www.newsandpromotions.com/tracking/8760
34.117.221.220307 Temporary Redirect 0 B URL HTTP/1.1 www.newsandpromotions.com/tracking/8760
IP 34.117.221.220:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tracking/8760 HTTP/1.1
Host: www.newsandpromotions.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 307 Temporary Redirect
Date: Thu, 08 Dec 2022 22:46:46 GMT
Server: Apache
Set-Cookie: _xTID=8760; expires=Thu, 08-Dec-2022 22:51:46 GMT; Max-Age=300; path=/; domain=newsandpromotions.com
_xSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=newsandpromotions.com
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Location: http://track.ecampaignstats.com/lprd/trk.php?TID=8760
Vary: User-Agent
Content-Length: 0
Content-Type: text/html; charset=UTF-8
X-Varnish: 48036550
Age: 0
X-Cacheable: NO:Logged in/Got Sessions
Via: 1.1 varnish (Varnish/6.0), 1.1 google
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2acd891dc6eb1f09f57a2b086791781
1e2088306501a61edcca1ade62c4d54f23b3b083
51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11467
Expires: Fri, 09 Dec 2022 01:57:53 GMT
Date: Thu, 08 Dec 2022 22:46:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash aea93551fa9deb76ae49a3b4019d64fe
e3b8862057ebe839959228e42246d7b1807fc90c
7e210f03b140418085e94ec20c1d27d6ecf7a404cbd323e16476ae5ae95d6dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7E210F03B140418085E94EC20C1D27D6ECF7A404CBD323E16476AE5AE95D6DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9541
Expires: Fri, 09 Dec 2022 01:25:47 GMT
Date: Thu, 08 Dec 2022 22:46:46 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash c3470f9f0a4df8c1496b577fa9435ff6
f83b0226bb57ed0f3e1acdad61b940414add135d
f542579e3a3577a646babde862282c2afda6ed784360a915143216100f7a3d91
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F542579E3A3577A646BABDE862282C2AFDA6ED784360A915143216100F7A3D91"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3707
Expires: Thu, 08 Dec 2022 23:48:33 GMT
Date: Thu, 08 Dec 2022 22:46:46 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 22:08:15 GMT
content-type: application/json
age: 2311
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 4g6IQCWliryShscOpVG02UEqMzF6H0azP4OnuoAM+HdkHImrx8ZWOraLlLA7KVxSYDAv3x2kQCI=
x-amz-request-id: TTPJCVP4HQTZFY4P
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 21:48:04 GMT
age: 3522
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 22:46:46 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Last-Modified, ETag, Cache-Control, Alert, Content-Length, Pragma, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 22:07:58 GMT
age: 2328
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash fd55f4aaaab6ec40bc7dc10252cd819a
a72523f60be265a391fa9edc43e0a93418ad1fd0
bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5065
Cache-Control: max-age=128669
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:47 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 10:31:16 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471
track.ecampaignstats.com/lprd/trk.php?TID=8760
209.148.95.13302 Found 0 B URL HTTP/1.1 track.ecampaignstats.com/lprd/trk.php?TID=8760
IP 209.148.95.13:0
ASN #394844 ROOT-LEVEL-TECHNOLOGY
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /lprd/trk.php?TID=8760 HTTP/1.1
Host: track.ecampaignstats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Date: Thu, 08 Dec 2022 22:46:46 GMT
Server: Apache/2.4.52 (Debian)
Set-Cookie: _xTID=8760; expires=Thu, 08-Dec-2022 23:01:46 GMT; Max-Age=900
Location: https://www.cardealsnearyou.com?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content=&utm_term=
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
push.services.mozilla.com/
54.202.70.174101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 54.202.70.174:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: JxVypR1tyLcB7KOBN+rGcg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: f0o9qhY0PetIBnc1xBSv8S6J/Sw=
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 64b06d65628a6c0abfc8830a05df063d
f7026187771bcd9a45e499fd8410476b76175718
42d6afde50843d5f5247ab2acab5dd0637822a6af0de0f1b17eac1440b4cdc56
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "42D6AFDE50843D5F5247AB2ACAB5DD0637822A6AF0DE0F1B17EAC1440B4CDC56"
Last-Modified: Wed, 07 Dec 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20759
Expires: Fri, 09 Dec 2022 04:32:46 GMT
Date: Thu, 08 Dec 2022 22:46:47 GMT
Connection: keep-alive
www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content=&utm_term=
8.38.122.197301 Moved Permanently 0 B URL HTTP/2 www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content=&utm_term=
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content=&utm_term= HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 301 Moved Permanently
x-b-cache: BYPASS
x-redirect-by: WordPress
set-cookie: stm_visitor_1=58464791; expires=Sat, 07-Jan-2023 22:46:47 GMT; Max-Age=2592000; path=/
location: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 22:46:47 GMT
server: Apache
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7811
Expires: Fri, 09 Dec 2022 00:56:59 GMT
Date: Thu, 08 Dec 2022 22:46:48 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7811
Expires: Fri, 09 Dec 2022 00:56:59 GMT
Date: Thu, 08 Dec 2022 22:46:48 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7811
Expires: Fri, 09 Dec 2022 00:56:59 GMT
Date: Thu, 08 Dec 2022 22:46:48 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7811
Expires: Fri, 09 Dec 2022 00:56:59 GMT
Date: Thu, 08 Dec 2022 22:46:48 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F884d1162-4377-487f-a056-b21117ef5001.jpeg
34.120.237.76200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F884d1162-4377-487f-a056-b21117ef5001.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9cb76c68a8cd472600106cc118067868
6cee6b1828c709f68b995197ca943a5c393f86fb
009d9ba19043b03b5aceeb80b69bf249f19a0a225bdbfef7ab8691669cb64130
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F884d1162-4377-487f-a056-b21117ef5001.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8204
x-amzn-requestid: cf54b5f8-ede8-49d5-aa56-5d9de98e3ab8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cjtKfEiToAMFSXA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638af576-6ddfe35c0b31074d6a07076f;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 07:06:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UfqFAlLedF6ZkfbGXhyYDcvu0porNJb6LPaeQ8p4dqWqsFD6iRgWLw==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 15:12:28 GMT
age: 27260
etag: "6cee6b1828c709f68b995197ca943a5c393f86fb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd0c11050-5c0c-4d59-80cd-f72cf377a852.jpeg
34.120.237.76200 OK 7.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd0c11050-5c0c-4d59-80cd-f72cf377a852.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b1a13d12c326848d5b7adeb2562a35a5
d795c519ea637a213aab1d80daaf44ce5ad19069
f7b99c93b99268e1b2fa438d493cf23cd75a98833710ddd22b5278a76e9f019a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd0c11050-5c0c-4d59-80cd-f72cf377a852.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7919
x-amzn-requestid: 05f49b7c-7c76-4df4-8258-c270078d8fe9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctl_TH-KoAMFkWg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638ee9fb-1971e1e0359763a96b4d320b;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 07:06:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: BEsmH1BkWu_c_-qHStWD1CT1Lx1AZVcw9tnLcoGZCmnjwFWdtB7BRA==
via: 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 21:02:50 GMT
age: 6238
etag: "d795c519ea637a213aab1d80daaf44ce5ad19069"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F345b9f5c-0162-4ba2-800e-223d402d28bf.jpeg
34.120.237.76200 OK 3.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F345b9f5c-0162-4ba2-800e-223d402d28bf.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a1be0ae00ba0c6009ac14c8df38b8ad0
33edd1469c54a08e3c4cb0003b87b225eba55b3f
ab70390c49c5bb3dd7e97ba008c01213a59b3bc271aa8a350ab35ff422d8b3fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F345b9f5c-0162-4ba2-800e-223d402d28bf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3030
x-amzn-requestid: c5e5e4a1-bc45-42e8-a021-9c8f99e22556
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czUqCFWBoAMFiqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639134a6-5cc9bdf360f2bfb54e16b448;Sampled=0
x-amzn-remapped-date: Thu, 08 Dec 2022 00:49:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: x5FUJ8Cbw9B9BWcHlencYw564Xri5cgoVXkQ2MbhEjYq7Y5v2P0IxQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 14:51:55 GMT
etag: "33edd1469c54a08e3c4cb0003b87b225eba55b3f"
content-type: image/jpeg
age: 28493
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg
34.120.237.76200 OK 8.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash eb00a2a503a690cee3e4dd729b5bc9bd
cfb1e5bcab2148a777889680e6e36b9d7e8917ec
7e4583ae78ab597639f53669ac2d67d1ebd26be3278c2fc3fc95af934178c116
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7960
x-amzn-requestid: beadd240-39d0-407d-a890-6a095657cac3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctEd8HC0oAMFUag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638eb459-44d4f63c62f58684782ef14a;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 03:17:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: kTEbkncBnAJmQE8cdAqvDtejiwaetpRBsVcpLXy1h52lO4iUkzmOGA==
via: 1.1 74aa91fe819001bcedd882694f52b436.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 16:28:48 GMT
age: 22680
etag: "cfb1e5bcab2148a777889680e6e36b9d7e8917ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf3829a8-4b4d-433d-9452-46c3ffc7ea6e.jpeg
34.120.237.76200 OK 7.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf3829a8-4b4d-433d-9452-46c3ffc7ea6e.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 955c6ac69b89f6cbd497df53fcb2ae1b
2506152cdd1056533116feb9350124356e570e54
fca1b303a554aa9cdd13c4769a1088e1905ef888ed703de17864fe76ff880abe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf3829a8-4b4d-433d-9452-46c3ffc7ea6e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7217
x-amzn-requestid: be9196fc-3d43-49db-8522-8781cbf5a247
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csUEDEWpIAMFqUQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e66e6-04b24220213872ba378d3538;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:47:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 4QlJZW4ZiPNVhOJbcRldanR8veym3l0sIBGa1Ym-4FOTT_utMQeZQg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 08:39:07 GMT
age: 50861
etag: "2506152cdd1056533116feb9350124356e570e54"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47563cf2-d887-4c1d-a3b9-0b5151226171.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47563cf2-d887-4c1d-a3b9-0b5151226171.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0321199622f614202a646f925521ace7
cac4e03ae9857def8b094e005647c3e49c34d686
042494598add540a49650d5556d33bf53f647d77e64fbf13f3d881ebf251a525
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47563cf2-d887-4c1d-a3b9-0b5151226171.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8709
x-amzn-requestid: 8c5094d3-3286-44db-bd3f-9369cd8220eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: c2LYGGm6oAMFn1A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63925900-2ea563bc1b5aa87a0ebd6251;Sampled=0
