13rto746fu6; expires=Wed, 14-Dec-2022 07:07:10 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Tue, 15-Nov-2022 07:07:10 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Mon, 21-Nov-2022 07:07:10 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese
IP
GET /css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://front.cdn-mb.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 14 Nov 2022 07:07:11 GMT
date: Mon, 14 Nov 2022 07:07:11 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=messages&fallback=1
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=messages&fallback=1
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v2/translations?locales[]=bn&domains[]=messages&fallback=1 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Connection: keep-alive
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:10 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"6cf4e14b952c37946f84bd142ff5a7fe"
x-request-id: 9012cdc90bfc223d3917b53c0cbc19ed
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)fip(1)rqnl(1)ti(2)
302 Found 0 B URL HTTP/2 mc.yandex.ru/watch/37954615?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)fip(1)rqnl(1)ti(2)
IP
GET /watch/37954615?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
location: /watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1810302869%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A1513%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A987609120119%3Ahid%3A350433437%3Az%3A0%3Ai%3A20221114070709%3Aet%3A1668409629%3Ac%3A1%3Arn%3A149407239%3Arqn%3A1%3Au%3A166840962925061717%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C236%2C31%2C1%2C234%2C0%2C%2C401%2C3%2C%2C%2C%2C919%3Ans%3A1668409627340%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668409629%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29
date: Mon, 14 Nov 2022 07:07:10 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
set-cookie: yandexuid=2315705611668409630; Expires=Tue, 14-Nov-2023 07:07:10 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
yuidss=2315705611668409630; Expires=Tue, 14-Nov-2023 07:07:10 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
yabs-sid=873042941668409630; Path=/; SameSite=None; Secure
i=OwZQenEFKeHzmQADS4Y2BK3Uyz/5o7/3tCy7LncV9rbIr9qx9lx/exswLxj0tfo+kQpoBOoxG7thsDYlie1Tuufu7fg=; Expires=Thu, 11-Nov-2032 07:07:01 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly; SameSite=None
ymex=1699945630.yrts.1668409630#1699945630.yrtsi.1668409630; Expires=Tue, 14-Nov-2023 07:07:10 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Mon, 14-Nov-2022 07:07:10 GMT
last-modified: Mon, 14-Nov-2022 07:07:10 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Connection: keep-alive
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=166840962925061717; _ym_d=1668409629; _fbp=fb.1.1668409629407.1438755398; _ym_isad=2; multiAuthThirdPartyEnabled=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:11 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"6cf4e14b952c37946f84bd142ff5a7fe"
x-request-id: eef999ab3246b56f1dce3b266ab65ec8
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/auth/providers
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/auth/providers
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/auth/providers HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: tiz0f1nkc8fnzrfqioe5
x-client-device-id: m0v2edhnnhixl8avs8qu
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1810302869&pid=14628&sip=0
Cookie: theme=desktop; rst-uid=6997817183577309184; _ga_HCZ6L6382W=GS1.1.1668409628.1.0.1668409628.0.0.0; _ga=GA1.2.409372843.1668409629; cid=1810302869; prid=most_partner.1810302869; pid=14628; sip=0; PHPSESSID=oa2662b8q7d65ai7mp3q9cq8hm; lunetics_locale=bn; tz=Europe%2FOslo; _gid=GA1.2.1318375477.1668409629; _gaclientid=409372843.1668409629; _gasessionid=20221114|03197610; _gahitid=1668409628740; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=166840962925061717; _ym_d=1668409629; _fbp=fb.1.1668409629407.1438755398; _ym_isad=2; multiAuthThirdPartyEnabled=true; _ym_visorc=b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 07:07:11 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: b1f6a4c7a02b1d237db43a7bb62630b0
vary: Accept-Encoding, Accept-Language
expires: Mon, 14 Nov 2022 07:07:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js
200 OK 0 B URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js
IP
GET /spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 07:07:09 GMT
content-type: application/javascript
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-7ac65"
expires: Mon, 14 Nov 2022 08:02:48 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 11061
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Va%2BXIOJYeYs5pFWSE2hOHjSkQ9%2FduP3tWbbrVre72rZq46p3zP9w72yi4mQFL45CUJDhoH9%2BvgrajAUMLMPLA8FgNdmd3MC4ZvaHAL4On74apPx2BgQOi%2B78Egg2ey6u3j%2Fw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 769de898ae98b50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
35.159.51.213
34.117.237.239
104.18.21.226
31.13.72.36
93.184.220.29
92.223.126.57
23.36.76.226
188.72.107.240
77.88.21.119