x-amzn-remapped-date: Thu, 08 Dec 2022 21:37:04 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oHNHICPfq1U2qYhNmrtf5_56-jtn-zOMPGvBdhXICE493RfJ1cFCvA==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 21:59:55 GMT
age: 2813
etag: "cac4e03ae9857def8b094e005647c3e49c34d686"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash d61883097c47c0fcb4a15cafc5bdbdfc
54411aba43093cafd1cb2acea7c2b4c69184611f
0aef2b974544f530bd591dd0201909a9c2a6b3f4451c69288bafc126d9a37e2c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
93.184.220.29200 OK 279 B IP 93.184.220.29:0
Hash 751ba6176ded85595c594fef175946d4
34f7cde70159cde1c4a04b370fe662df9ff010fd
7a141fe590a06db212e0c6570342ac7366633f79b32040b33a498c8c94f6957c
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 165
Cache-Control: max-age=88112
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Etag: "63911de4-117"
Expires: Fri, 09 Dec 2022 23:15:21 GMT
Last-Modified: Wed, 07 Dec 2022 23:12:36 GMT
Server: ECS (amb/6B7D)
X-Cache: HIT
Content-Length: 279
maps.googleapis.com/maps/api/js?key=AIzaSyDr1xM6IU4fHaTYM8RxC9hoou0Ig_58ITc&libraries=places%2Cdrawing%2Cgeometry&language=en&ver=2.0.1
142.250.74.106200 OK 59 kB URL HTTP/2 maps.googleapis.com/maps/api/js?key=AIzaSyDr1xM6IU4fHaTYM8RxC9hoou0Ig_58ITc&libraries=places%2Cdrawing%2Cgeometry&language=en&ver=2.0.1
IP 142.250.74.106:0
File type ASCII text, with very long lines (2447)
Hash 4e268119117762d1206cd251bdd04441
f691e436e17a3349c4ffd67b88a23e818e973023
8ba0f96b20b2d8264bd171eca86374f2c146df466b87e2317f52f1624b1ccc15
GET /maps/api/js?key=AIzaSyDr1xM6IU4fHaTYM8RxC9hoou0Ig_58ITc&libraries=places%2Cdrawing%2Cgeometry&language=en&ver=2.0.1 HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-encoding: gzip
server: mafe
content-length: 59158
x-xss-protection: 0
x-frame-options: SAMEORIGIN
server-timing: gfet4t7; dur=26
date: Thu, 08 Dec 2022 22:32:55 GMT
expires: Thu, 08 Dec 2022 23:02:55 GMT
cache-control: public, max-age=1800
content-type: text/javascript; charset=UTF-8
age: 834
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
maps.googleapis.com/maps/api/js?key=AIzaSyDRiOJcH5jlSFqsAFGOgkGLZ02XvQSMTHo&libraries=places&sensor=false&language=en-US&ver=5.1.2
142.250.74.106200 OK 56 kB URL HTTP/2 maps.googleapis.com/maps/api/js?key=AIzaSyDRiOJcH5jlSFqsAFGOgkGLZ02XvQSMTHo&libraries=places&sensor=false&language=en-US&ver=5.1.2
IP 142.250.74.106:0
File type ASCII text, with very long lines (2459)
Hash 1cb0bc690dabc60e9268d89c14aeb21b
fdb06535fd8100a1344e3a0a6925db020a95e586
35605bff5beee283e6a569e456b74aa2763a80cef5ebc0123206b055937a33be
GET /maps/api/js?key=AIzaSyDRiOJcH5jlSFqsAFGOgkGLZ02XvQSMTHo&libraries=places&sensor=false&language=en-US&ver=5.1.2 HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-encoding: gzip
server: mafe
content-length: 56002
x-xss-protection: 0
x-frame-options: SAMEORIGIN
server-timing: gfet4t7; dur=22
date: Thu, 08 Dec 2022 22:32:55 GMT
expires: Thu, 08 Dec 2022 23:02:55 GMT
cache-control: public, max-age=1800
content-type: text/javascript; charset=UTF-8
age: 834
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:400%2C400+%21important%2C700%7CRoboto:700%2C400&display=swap
142.250.74.106200 OK 1.2 kB URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:400%2C400+%21important%2C700%7CRoboto:700%2C400&display=swap
IP 142.250.74.106:0
Hash 07642532ef3f57996652367e3a735133
6f7327ad6f02c98b80f11366107ef4d5abe7dd83
73097f704df43c8124c3297a57e7a9b70acc47287b9d247ca08e389adbb68f68
GET /css?family=Montserrat:400%2C400+%21important%2C700%7CRoboto:700%2C400&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 22:46:49 GMT
date: Thu, 08 Dec 2022 22:46:49 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 6ec5f6261a8262e9f94b29627f54cefe
7ac766cf2ac8c2d960ec033388a767ff8a7d45e2
5f6ee11d840909fc5272c2c32f7874d55f49d831abc88d527e35562d218890f9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.cardealsnearyou.com/wp-content/plugins/dynamic-content-for-elementor/assets/css/animations.css?ver=2.7.10
8.38.122.197200 OK 1.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/dynamic-content-for-elementor/assets/css/animations.css?ver=2.7.10
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 590881ddb2faca501eb64a1cae756d2a
095a054091ac2d12de37d460b54fac424f406fc1
e4ac349500702dcd738cde2fb9eb760d6d11d762e25997a39e3cb9db23ad40a3
GET /wp-content/plugins/dynamic-content-for-elementor/assets/css/animations.css?ver=2.7.10 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:02 GMT
etag: "3cfb-5e9dce38493fc-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1551
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/formidable/css/formidableforms.css?ver=10181831
8.38.122.197200 OK 8.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/formidable/css/formidableforms.css?ver=10181831
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (51296)
Hash ea90d24c5f8e265b80412d77c8fe82ce
9aa22159c8a3ad5e7980e8efc9d5ddd692236207
639d7e1e608414d341a42ed372d15f0f18caf92bb9cd946de61f814d711eea01
GET /wp-content/plugins/formidable/css/formidableforms.css?ver=10181831 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 18 Oct 2022 18:31:28 GMT
etag: "c8c4-5eb534ce47ce3-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 8583
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/css/dist/block-library/style.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/css/dist/block-library/style.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (43771)
Hash e5548800176e913a9084f47a3e1e04f6
eff4604acc5c26ae82a19188de2f98bf5b79d80c
a2569c768eaca09f2483b971fcebb97badd57c9a16b5ae3e16b8cdcd8c688b07
Analyzer Verdict Alert fortinet Phishing
GET /wp-includes/css/dist/block-library/style.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Wed, 13 Jul 2022 13:21:17 GMT
etag: "15b64-5e3afa8f72a1e-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 11681
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.4
8.38.122.197200 OK 972 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.4
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 8bf268dfcca7cb20719b7ea14373ef4a
58bd839bbf0e8cc082f0a488b538b4ec71bebd2e
eece4a14939273c7af07bce8bab3a6cfc2c9de44c0eea82cc886abac13cb3870
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.4 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 25 Oct 2022 16:45:04 GMT
etag: "aab-5ebdea14c16e2-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 972
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash a0905812e8498e6c5c0a9b4b584b972f
039b784fd1e0152ec7f49a54ba027f0b2bd1e833
ee3531ef0f334dcd73a86b1e4365a020d5db69ff7b82bad136eaf1a8e9d3b47f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.cardealsnearyou.com/wp-content/uploads/stm_fonts/stm-icon/stm-icon.css?ver=1.0
8.38.122.197200 OK 1.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/stm_fonts/stm-icon/stm-icon.css?ver=1.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash bca8508ed19ce66d215162de0dcd5743
538112b87de9de0ca1b5b7e2d446a3244e2f523a
b080aba9c0cbdeb630352ebbce2c83a06783a09e4c34d54a0c8e73aa408582ef
GET /wp-content/uploads/stm_fonts/stm-icon/stm-icon.css?ver=1.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 25 Oct 2022 16:53:57 GMT
etag: "18eb-5ebdec10e3351-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1333
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/owl.carousel.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 899 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/owl.carousel.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (3630), with no line terminators
Hash 0fd6cde7646e79e085a7bcd4e54454e1
6af9258308691fc18f233b3a716bab3d0ef49426
4ba6f1bcf100600b7f2e008c46cc8597916f14c8db378fa507f2daaa3560740d
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm_vehicles_listing/assets/css/frontend/owl.carousel.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "e2e-5d9e1308340c7-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 899
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/grid.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 1.4 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/grid.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (540)
Hash 010ba361ace5fbb7d07bd66b3a48cf2a
c60c40f4e72c63363b68ba02a2a19b682041a10f
f3edb316d73bcd98551b4d90fb059d3ebf5307852a046a507915fb0d8a7a60b8
GET /wp-content/plugins/stm_vehicles_listing/assets/css/frontend/grid.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "2b33-5d9e13083350f-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1444
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/lightgallery.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 3.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/css/frontend/lightgallery.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (20660), with no line terminators
Hash b8f5fb406b5dde0528079b1f2957f623
cd9e95a4c9121e714058ccd4b4bb20abfabc9080
d906fb4ec194f825b3a60ba2367400588fee92446204b49fdab907258b0e68c1
GET /wp-content/plugins/stm_vehicles_listing/assets/css/frontend/lightgallery.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "50b4-5d9e130833cdf-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3790
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 280 B IP 93.184.220.29:0
Hash 84de36d5372f52533eda018818cc79dd
06acac862e41839462c43d1adbe287bf0bc5d0fe
264e1b05b005b36b9122fb9dbb64840de28314ebae7ae0023da9b0deee3bb951
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 497
Cache-Control: max-age=167672
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Etag: "63925360-118"
Expires: Sat, 10 Dec 2022 21:21:21 GMT
Last-Modified: Thu, 08 Dec 2022 21:13:04 GMT
Server: ECS (amb/6B7D)
X-Cache: HIT
Content-Length: 280
ocsp.sca1b.amazontrust.com/
143.204.42.165200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP 143.204.42.165:0
Hash 6ac34378cbc9d41a56fe071b751f401f
89d0f36b3c6746f91f66e52384304e3ec5a6267e
bf8fbdf4b48a4f19132207b8e03600a61a0538639dbb52c164370b9db2bacec2
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=120120
Date: Thu, 08 Dec 2022 22:46:49 GMT
Etag: "639199a3-1d7"
Expires: Sat, 10 Dec 2022 08:08:49 GMT
Last-Modified: Thu, 08 Dec 2022 08:00:35 GMT
Server: ECS (bsa/EB24)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Tq_REmHXh6xP_THnyEPxvuxrso3_ZDZuQjUdiOiP_0c3GUNSMfd9Ag==
Age: 494
www.cardealsnearyou.com/wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/vendors/font-awesome.min.css?ver=1670539608
8.38.122.197200 OK 13 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/vendors/font-awesome.min.css?ver=1670539608
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (59158)
Hash d7913fc87c4606f82b4ee77a8d47fc2f
62a54acf7535ae53425b44dadfe5fdabf3d8300a
bb05c88bb0b82e2f14f1efb94b4c3511292f74c3bb7cb0b104d300a42a49492f
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/vendors/font-awesome.min.css?ver=1670539608 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:15:37 GMT
etag: "e7d0-5d9e133737f19-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12869
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm-megamenu/assets/css/megamenu.css?ver=2.3.1
8.38.122.197200 OK 29 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm-megamenu/assets/css/megamenu.css?ver=2.3.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (545)
Hash 45f6eab951ca317ec475b529f46417b4
fce41b7dd131001beb3f1dc96a1793452f624b44
a231e34d708b1f7663ec942c27dd9eec1fcdf574b8f9431522d3c360afbf32a2
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm-megamenu/assets/css/megamenu.css?ver=2.3.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:17:22 GMT
etag: "a149c-5d9e139b90cf5-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 29438
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/service-icons.css?ver=5.1.2
8.38.122.197200 OK 977 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/service-icons.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 641140f1223ff5df29ee18f8c8f70aba
ee0c640727fd652e863fd635d520b173e8b40d13
b5bc1943b25ef3c81c37dfb34d070364f53739ca18660bb96809c5a3225541aa
GET /wp-content/themes/motors/assets/css/service-icons.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "fad-5d2c3afd921f0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 977
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/classie.js?ver=5.1.2
8.38.122.197200 OK 2.0 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/classie.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 55e1109b3022c56ad23c5ba676055619
a940196e1ddfad80d753dd70484da942a3b2c2b4
9477ec4f89eb231b413a95b7438ababe1800c2cff84bb08283dedadf565731f1
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/classie.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "7b4-5d2c3afdeea89"
accept-ranges: bytes
content-length: 1972
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.cookie.js?ver=5.1.2
8.38.122.197200 OK 3.2 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.cookie.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 274f1795c34d6b35e0e79eb1633abe23
a9e973e7d4830462c90a44f4766ab4e1f5177fe5
582e7032302e4a28726d52ff3ff8db3bb0d1b3a7c1e83e38890ee62bc0a174ed
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/jquery.cookie.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "c9f-5d2c3afdf1582"
accept-ranges: bytes
content-length: 3231
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/boat-icons.css?ver=5.1.2
8.38.122.197200 OK 1.0 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/boat-icons.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash ed52b7ca5b3418b28153da35cedf6071
4487d8be68353b68bd5cc1d13f3f06f9cdbcfb27
19c044faacbde16eff6a8dbde2c95c527de4de1d75240f3e32f93de390db7582
GET /wp-content/themes/motors/assets/css/boat-icons.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:33 GMT
etag: "12c6-5d2c3afd50329-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1007
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/rental/icons.css?ver=5.1.2
8.38.122.197200 OK 516 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/rental/icons.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 277e52066662b1b4a68efef4e93727e2
a2f2b791f3510e4b5d44554e004f60d041ceca9c
3659bb3504f8f1972b298b0e35d3a7bb23abad8480b894c730a6081159daf0cf
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/rental/icons.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "658-5d2c3afd91638-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 516
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/motorcycle/icons.css?ver=5.1.2
8.38.122.197200 OK 490 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/motorcycle/icons.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash cb10860ede4d9ab43f9cdb5aaae451bd
e3910ef96d8ceb6550f9ea6a58c712d004b79acc
33da399f2c6220f71350a51b05a19058cec7ccc070e5b1c18520d0eaec608830
GET /wp-content/themes/motors/assets/css/motorcycle/icons.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "5b3-5d2c3afd90a80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 490
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/listing_two/icons.css?ver=5.1.2
8.38.122.197200 OK 427 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/listing_two/icons.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 19bb036adf9fd75599fa621d9cb38848
52111ce03d19317deb4405fe90e46fa556d3acd7
03e075be68024ed59155efdb887c1154ea3685980f4d35da09c6b2f21101a69a
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/listing_two/icons.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "401-5d2c3afd8fadf-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 427
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/auto-parts/style.css?ver=5.1.2
8.38.122.197200 OK 544 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/auto-parts/style.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 647499d93bd6ced6839431fee63db188
2090144108643c4f8ad4181e18c7625a9019615d
46cb51a861e4887e2d2017ac5e6eb349bc2b4427948598d26d6e55e6e15dcf58
GET /wp-content/themes/motors/assets/css/auto-parts/style.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:33 GMT
etag: "6bb-5d2c3afd4ff41-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 544
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/magazine/magazine-icon-style.css?ver=5.1.2
8.38.122.197200 OK 421 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/magazine/magazine-icon-style.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 5c1a960d788c02bad2b16c27e454c54c
173296d3fc4e8de3414a123deb279dfdd64bd034
f11d0b6e69aaf946642073a7cca64a84239b56463ea101419eb5cc2249a4bf5d
GET /wp-content/themes/motors/assets/css/magazine/magazine-icon-style.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "3e5-5d2c3afd902af-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 421
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/stm-aircrafts-font-style.css?ver=5.1.2
8.38.122.197200 OK 500 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/stm-aircrafts-font-style.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash e3aa2e50e7548a11d09b751859c1becb
576d4d743e87890fcb1d27c9b612095dc38f157f
08390ab2377861fbbeae93767265f829763ce9cbe12a73f93e79ce3eb2ce6c2c
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/stm-aircrafts-font-style.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "5dd-5d2c3afd98f53-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 500
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder/assets/img/vin-check-btn.svg
8.38.122.197200 OK 1.1 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder/assets/img/vin-check-btn.svg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1076), with no line terminators
Hash d0b222e20615087119d27f2619371dd0
dfa0a9fa19d7a53f94e430dc6210bb199b81d441
d47df921df4e7d3e59b1b157ab1d80bdda634160a5e1f2f6251418964121b9f1
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/motors-vin-decoder/assets/img/vin-check-btn.svg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:26 GMT
etag: "434-5e9dce4f3cf9d"
accept-ranges: bytes
content-length: 1076
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 404 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (1414), with no line terminators
Hash dcadca1139e6522100c6ba8850f572ca
dca0ee9e0f96f5f8d399e2aee39b26ff26a4ee18
bb206bb906b05edee537c89d075ec04bc570ff9f7e59270d803b6f4bb80f2534
GET /wp-content/plugins/motors-vin-decoder//assets/css/icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:26 GMT
etag: "586-5e9dce4f2e538-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 404
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/style.css?ver=5.1.2
8.38.122.197200 OK 396 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/style.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 5b14aab06cc4ce54392ef426221ba25d
07f40c8f54e83ff19f3d0b03529419cf0f93f1e5
32acde4090f36bd8d830b58765765d2fc848935052bb4154be54fb786447666b
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/style.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:35 GMT
etag: "298-5d2c3afeb1417-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 396
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 1.1 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (5334), with no line terminators
Hash 0b06d9e311712e0f5c38e06f549d646c
96ffc4906d416ca3c5e0aa21fc2d6ea262b4f8bd
e3c5dbba5924a8329f175882cd40dba5f02b082fb631dc6510119a88ce19b112
GET /wp-content/plugins/cookie-notice/css/front.min.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:49:49 GMT
etag: "14d6-5e9dce2b4f716-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1108
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/wp-auto-affiliate-links/css/style.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 998 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/wp-auto-affiliate-links/css/style.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 863bd6ca1f3e51547c37bbf7f3a621ed
b24c95e413ff38ea4e4bf0abf88db4feebe9f565
b895c8a154b420f9612aa9911eb4a1599585fc21e550dfff747226a1f38e59e5
GET /wp-content/plugins/wp-auto-affiliate-links/css/style.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:49:44 GMT
etag: "c78-5e9dce267100a-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 998
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/service-icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 691 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/service-icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (3302), with no line terminators
Hash ab6f97ea7059c232693a4b570e087b62
dcfe539ea4e28d385ce694223174123f82e14ac0
6d7bc8cdd8c2936c4e49bca0f1f14363bc020331fba7379c0f741f85e014ab6f
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/motors-vin-decoder//assets/css/service-icons.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:26 GMT
etag: "ce6-5e9dce4f2e920-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 691
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/stm-icon.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 922 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/stm-icon.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (4593), with no line terminators
Hash db40a8a36efef57420f92ea109fc33a2
5554034fed439657049ea0b3bd7eb43d9aa0fb50
c3ff3a300e8016e244ca4e49de4285da191044970ddcf0f93710d014481f5765
GET /wp-content/plugins/motors-vin-decoder//assets/css/stm-icon.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:26 GMT
etag: "11f1-5e9dce4f2f0f0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 922
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/jquery-ui.css?ver=5.1.2
8.38.122.197200 OK 1.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/jquery-ui.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (1165)
Hash 9c409d2d0082c4c92f139b79b9b56496
71af88ff8fb89bbde6780e3654e9ac5efcf6cd72
3abed05aa50906e4ba6d49983bd2c324bd57c9a0a4e74b52f95ceb965d27f27f
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/jquery-ui.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "1ad9-5d2c3afd7d9c9-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1833
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/select2.min.css?ver=5.1.2
8.38.122.197200 OK 2.0 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/select2.min.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (14965)
Hash 8e684dd388239a6bcac3bc41e52c4e17
2691065d51586e3fdcfce1ea8e51787a05061989
f5e41c52b1303b9ad13beb859f02abc7397d27e3b6504c5bd82a2b68dfa6ece4
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/select2.min.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "3a76-5d2c3afd91e08-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1998
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
a.clickcertain.com/px/smart/a/?c=243b667b11e7ebf
172.67.74.207302 Found 0 B URL HTTP/2 a.clickcertain.com/px/smart/a/?c=243b667b11e7ebf
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/smart/a/?c=243b667b11e7ebf HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: text/javascript
content-length: 0
location: https://a.clickcertain.com/px/?c=243b667b11e7ebf
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:49 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-2qlzc:cc-nginx-554675d589-2qlzc
x-requestid: 31dca6b3-23e5-401a-94b1-128fd8209c65
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HEynEG6mZhb3j3Xr%2FPEJqofongmWj2MIcpxCY4ZTz1ozQhio3TbExXdvT2z9qxQavt3E%2Foe7MHUna7WX%2FyD%2Fn2P3cooOsgNvUMI%2BF1huIKhHSmsjhd9C7%2FBNvc23npz%2F0LlkYA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a0e6e6bb503-OSL
X-Firefox-Spdy: h2
rdcdn.com/rt?aid=18662&e=1&img=1
52.7.240.180302 Found 121 B URL HTTP/2 rdcdn.com/rt?aid=18662&e=1&img=1
IP 52.7.240.180:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 3566835ab38329ddb105f8649131cabb
72eb59670ff0ea8cc99983629acc33aebd65a6e0
66b563593020781cd23517f1e111f600993a0b893f79970b32e9f95147db269c
GET /rt?aid=18662&e=1&img=1 HTTP/1.1
Host: rdcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: text/html; charset=utf-8
content-length: 121
cache-control: private
location: /eow
server: Microsoft-IIS/10.0
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
set-cookie: aid=18662; expires=Fri, 01-Jan-2038 06:00:00 GMT; path=/;SameSite=None; secure
ref=https://www.cardealsnearyou.com/; expires=Fri, 01-Jan-2038 06:00:00 GMT; path=/;SameSite=None; secure
img=http://rdcdn.com/rt?aid=18662&e=1&img=1; expires=Fri, 01-Jan-2038 06:00:00 GMT; path=/;SameSite=None; secure
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.13.1
8.38.122.197200 OK 901 B URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (715)
Hash e0b6ee7035469fab34982887e7ef21f7
8f38f75ae3db197142744524b6fcb8dc11efd577
f7f639c14daca92fe9f66f08d4ef076d2413eb99dbc35129158de1814d1d7c91
GET /wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:19:20 GMT
etag: "385-5d9e140bc8be3"
accept-ranges: bytes
content-length: 901
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/jquery.stmdatetimepicker.css?ver=5.1.2
8.38.122.197200 OK 4.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/jquery.stmdatetimepicker.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (1961)
Hash 2dbe5d4f94fdcf3df53ec6071a433b32
b71af6bb415f16b2624d97e8914137399c8ec596
0850bfcae403b88d409a60d16d73c6e1f7ef1c8274c5b090ab290b2aa7923546
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/jquery.stmdatetimepicker.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "4981-5d2c3afd7ddb1-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 4618
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.7.0
8.38.122.197200 OK 4.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.7.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (34217)
Hash ff23202f1227d35b13635501c86b2156
31c5de356f90da7a53468ef8ed0a9237cdaa67ce
c4b5a8cbcaef7b3a6d4d2f1a3d68cfac3a2ccb7fbfcd7ae212bf2c39fc85ed42
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.7.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: "865f-5d9e136b05866-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 4260
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
8.38.122.197200 OK 11 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (11126)
Hash 79b4956b7ec478ec10244b5e2d33ac7d
a46025b9d05e3df30d610a8aef14f392c7058dc9
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
Analyzer Verdict Alert fortinet Phishing
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 17 Dec 2020 15:23:57 GMT
etag: "2bd8-5b6aa9497f7ec"
accept-ranges: bytes
content-length: 11224
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.touch.punch.min.js?ver=5.1.2
8.38.122.197200 OK 1.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.touch.punch.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (1090)
Hash 700b877cd3ade98ce6cd4be349d81a5c
c1c36e6927436231eb20474356b29667c4c648aa
000854d782781aff1b16ea5451c1da3d07efadd35ab911ccb7e4b851571a25bd
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/jquery.touch.punch.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "50b-5d2c3afdf38ab"
accept-ranges: bytes
content-length: 1291
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/vivus.min.js?ver=5.1.2
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/vivus.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (11790)
Hash edca8ffeb6cac2f6d5f9186043d569b6
ff20f18369ad92eedfee40a0cd461510eef41756
6cbced0782f23b4da0f1c24988d05a1395af3f6399a50cdd79114f1aac5b2b0c
GET /wp-content/themes/motors/assets/js/vivus.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "2eb3-5d2c3afe1d89a"
accept-ranges: bytes
content-length: 11955
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/vin-decoder.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 4.5 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/motors-vin-decoder//assets/css/vin-decoder.css?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (23366), with no line terminators
Hash 409ed4df68521a808313b7ce8d2875d3
2bfeb5236e3db8e1ed77213d8dad9e97b6f7bb17
ec27d1caa25b46911cbe9f09fc12684cb3dc2c07c36972f6f9b9304145e9fd62
GET /wp-content/plugins/motors-vin-decoder//assets/css/vin-decoder.css?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:26 GMT
etag: "5b46-5e9dce4f2fca8-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 4490
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.cascadingdropdown.js?ver=5.1.2
8.38.122.197200 OK 15 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.cascadingdropdown.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash d46dc465806c94eb45c31ef252cc4d3e
6af119bb9785f07c0bdb0a6be7ade13cc045135c
17fb1aea21344fabd758897bdf5b704ee83e417efd5411c836cfef6ec2dfc41a
GET /wp-content/themes/motors/assets/js/jquery.cascadingdropdown.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "3af3-5d2c3afdf119a"
accept-ranges: bytes
content-length: 15091
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/assets/dummy.png
8.38.122.197200 OK 68 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/assets/dummy.png
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced\012- data
Hash 2a637d3d825673c0e3462fa4ed9a1c5c
81668d396da22832d75a986407ff10035e0d5899
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
GET /wp-content/plugins/revslider/public/assets/assets/dummy.png HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:09 GMT
etag: "44-5d9e135542066"
accept-ranges: bytes
content-length: 68
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/animation.css?ver=5.1.2
8.38.122.197200 OK 6.7 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/animation.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash c539b9aac3a65cca3f449ef37e548ccb
b87a9e1f75f50a6d22ee1d783d3689d674204f0b
7e9d9f8aacc325dc3d2abfa0252b9049cd3399c7f81cbf32f776c4644d0ec698
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/animation.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:33 GMT
etag: "14f25-5d2c3afd4f388-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6679
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-user-sidebar.js?ver=5.1.2
8.38.122.197200 OK 898 B URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-user-sidebar.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 233c154fec1bd47cb2d7c5c9c5f70941
40260ff178c49cf3ecffe7b8484d07e52308cead
f0fcb6a32306c5ff4a50df8e19e176be412c7ec0b9306c8083347a52c98ca1bd
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/app-user-sidebar.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "382-5d2c3afdec760"
accept-ranges: bytes
content-length: 898
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
rdcdn.com/eow
52.7.240.180302 Found 151 B IP 52.7.240.180:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 82133787c1fcce4fd893463e0b0b3ecb
f4af96850470b845614985cb3a56d9e16ad14e9c
ba90dc61e3a7b2caff87da8bf66ff677120d58b1f76e79f40dcfaac4cf58a555
GET /eow HTTP/1.1
Host: rdcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Cookie: aid=18662; ref=https://www.cardealsnearyou.com/; img=http://rdcdn.com/rt?aid=18662&e=1&img=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: text/html; charset=utf-8
content-length: 151
location: https://rdcdn.com/images/blank.gif
cache-control: private
server: Microsoft-IIS/10.0
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
X-Firefox-Spdy: h2
developers.google.com/maps/documentation/javascript/examples/markerclusterer/markerclusterer.js?ver=5.1.2
142.250.74.174200 OK 8.9 kB URL HTTP/2 developers.google.com/maps/documentation/javascript/examples/markerclusterer/markerclusterer.js?ver=5.1.2
IP 142.250.74.174:0
File type HTML document, ASCII text
Hash 4006fd0e4f448db64df98fa9432dd4dd
922d5e7280dbdbbfd0590787673bacd3056fa854
5e0998066136dbf281d390f94e4cff15fdc5e459d29e2a0741740e7aa6afd806
GET /maps/documentation/javascript/examples/markerclusterer/markerclusterer.js?ver=5.1.2 HTTP/1.1
Host: developers.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
last-modified: Mon, 16 Jan 2017 03:43:59 GMT
set-cookie: _ga_devsite=GA1.3.3339737515.1670539609; Expires=Sat, 07 Dec 2024 22:46:49 GMT; Max-Age=63072000; Path=/
content-security-policy: base-uri 'self'; object-src 'none'; script-src 'strict-dynamic' 'unsafe-inline' https: http: 'nonce-hwV26b+NRvDMo75yVTN2+RLWUpyYQw' 'unsafe-eval'; report-uri https://csp.withgoogle.com/csp/devsite/v2
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
cache-control: no-cache, must-revalidate
expires: 0
pragma: no-cache
content-encoding: gzip
x-cloud-trace-context: 0f3596e1ac26bf4d777519f53aae4012
vary: Accept-Encoding
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Google Frontend
content-length: 8937
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
rdcdn.com/images/blank.gif
52.7.240.180200 OK 42 B URL HTTP/2 rdcdn.com/images/blank.gif
IP 52.7.240.180:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash accba0b69f352b4c9440f05891b015c5
9d01cc5dc8e042c0d4ad6cfb8b3ac38e84a5ef9f
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
GET /images/blank.gif HTTP/1.1
Host: rdcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Cookie: aid=18662; ref=https://www.cardealsnearyou.com/; img=http://rdcdn.com/rt?aid=18662&e=1&img=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: image/gif
content-length: 42
last-modified: Thu, 23 Dec 2021 21:40:22 GMT
accept-ranges: bytes
etag: "0e70b045f8d71:0"
server: Microsoft-IIS/10.0
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash a0905812e8498e6c5c0a9b4b584b972f
039b784fd1e0152ec7f49a54ba027f0b2bd1e833
ee3531ef0f334dcd73a86b1e4365a020d5db69ff7b82bad136eaf1a8e9d3b47f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:49 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.7.0
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.7.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (56243)
Hash 56ff26e4540fe0eb470200be12da9539
e55c1cf13307417eb0721280047dfe0a7e870752
41bd8b382a880ae6ec59d84506d7b5ba03c23eb9dd5b4044eb8f50e182fb39f4
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.7.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: "dc69-5d9e136b05096-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12251
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.5.11
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.5.11
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (12602)
Hash ec14123fd07ef488fc1aff60a6f99c13
55e9b5c3cad505a780d948349d9009867368cf6a
46e3efd2835c5f189acbe5c392d41ce6b86f2cfe3f064cdd6780032777f5706a
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.5.11 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:10 GMT
etag: "e197-5d9e13570059b-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12303
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
8.38.122.197200 OK 90 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (65447)
Hash 02dd5d04add4759122013c5ab4dc5cc2
a45a56e396ac549b4ff39b696ce9e0c16a7612de
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 17:31:52 GMT
etag: "15db1-5cc344e9c4b4e"
accept-ranges: bytes
content-length: 89521
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/bootstrap.min.css?ver=5.1.2
8.38.122.197200 OK 19 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/bootstrap.min.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (65371)
Hash a69801e0e683a8efdc50685e08da6a5c
6f9e7217c522f9e426b01836de5ca4b489da9cc8
af869524400958bf10cefcd1a2790715f9f569117fabe6c69e24e5ca65e45321
GET /wp-content/themes/motors/assets/css/bootstrap.min.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "1ca38-5d2c3afd55d03-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 19250
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/dist/headers/header-car_dealer.css?ver=5.1.2
8.38.122.197200 OK 11 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/dist/headers/header-car_dealer.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash d23d8ee10642ccb21ae0153d554fda59
6de0a2d9861421f92ed4f77633c47ebbb9736022
c70f9c79a5d06d76a364ba8fa18218ef77aa585888ca2a418d61753edfec6e30
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/dist/headers/header-car_dealer.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "271fc-5d2c3afd691a1-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 10852
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm-megamenu/assets/js/megamenu.js?ver=2.3.1
8.38.122.197200 OK 3.5 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm-megamenu/assets/js/megamenu.js?ver=2.3.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 1d26ded5f43ab4a713a025725d980d93
f6372bb22d53b2986160a3ff764f6ef2e615130c
69e9d8eeb0cc13a23f786c0dafd6909001e394d69d397083473ccd6ee2f0b234
GET /wp-content/plugins/stm-megamenu/assets/js/megamenu.js?ver=2.3.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:17:22 GMT
etag: "ddc-5d9e139b93406"
accept-ranges: bytes
content-length: 3548
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.1
8.38.122.197200 OK 3.4 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (3233)
Hash 5c38aa6d5b98586ca2ba973ab8b4b6b1
8215983363ea0d74f99368336404b0d27217778f
7c4dcab706e6bf67c64df89d3f5e137cb19efa293771613f511aff1ad563a6df
Analyzer Verdict Alert fortinet Phishing
GET /wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "d53-5e0322dd55ac3"
accept-ranges: bytes
content-length: 3411
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/jquery.cookie.js
8.38.122.197200 OK 3.1 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/jquery.cookie.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 0f1f6cd6e0036897019b376d38593403
498b29de6e170fffc8535183b7d6550490f0a159
8c0301b3dba5061632d7321cd8bb7bd527f48288d5cb15ff614ea0c1dcc1ad69
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm_vehicles_listing/assets/js/frontend/jquery.cookie.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "c44-5d9e13084daf8"
accept-ranges: bytes
content-length: 3140
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/12/0-APR-Guide-What-You-Need-To-Know-Before-Financing-350x181.jpg
8.38.122.197200 OK 7.5 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/12/0-APR-Guide-What-You-Need-To-Know-Before-Financing-350x181.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, progressive, precision 8, 350x181, components 3\012- data
Hash a67452cd96a0b162ac0c5d08b7b9e604
8432b34cab30d2e75e33b5ce0e2bd87a0e8d8d9c
2d13907be02b711dba70eca9cf60821584e7a571b6228c8f258b6a578af19948
GET /wp-content/uploads/2022/12/0-APR-Guide-What-You-Need-To-Know-Before-Financing-350x181.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Wed, 07 Dec 2022 17:20:21 GMT
etag: "1d4e-5ef40229a4649"
accept-ranges: bytes
content-length: 7502
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2021/12/cu-1-350x205.jpg
8.38.122.197200 OK 9.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2021/12/cu-1-350x205.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 350x205, components 3\012- data
Hash 69608054e1e55088716a9f5c97b25aa9
01355c2d0f11001e993866564c39313be6201df7
27263256df09c1beea5c70b6f8c35a3935c60a98cfa4db4685c4c4357a9c85ec
GET /wp-content/uploads/2021/12/cu-1-350x205.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Wed, 05 Jan 2022 15:16:25 GMT
etag: "2462-5d4d73cb8db7e"
accept-ranges: bytes
content-length: 9314
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2017/09/2018-toyota-camry-350x205.jpg
8.38.122.197200 OK 9.4 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2017/09/2018-toyota-camry-350x205.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 350x205, components 3\012- data
Hash 819068307a587d984f28e60907bdfd1c
6e46fea8bc6c0b264e0100c94820443f729aeac3
a52a9b7ae1715e83974c953535f27607c6cf7b36cb5825ccdf34b0af847326ae
GET /wp-content/uploads/2017/09/2018-toyota-camry-350x205.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Wed, 17 Nov 2021 23:18:02 GMT
etag: "24c7-5d10440e0d7b5"
accept-ranges: bytes
content-length: 9415
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/01/img-1-960x-350x205.jpg
8.38.122.197200 OK 11 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/01/img-1-960x-350x205.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 350x205, components 3\012- data
Hash 66cc6b8b127fc5d9149fd34ec77c20ed
e1dad3dceaac31074655d2e7120e0c7741ea354d
1ce5e67c9fb60b2215f6ef8151ddc43e3ffe1587aec9e53e4e2de3d8b65780ce
GET /wp-content/uploads/2022/01/img-1-960x-350x205.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 06 Jan 2022 15:24:16 GMT
etag: "2c46-5d4eb76a0b233"
accept-ranges: bytes
content-length: 11334
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2015/12/6-350x205.jpg
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2015/12/6-350x205.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 350x205, components 3\012- data
Hash 6687e81017d51a5ae62ac9d4a8e272d2
fd38828d026ea40e7e0f40835767af9d7a292593
ac63a05279b1d4d0ed62cd73480673108d526a72ff593d0f3ac6a00d072be9d0
GET /wp-content/uploads/2015/12/6-350x205.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 18:57:33 GMT
etag: "2f88-5cc3581046509"
accept-ranges: bytes
content-length: 12168
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/filter.js
8.38.122.197200 OK 3.9 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/filter.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 4b48425e53ee05842fa3dba2952cca8c
d69bbb7e79c27e0b6c1dd13881c1dbc7c40ba7a3
2ed882d62d05459ec26f592856c0b845c01576d77982041311bca039901102a4
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm_vehicles_listing/assets/js/frontend/filter.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "f0f-5d9e13084cf3f"
accept-ranges: bytes
content-length: 3855
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2021/09/logo.png
8.38.122.197200 OK 32 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2021/09/logo.png
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type PNG image data, 1738 x 286, 8-bit/color RGBA, non-interlaced\012- data
Hash 4deff5845cbb90754c8ffabf3dfd81cd
1f618ced7ef5cf2a02af294275249388f6c2a835
5ab4cc19429e66d11688ffb55af4f733c289799eaaae054b14893ccfd13fa341
GET /wp-content/uploads/2021/09/logo.png HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 18:13:07 GMT
etag: "7df1-5cc34e21889ef"
accept-ranges: bytes
content-length: 32241
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2015/12/cndy1_300x250_FINANCING.png
8.38.122.197200 OK 66 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2015/12/cndy1_300x250_FINANCING.png
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type PNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced\012- data
Hash 0b841c6ad2aa84d74ed2b064ba608e44
8cbaf0736f2be0204f37d861fad78c6ac337b763
f1c83dd7711344434da0d72a536bbf998fb6033a93efe7a8c405aa31f4e28e76
GET /wp-content/uploads/2015/12/cndy1_300x250_FINANCING.png HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 17 May 2022 12:54:28 GMT
etag: "10337-5df34a41da471"
accept-ranges: bytes
content-length: 66359
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/stm-google-places.js?ver=5.1.2
8.38.122.197200 OK 4.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/stm-google-places.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Algol 68 source text\012- Pascal source, ASCII text
Hash f130c0956c2e19ed130561577a694499
1ef8515331c4861d7c8ccbcc79382802dc003c83
930cfdcae2f9f6e399d2cf40fe97c1ce86f97cf7f6c6994573d61f4b39ce3565
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/stm-google-places.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "12c6-5d2c3afe18a78"
accept-ranges: bytes
content-length: 4806
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/fonts/revicons/revicons.woff?5510888
8.38.122.197200 OK 7.5 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/fonts/revicons/revicons.woff?5510888
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Web Open Font Format, TrueType, length 7536, version 1.0\012- data
Hash 04eb8fc57f27498e5ae37523e3bfb2c7
d942ae11706c3f7e511e3c49b0e4574d7ad199c4
f7b9c3065e55fa3b9e320093612e7b30dcb14355a44ec461247b495a3e729686
GET /wp-content/plugins/revslider/public/assets/fonts/revicons/revicons.woff?5510888 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:11 GMT
etag: "1d70-5d9e1357174d3"
accept-ranges: bytes
content-length: 7536
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/font-woff
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/lazyload.js?ver=5.1.2
8.38.122.197200 OK 5.7 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/lazyload.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 2e546bbdcb575cc8ccfd49e09f8a0d1e
de02ee8c061a9e7b019af42d6894e9a6161c044b
56a580939c1b8c0a26c5fab297b2efc96e7dfe1e66b22b70adc9ef440b4d2b03
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/lazyload.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "162f-5d2c3afdf407b"
accept-ranges: bytes
content-length: 5679
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.countdown.min.js?ver=5.1.2
8.38.122.197200 OK 5.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.countdown.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (4136)
Hash 5d3ff3c3fbaa67cc639501f44eeb07be
bd66e4cd58de09c198e7abc77fa4c883955d189e
2249399b2268c260d0698542503d16afebc80e437c846239f12196744ebbd40f
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/jquery.countdown.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "14db-5d2c3afdf196a"
accept-ranges: bytes
content-length: 5339
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/form-autocomplete-nish-premium/js/app.js?ver=2.0.1
8.38.122.197200 OK 7.3 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/form-autocomplete-nish-premium/js/app.js?ver=2.0.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 7c898d32907792a4ca6d509d0c2b52af
b54cb8a2682a24d180f0528ef06d998f88fc3a59
05322da8b0c192999052935f12b463d6e5a84b224f6fae2937abeb2b27b6bebe
GET /wp-content/plugins/form-autocomplete-nish-premium/js/app.js?ver=2.0.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 19 Apr 2022 14:32:02 GMT
etag: "1c56-5dd02bd7ece60"
accept-ranges: bytes
content-length: 7254
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/droppable.min.js?ver=1.13.1
8.38.122.197200 OK 6.7 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/droppable.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (6469)
Hash 986cbf4f93616febf4243f6e3e76e3e9
7de9dd72732ca8fe46c0242749d4a705345fe0b7
c3a015f250093ba41c36da57625051930eada74b0bb8d61b7e0c6fef36952317
GET /wp-includes/js/jquery/ui/droppable.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "19fb-5e0322dd52fca"
accept-ranges: bytes
content-length: 6651
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.7.0
8.38.122.197200 OK 46 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.7.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (65358)
Hash bfddc4ff4e82f2dd9a33b2b0bf3bb878
5cb05aacf9e97c6c58e02fabd69fcae22118c200
be6316c3e4d24d0b139c1afabe5be1fd0e84e62a0e72d9f507eb32407897d4b2
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.7.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: "76878-5d9e136a58a8c-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 45810
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.uniform.min.js?ver=5.1.2
8.38.122.197200 OK 8.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/jquery.uniform.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (8555), with no line terminators
Hash 602e6f2ddacb95ef0f3061fd2a671f87
91cbe28c3c5cf6187680f4529f0c40e4cf6098ff
8db04d82f75d8073b25dc594a13c2dafdfb762f8d66ed1dd32f95c3420868a6a
GET /wp-content/themes/motors/assets/js/jquery.uniform.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "216b-5d2c3afdf3c93"
accept-ranges: bytes
content-length: 8555
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.1
8.38.122.197200 OK 8.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type C source, ASCII text, with very long lines (8750), with no line terminators
Hash 5f7dca83f1cac6295b0d4c72e325ac20
e0aacf1cfd0d8ed4bc37c8ef2be23d46513b71ed
af735813266cdf52a38a6e1583a86066db357469ceded2d7ea8335b298d73d65
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:49:49 GMT
etag: "222e-5e9dce2b5f503"
accept-ranges: bytes
content-length: 8750
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.4
8.38.122.197200 OK 9.9 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.4
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (9937), with no line terminators
Hash dc74c9954b1944928eca0172c3b8c6b3
e9e00e587e0e28491b69563b4e768945ff2e0ed5
d7eff2d3185c4035edbe18b653f9da26c2d872e03c92419542ed524d569fe81b
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.4 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 25 Oct 2022 16:45:04 GMT
etag: "26d1-5ebdea14ce207"
accept-ranges: bytes
content-length: 9937
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-header-scroll.js?ver=5.1.2
8.38.122.197200 OK 9.9 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-header-scroll.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 3e79399963f950548b8528e8f2ce8354
48f2c8bf5bf3ab66c930bbf4aaebc4d44b549e40
7ccc91bc49d744f8f5131ab1a1080c4fb4afad71648f71901344f76e013faae7
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/app-header-scroll.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "269f-5d2c3afdeb3d8"
accept-ranges: bytes
content-length: 9887
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/init.js
8.38.122.197200 OK 11 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/init.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with CRLF line terminators
Hash ef27876965ca7a901f5d659cfef2508e
00ef39e8450b72bdac334c9d6d360f97dbc54c5c
b52fb9c7daf25d03006566b0ed7941011b21a1b42041cabce73c681e8163e4dd
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm_vehicles_listing/assets/js/frontend/init.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "2afc-5d9e13084d710"
accept-ranges: bytes
content-length: 11004
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/sell-a-car.js?ver=5.1.2
8.38.122.197200 OK 10 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/sell-a-car.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 940cfb0a414f7d25580db8ae1d593cce
9fc3d2e8fe80298b7698e91d50eb9a8353845e5e
3a1828577697300c7856c303a82e07c62a4ce6886f8783e0494b6f11638a9772
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/sell-a-car.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "28a7-5d2c3afe182a8"
accept-ranges: bytes
content-length: 10407
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.13.1
8.38.122.197200 OK 11 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (10572)
Hash 0ee357a183287d64fcf277f66d532e6d
b45721bde387037ac73347020edb890ac4a77814
7ce6eb9cd7f07b424c34ee977214503668ae5e137d07b3fe0a37373e57686ebf
GET /wp-includes/js/jquery/ui/slider.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "29ff-5e0322dd57234"
accept-ranges: bytes
content-length: 10751
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type HTML document, ASCII text, with very long lines (12310), with no line terminators
Hash 1f9968a7c7a2a02491393fb9d4103dae
0032c8a6a692e6f072b2cef20828449402fdd57d
f1d5583d4c00ebe19c7be536e72ab8234c1f926023cb5a1fd5edbe9c912f0f49
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 25 Oct 2022 16:45:04 GMT
etag: "3016-5ebdea14c45c3"
accept-ranges: bytes
content-length: 12310
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/filter.js?ver=5.1.2
8.38.122.197200 OK 12 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/filter.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 66c22cb02b7d85cf5b8dad3bbddfa373
cf41bdb5596cda0a6492be756a1256a76a0269ab
92aad1c4ed170ca3235640b5acdebbd3a5433bf4b4441f4e24b88e19bc183bbc
GET /wp-content/themes/motors/assets/js/filter.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "30bf-5d2c3afdef641"
accept-ranges: bytes
content-length: 12479
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/skrollr/dist/skrollr.min.js?ver=6.7.0
8.38.122.197200 OK 13 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/skrollr/dist/skrollr.min.js?ver=6.7.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (12478)
Hash 0bf128a0c049a8e5386d7c709e8f2d5d
dca62041e11fcbb5aeb958612916f3453efbcf5c
2d42b8a78389235460930cf4f496b8411d46a3344229e4309480803bb39d1575
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/lib/bower/skrollr/dist/skrollr.min.js?ver=6.7.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:32 GMT
etag: "3222-5d9e136b26f99"
accept-ranges: bytes
content-length: 12834
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 65174afaf70b91b7c2168a147af7e1f5
1411ff2237ac2a062bd290eb781aff29462813a8
a1a69f0c72380e81af95a7c3ad3a3503a5fcc46f0150af9866b064e0ff9aa32f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1A69F0C72380E81AF95A7C3AD3A3503A5FCC46F0150AF9866B064E0FF9AA32F"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4915
Expires: Fri, 09 Dec 2022 00:08:45 GMT
Date: Thu, 08 Dec 2022 22:46:50 GMT
Connection: keep-alive
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/lg-video.js?ver=5.1.2
8.38.122.197200 OK 14 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/lg-video.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 5f7d592389a8dbbf34620dd38d2d2c57
46405fe79ab85a930797c814d6cd8879a7553041
53aad6aea6b1938f9b296a38293fb4b862a066e0102020b6772e5a8c72060044
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/lg-video.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "351d-5d2c3afdf4463"
accept-ranges: bytes
content-length: 13597
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/smoothScroll.js?ver=5.1.2
8.38.122.197200 OK 23 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/smoothScroll.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 28caad470346a31bde5404ea7c6be837
927590e21de028a332a5fa2f036c6d063860ed3c
11a137a3aa4740aa67ff3f25ec5034c22c5d4532b7112e3f116170039371016b
GET /wp-content/themes/motors/assets/js/smoothScroll.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "5b47-5d2c3afe18690"
accept-ranges: bytes
content-length: 23367
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 795e67bdfadc3c890a663080413b56b7
fdefde3befb6aceac3c337c34c8d738f5091908c
8375b55cfc13989b0cf96293b7bead2ce5811a993b3445da1776ca7015c36985
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/load-image.all.min.js?ver=5.1.2
8.38.122.197200 OK 26 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/load-image.all.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (26142), with no line terminators
Hash cb3dbe292b68411b99ee97e96b466401
485596ed25391964a16e53bab5f0bc0cd9519ab9
24f0a6a74ca6edba6bb4ff364aae0fa92eac5835b529a2e05faf8666f5cd635d
GET /wp-content/themes/motors/assets/js/load-image.all.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "6623-5d2c3afdf5404"
accept-ranges: bytes
content-length: 26147
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=6.7.0
8.38.122.197200 OK 20 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=6.7.0
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (19905)
Hash 596d6e5d8400fd1e913f9adc21071f93
fee2d7a4ac08d5a522c2298a5ad3ed30ac9e62ec
159faf7827be43b4c85a35fc941924a9de59a169d42d600b49161f60debf9dff
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=6.7.0 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: "4e9c-5d9e136a90157"
accept-ranges: bytes
content-length: 20124
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/wp-emoji-release.min.js?ver=e36eae1c9f3075d8b2de55c94dc7e512
8.38.122.197200 OK 19 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/wp-emoji-release.min.js?ver=e36eae1c9f3075d8b2de55c94dc7e512
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (15660)
Hash 32beb68a374e3aeac00abdf9e12b84ea
b5d18aa625e8696dd9d07cd0869337717b211ae0
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
GET /wp-includes/js/wp-emoji-release.min.js?ver=e36eae1c9f3075d8b2de55c94dc7e512 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "48b9-5e0322dd7569e"
accept-ranges: bytes
content-length: 18617
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
c.fqtag.com/tag/implement-r.js?org=9Xf4JS6qIDnMDOaZ0z86&fmt=banner&rt=click&sl=1&fq=1&p=709&a=true&cmp=cdny
35.190.72.161200 OK 2.7 kB URL HTTP/2 c.fqtag.com/tag/implement-r.js?org=9Xf4JS6qIDnMDOaZ0z86&fmt=banner&rt=click&sl=1&fq=1&p=709&a=true&cmp=cdny
IP 35.190.72.161:0
File type ASCII text, with very long lines (2656), with no line terminators
Hash 1f0e1fe30178dd65bb31836434991ac6
2c458f495228f58b0cbe7021528445008e94860e
fce3482008eeece9a7a917256b7736463d4c2c8aaf2b633216a3a9121688b1d2
GET /tag/implement-r.js?org=9Xf4JS6qIDnMDOaZ0z86&fmt=banner&rt=click&sl=1&fq=1&p=709&a=true&cmp=cdny HTTP/1.1
Host: c.fqtag.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: 0
cache-control: no-cache, no-store, must-revalidate
x-xss-protection: 0
pragma: no-cache
date: Thu, 08 Dec 2022 22:46:50 GMT
access-control-allow-origin: *
content-type: application/javascript
content-length: 2656
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
rtxpx-a.akamaihd.net/main.js
23.36.76.114200 OK 31 kB URL HTTP/1.1 rtxpx-a.akamaihd.net/main.js
IP 23.36.76.114:0
ASN #20940 Akamai International B.V.
File type Unicode text, UTF-8 text, with very long lines (50918), with NEL line terminators
Hash abe669990a8ec7d16c36e0c32e80abf9
b46a4bd88e20175b4e660e9e52b8eaef9c59373a
7b3b6a221e62ae6765c49111c8697db2c40cce8651cc8f6d6feb2e58a1dde95f
GET /main.js HTTP/1.1
Host: rtxpx-a.akamaihd.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
x-amz-id-2: TAyOzEssvwNa8Am544iCz+NPIUwkgHSMu1TJHwcbKWQUosr9T6tD1fEX9XrX6lqnY5FnpTYUmoc=
x-amz-request-id: C831BE0276127BEE
Last-Modified: Thu, 28 Jan 2021 21:02:34 GMT
ETag: "0e00eda4d7973d0a511ce8aae95bef1c"
Accept-Ranges: bytes
Content-Type: application/javascript
Server: AmazonS3
Unused62: 8096267
Vary: Accept-Encoding
Content-Encoding: gzip
Expires: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 08 Dec 2022 22:46:50 GMT
Content-Length: 30922
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
www.cardealsnearyou.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.13.1
8.38.122.197200 OK 17 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (15439)
Hash aa5fef7b171510a2a430328d4a0f3b03
cf6377f9bd83d9ce5f18c3de8ac7e57c047168d4
5f030eda75a32de3b4f63e28a38e83642b8a723c84ae73bf3726b85cd411bfee
GET /wp-includes/js/jquery/ui/effect.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "43b3-5e0322dd552f3"
accept-ranges: bytes
content-length: 17331
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
8.38.122.197200 OK 21 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (8189)
Hash 6aaf0a4e8eac131defea126f5b1b5fbf
24da0326af36303e5a1e9799a3c26f7a1077928c
240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5
Analyzer Verdict Alert fortinet Phishing
GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "50eb-5e0322dd51c42"
accept-ranges: bytes
content-length: 20715
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-includes/js/jquery/ui/draggable.min.js?ver=1.13.1
8.38.122.197200 OK 18 kB URL HTTP/2 www.cardealsnearyou.com/wp-includes/js/jquery/ui/draggable.min.js?ver=1.13.1
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (18145)
Hash e5928fe54e2689822e39407a9ce71391
8c205903aedfae7f51df37d2387e14542544e4aa
8b934f3213c33c849410d6edf4fa6f85f970839503d462d94413bd8c15a2e106
GET /wp-includes/js/jquery/ui/draggable.min.js?ver=1.13.1 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 30 May 2022 03:23:25 GMT
etag: "4797-5e0322dd52be2"
accept-ranges: bytes
content-length: 18327
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0e9eef4ed41ef94e9ea175ad243e294e
b6f83e508270413dabe55e2884b5409ca7978e24
0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0e9eef4ed41ef94e9ea175ad243e294e
b6f83e508270413dabe55e2884b5409ca7978e24
0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
216.58.207.227200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 216.58.207.227:0
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 07 Dec 2022 19:33:54 GMT
expires: Thu, 07 Dec 2023 19:33:54 GMT
cache-control: public, max-age=31536000
age: 97976
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 8f6ab0debac98d11413e20fa98ba8286
e63543ba0f3a685edf4d8fee3f587efd5417015f
fe6bc081b1963c61a3af1ab7b7b1213ae5bc7b962c5474d8f6fe123547d5d309
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 65174afaf70b91b7c2168a147af7e1f5
1411ff2237ac2a062bd290eb781aff29462813a8
a1a69f0c72380e81af95a7c3ad3a3503a5fcc46f0150af9866b064e0ff9aa32f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1A69F0C72380E81AF95A7C3AD3A3503A5FCC46F0150AF9866B064E0FF9AA32F"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4915
Expires: Fri, 09 Dec 2022 00:08:45 GMT
Date: Thu, 08 Dec 2022 22:46:50 GMT
Connection: keep-alive
fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
216.58.207.227200 OK 31 kB URL HTTP/2 fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP 216.58.207.227:0
File type Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Hash ac0d2859ea5f8fd6bcb3c305c08ec184
7f6c17e3e592cd8bd346b9cc261d8dd961b8aef7
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
GET /s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 30928
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 02 Dec 2022 06:30:11 GMT
expires: Sat, 02 Dec 2023 06:30:11 GMT
cache-control: public, max-age=31536000
age: 576999
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
216.58.207.227200 OK 45 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP 216.58.207.227:0
File type Web Open Font Format (Version 2), TrueType, length 44856, version 1.0\012- data
Hash 565ce506190ad3af920b40baf1794cec
ad3cba5d06100e09449a864d3b5e58403b478b3d
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
GET /s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 44856
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 05 Dec 2022 18:52:41 GMT
expires: Tue, 05 Dec 2023 18:52:41 GMT
cache-control: public, max-age=31536000
age: 273249
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.googletagmanager.com/gtm.js?id=GTM-N68RHD7
142.250.74.168200 OK 90 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-N68RHD7
IP 142.250.74.168:0
File type ASCII text, with very long lines (41285)
Hash 045ae139573c375524b3993c3f56e411
fd247fb3047bbc6cff615f5bcaf436327ef553ad
212d958b85fa6864047eebac9eb4398d2de963721b17ffe1236bba3668b3fb03
GET /gtm.js?id=GTM-N68RHD7 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 08 Dec 2022 22:46:50 GMT
expires: Thu, 08 Dec 2022 22:46:50 GMT
cache-control: private, max-age=900
last-modified: Thu, 08 Dec 2022 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 90132
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 8f6ab0debac98d11413e20fa98ba8286
e63543ba0f3a685edf4d8fee3f587efd5417015f
fe6bc081b1963c61a3af1ab7b7b1213ae5bc7b962c5474d8f6fe123547d5d309
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/bootstrap.min.js?ver=5.1.2
8.38.122.197200 OK 36 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/bootstrap.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (32087)
Hash 2616d3564578d8f845813483352802a9
5ada7c103fc1deabc925cc1fdbbb6e451c21fc70
f971b901aeb9e55b07d472afee09bd5ae05159e1119dbd16d993e473565e7fc0
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/bootstrap.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "8b11-5d2c3afded319"
accept-ranges: bytes
content-length: 35601
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/dynamic-content-for-elementor/assets/lib/isotope/isotope.pkgd.min.js?ver=2.7.10
8.38.122.197200 OK 35 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/dynamic-content-for-elementor/assets/lib/isotope/isotope.pkgd.min.js?ver=2.7.10
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (32019)
Hash 2afcff647ed260006faa71c8e779e8d4
c4e5994f24ee8c8d2cf2d6602f0b56b9096a2e98
081ae9baaacc857c1c2cb51de6dbd0e1eb811c2761ef01a50df373f2f6eefe22
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/dynamic-content-for-elementor/assets/lib/isotope/isotope.pkgd.min.js?ver=2.7.10 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 30 Sep 2022 03:50:04 GMT
etag: "8a75-5e9dce399d5d6"
accept-ranges: bytes
content-length: 35445
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
cdn.fqtag.com/1.27.339-ccfb11a/pixel.js
35.190.36.172200 OK 90 kB URL HTTP/2 cdn.fqtag.com/1.27.339-ccfb11a/pixel.js
IP 35.190.36.172:0
File type ASCII text, with very long lines (31986)
Hash e0eff30579598f76147c9ea12f490d21
f0bf2ef576db440b275bdae3d6abac35e59a33b2
e70a34c5f232fa80328a361630a994cf847c54deb926f13d40be4807291b657b
GET /1.27.339-ccfb11a/pixel.js HTTP/1.1
Host: cdn.fqtag.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-guploader-uploadid: ADPycdsN4QEaQBL5GY4AdrhShKQjwoIPSOOfGXdAwuXUdpf8KjQhW836wUbaJ6ei4Q_WCrEvC2LIJ4pD7MUyINsPPU6QZg
x-goog-generation: 1611776924905378
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 89647
content-language: en
x-goog-hash: crc32c=YwE4YA==, md5=4O/zBXlZj3YUfJ6hL0kNIQ==
x-goog-expiration: Sun, 11 Nov 2294 19:48:44 GMT
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
content-length: 89647
server: UploadServer
date: Thu, 08 Dec 2022 22:29:06 GMT
expires: Thu, 08 Dec 2022 23:29:06 GMT
cache-control: public, max-age=3600
age: 1064
last-modified: Wed, 27 Jan 2021 19:48:44 GMT
etag: "e0eff30579598f76147c9ea12f490d21"
content-type: application/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
stickyid-a.akamaihd.net/id?o=https%3A%2F%2Fwww.cardealsnearyou.com
23.36.76.176302 Moved Temporarily 154 B URL HTTP/1.1 stickyid-a.akamaihd.net/id?o=https%3A%2F%2Fwww.cardealsnearyou.com
IP 23.36.76.176:0
ASN #20940 Akamai International B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 52558d05355ee6e9d14ff3cf8a5a3ef0
52cfd7dd3859dc0578849a7b1c91bb8f91ad84c2
bac5546ea0f819f461c9023592ec2398a45a6c3aab78e55fed8b7c908dce6060
GET /id?o=https%3A%2F%2Fwww.cardealsnearyou.com HTTP/1.1
Host: stickyid-a.akamaihd.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Moved Temporarily
Server: Apache
Content-Length: 154
Content-Type: text/html
Location: /id?cc=1&o=https%3A%2F%2Fwww.cardealsnearyou.com
Set-Cookie: b53eedc13__=c980d49b94c156932875fa21f133f4c4074d22e3f.1670539610; expires=Fri, 08 Dec 2023 22:46:50 GMT; domain=.akamaihd.net; path=/; HttpOnly; SameSite=None; Secure
ETag: "d2715d34e10e5a9f3692d96bd0fbb282:1592835897"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.cardealsnearyou.com
P3P: CP="We do not have a P3P policy."
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Unused62: 8096267
Expires: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: max-age=0, no-cache, no-store, private
Pragma: no-cache
Date: Thu, 08 Dec 2022 22:46:50 GMT
Connection: keep-alive
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app.js?ver=5.1.2
8.38.122.197200 OK 50 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (1677)
Hash d9f0e8b77f8c0359825b0d31a012af19
4f1488ce8c5d3d5cfe672d03379d34f3278412cf
9c12230d2e212e052effc78814f0548efa5b2838d22b2babcc407c93c489729d
GET /wp-content/themes/motors/assets/js/app.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "c3b9-5d2c3afdecb48"
accept-ranges: bytes
content-length: 50105
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/select2.full.min.js?ver=5.1.2
8.38.122.197200 OK 79 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/select2.full.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (64131)
Hash fcd7500d8e13d2b2aae5d3956dc3e21d
aa40e683c82dd844db73fde37048cf7fc145135e
5c6fdab80cb86a279695dccc226a1fac50e2c922bea70242edaa28f52b7bad2d
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/select2.full.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "1356c-5d2c3afe17ec0"
accept-ranges: bytes
content-length: 79212
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
stickyid-a.akamaihd.net/id?cc=1&o=https%3A%2F%2Fwww.cardealsnearyou.com
23.36.76.176200 OK 90 B URL HTTP/1.1 stickyid-a.akamaihd.net/id?cc=1&o=https%3A%2F%2Fwww.cardealsnearyou.com
IP 23.36.76.176:0
ASN #20940 Akamai International B.V.
File type JSON data\012- , ASCII text, with no line terminators
Hash e53165fad87badb833972121d6bc9ee5
a3d43cd0388920df86603d7d6946456aac0142ae
c315c59b836493ed24f1ffa23d90507f71e66291fff1d23f33187ae97003f0fe
GET /id?cc=1&o=https%3A%2F%2Fwww.cardealsnearyou.com HTTP/1.1
Host: stickyid-a.akamaihd.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.cardealsnearyou.com
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Cookie: b53eedc13__=c980d49b94c156932875fa21f133f4c4074d22e3f.1670539610
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: Apache
Content-Length: 90
Content-Type: application/json
Set-Cookie: b53eedc13__=c980d49b94c156932875fa21f133f4c4074d22e3f.1670539610; expires=Fri, 08 Dec 2023 22:46:50 GMT; domain=.akamaihd.net; path=/; HttpOnly; SameSite=None; Secure
ETag: "d2715d34e10e5a9f3692d96bd0fbb282:1592835897"
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.cardealsnearyou.com
P3P: CP="We do not have a P3P policy."
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Unused62: 8096267
Expires: Thu, 08 Dec 2022 22:46:50 GMT
Cache-Control: max-age=0, no-cache, no-store, private
Pragma: no-cache
Date: Thu, 08 Dec 2022 22:46:50 GMT
Connection: keep-alive
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-ajax.js?ver=5.1.2
8.38.122.197200 OK 80 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/app-ajax.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (306)
Hash 80a8bbad5263fd42737869d711456fe9
4dde8bfaefc5895e8ab74ae381caddc8d2b5e761
c23720f61db5d790e244dd55f002003c4a02e3fb130cf2f54c7806e8327e5239
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/app-ajax.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "1379b-5d2c3afdea820"
accept-ranges: bytes
content-length: 79771
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/owl.carousel.js
8.38.122.197200 OK 90 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm_vehicles_listing/assets/js/frontend/owl.carousel.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (360)
Hash ccdf893e7d8b26933af0c336bcc3943e
ac575ba3377f95ef22bad865ec35b0b3dcb0dfe0
db9d6cf3c1c4b047c62f646e7d9991c06a212931c362bf53f9a2406b30f09466
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm_vehicles_listing/assets/js/frontend/owl.carousel.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:14:48 GMT
etag: "15f88-5d9e13084ee80"
accept-ranges: bytes
content-length: 89992
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/typeahead.jquery.min.js?ver=5.1.2
8.38.122.197200 OK 97 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/typeahead.jquery.min.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 225d23210d08c40de16183769eedacd7
a7a647b3279ace05c5a7b94ca33c2ffed84db28e
313d5e4676cc2cce8935b127b275d25bc17c2383885ee78b6aadab1c2fd14162
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/typeahead.jquery.min.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "1795d-5d2c3afe1ada1"
accept-ranges: bytes
content-length: 96605
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext&ver=5.1.2
142.250.74.106200 OK 116 kB URL HTTP/2 fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext&ver=5.1.2
IP 142.250.74.106:0
Size 116 kB (116074 bytes)
Hash 0291e723ba339e12d1b0f28685eca193
862ca47a33199013688c0d92644d6b87bc3b314c
0fd302fa6418f085e562a08a8105535cf98c20afbb634f2528025a8e71a6a6b9
GET /css?family=Open+Sans%3A300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext&ver=5.1.2 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 22:46:49 GMT
date: Thu, 08 Dec 2022 22:46:49 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/css/dist/app.css?ver=5.1.2
8.38.122.197200 OK 68 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/css/dist/app.css?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (316)
Hash 71eafe215eba9ebdf31fd35212542acc
9300c3176371d9dfcc4a91a6b62330d6c4561b77
685fe2a8b0ec0adcda36522412f460d32780332efec99a1f213827334f8b41bf
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/css/dist/app.css?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "7af78-5d2c3afd62c0f-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/themes/motors/assets/js/stm_dt_picker.js?ver=5.1.2
8.38.122.197200 OK 144 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/themes/motors/assets/js/stm_dt_picker.js?ver=5.1.2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Unicode text, UTF-8 text, with very long lines (6345)
Size 144 kB (143745 bytes)
Hash b976614f337b821f817f693e5970a410
df3ea44f4e022a258e2087fdace054838e34b64d
10bba1d290e50db78a800758934818ffbb5c8ef03174fd9902fd637cf3e292a3
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/themes/motors/assets/js/stm_dt_picker.js?ver=5.1.2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 10 Dec 2021 05:06:34 GMT
etag: "23181-5d2c3afe19630"
accept-ranges: bytes
content-length: 143745
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
a.clickcertain.com/px/?c=243b667b11e7ebf
172.67.74.207200 OK 2.0 kB URL HTTP/2 a.clickcertain.com/px/?c=243b667b11e7ebf
IP 172.67.74.207:0
File type ASCII text, with very long lines (2807)
Hash cef701c27573f488fd42a5331e7f370c
48777f5813d32b0a97ce6b5d6c3821b620c9b2dd
2e270b052c90c50dc4af54b7f571ced444f3dece6957c4a9fa0294e42748a619
GET /px/?c=243b667b11e7ebf HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: text/javascript
set-cookie: _ccpx_243b667b11e7ebf=1; Expires=Fri, 08 Dec 2023 22:46:49 GMT; Path=/; HttpOnly; SameSite=None; Secure
_ccpx=243b667b11e7ebf; Expires=Fri, 08 Dec 2023 22:46:49 GMT; Path=/; HttpOnly; SameSite=None; Secure
_ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:49 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-2qlzc:cc-nginx-554675d589-2qlzc
x-requestid: 9cc52937-ec95-49de-a209-7d9c54e1011c
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V0bOYq3qoxgPyES3o3ct7k0kyStNkm%2BGKZR2d4bmQRLYDuHBFIrUHrqKoTKzIflIehux4XgEYjjXcp54zViMhydHRgz4t8%2FgXj4gtYZujJD61MkiFhfBAV6vAV03vpt8U5yzhg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a0f9880b503-OSL
content-encoding: br
X-Firefox-Spdy: h2
pixel.tapad.com/idsync/ex/receive?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
35.227.248.159302 Found 0 B URL HTTP/2 pixel.tapad.com/idsync/ex/receive?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
IP 35.227.248.159:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /idsync/ex/receive?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d HTTP/1.1
Host: pixel.tapad.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:51 GMT
strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
set-cookie: TapAd_TS=1670539611147;Expires=Mon, 06 Feb 2023 22:46:51 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
TapAd_DID=d8ed3998-4e30-4547-8159-c3b1c965d08a;Expires=Mon, 06 Feb 2023 22:46:51 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
trc.pushnami.com/api/push/track
34.227.235.208200 OK 2 B URL HTTP/2 trc.pushnami.com/api/push/track
IP 34.227.235.208:0
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
POST /api/push/track HTTP/1.1
Host: trc.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
content-type: application/x-www-form-urlencoded
key: 6307cede82599900146a1edc
Origin: https://www.cardealsnearyou.com
Content-Length: 126
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:51 GMT
content-type: text/html; charset=utf-8
content-length: 2
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 9313b1cd6a26c3d38c99e96068a8ec87
a2217c0f38603726260e99a69d9fa62c7ebb654a
afe7c76b002dcc311da8dff4561000150c45cb5ce49bafac9d1df59131236813
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5390
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:51 GMT
Last-Modified: Thu, 08 Dec 2022 21:17:02 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471
pixel.tapad.com/idsync/ex/receive/check?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
35.227.248.159302 Found 0 B URL HTTP/2 pixel.tapad.com/idsync/ex/receive/check?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
IP 35.227.248.159:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /idsync/ex/receive/check?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d HTTP/1.1
Host: pixel.tapad.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:51 GMT
strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
set-cookie: TapAd_TS=1670539611192;Expires=Mon, 06 Feb 2023 22:46:51 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
TapAd_DID=2051cffa-bc04-4aa2-b37a-b250baf55b5c;Expires=Mon, 06 Feb 2023 22:46:51 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
TapAd_3WAY_SYNCS=;Expires=Mon, 06 Feb 2023 22:46:51 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
location: https://a.clickcertain.com/px/ta/?done=true&ta_id=2051cffa-bc04-4aa2-b37a-b250baf55b5c
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.5.11
8.38.122.197200 OK 383 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.5.11
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with very long lines (64288)
Size 383 kB (382936 bytes)
Hash 71ce48ddf4cac7d8bce4c0f574c4b9ed
f9ef3531d6e74249531971735f6d7ec8a30c7fcd
81ff08960b407fde4ee478cf9e8804ca6daf5491d65932f255e24babed80d14b
GET /wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.5.11 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:11 GMT
etag: "5d7d8-5d9e13571da65"
accept-ranges: bytes
content-length: 382936
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/stm_fonts/stm-icon/stm-icon.ttf?2bstzn
8.38.122.197200 OK 43 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/stm_fonts/stm-icon/stm-icon.ttf?2bstzn
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, stm-icon \012- data
Hash 0d1ad1b584084f4b7a41bbab6e6a5d04
f75a9004162d9f9ab5f72375ddf2e4d359d8d044
7c0089c452862710670e7e9645aebf9ff3649f235bf7bba034c3d0114227327e
GET /wp-content/uploads/stm_fonts/stm-icon/stm-icon.ttf?2bstzn HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/wp-content/uploads/stm_fonts/stm-icon/stm-icon.css?ver=1.0
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Tue, 25 Oct 2022 16:53:57 GMT
etag: "a928-5ebdec10e373a"
accept-ranges: bytes
content-length: 43304
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/font-sfnt
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/02/01.jpeg?id=6230
8.38.122.197200 OK 169 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/02/01.jpeg?id=6230
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x759, components 3\012- data
Size 169 kB (168966 bytes)
Hash 9bbb2b4a61d32c85b36d4a2b9b13f2af
297c996ceeaf68e10dd2e93191039e7169fc14ad
46726421207bd477e351650ad225bf408152d5e6f95c23e3614e74a5c21c3fdf
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/uploads/2022/02/01.jpeg?id=6230 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 03 Feb 2022 22:54:58 GMT
etag: "29406-5d7250604432d"
accept-ranges: bytes
content-length: 168966
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2021/03/02.jpg?id=1747
8.38.122.197404 Not Found 196 B URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2021/03/02.jpg?id=1747
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/uploads/2021/03/02.jpg?id=1747 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
content-length: 196
content-type: text/html; charset=iso-8859-1
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
143.204.42.165200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP 143.204.42.165:0
Hash 390398fe98cd83b1cc865ea23fbc4e3c
d6523eaca7c4c188552a674ea654c85f078a0365
b4de7503b9a9293c52182819b610ecb15bb015ef0a22458a10908af7971a06dc
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=91619
Date: Thu, 08 Dec 2022 22:46:51 GMT
Etag: "63911de4-1d7"
Expires: Sat, 10 Dec 2022 00:13:50 GMT
Last-Modified: Wed, 07 Dec 2022 23:12:36 GMT
Server: ECS (bsa/EB24)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: aDDNI57rMPKXN4tLgWhBMvFzQjbQ_JCgEqo3ULUhpAfaj08-UE19qw==
Age: 3674
ocsp.r2m01.amazontrust.com/
54.230.80.227200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP 54.230.80.227:0
Hash dba85a40e18fed562a01ac8d5f8afe40
5f1ef4bd62c64a511d6d72923951fdcb52d9034f
40ed75518379d0241904d940033cffec6a9f7ddbd5dc36b6472a8992fc87b0d2
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=130860
Date: Thu, 08 Dec 2022 22:46:51 GMT
Etag: "6391b302-1d7"
Expires: Sat, 10 Dec 2022 11:07:51 GMT
Last-Modified: Thu, 08 Dec 2022 09:48:50 GMT
Server: ECS (nyb/1D31)
X-Cache: Miss from cloudfront
Via: 1.1 4c07121ca6e32bcda85cc9091b92050e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: jHBedn9wR0psMgVf-zMSznNFBzKnsNMXuYXZuxBLVTLgjiZF_5OMMw==
Age: 4741
ocsp.sca1b.amazontrust.com/
143.204.42.165200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP 143.204.42.165:0
Hash 198f860574da46a0ad343dd9c84cb95a
2e6a47c140b666202f956110767894b277ce8902
0ba1190a764cc9fb0c98a8365604fbafc26abb51b28f30015b0860a9b37d705b
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=93974
Date: Thu, 08 Dec 2022 22:46:51 GMT
Etag: "6391223d-1d7"
Expires: Sat, 10 Dec 2022 00:53:05 GMT
Last-Modified: Wed, 07 Dec 2022 23:31:09 GMT
Server: ECS (nyb/1D2C)
X-Cache: Miss from cloudfront
Via: 1.1 142be88a35733307a5e7de05da0a20b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: N1ZsFvu7JXx1f9s-1_AVjKThOojIR1hyIejf0UqRPyhWFKZmK5beAQ==
Age: 4916
www.cardealsnearyou.com/wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/webfonts/fa-brands-400.woff2
8.38.122.197200 OK 77 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/webfonts/fa-brands-400.woff2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Web Open Font Format (Version 2), TrueType, length 76764, version 331.-31261\012- data
Hash f7307680c7fe85959f3ecf122493ea7d
fce0da592a3e536d6d5df5b50cb513398d8c5161
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/wp-content/plugins/stm-motors-extends/nuxy/metaboxes/assets/vendors/font-awesome.min.css?ver=1670539608
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:15:37 GMT
etag: "12bdc-5d9e1337455f6"
accept-ranges: bytes
content-length: 76764
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2015/12/io1Wf4rSHtoZ1h526tBordIxO5M-255x135.jpg
8.38.122.197200 OK 4.2 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2015/12/io1Wf4rSHtoZ1h526tBordIxO5M-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash 3d1e88f35f2f14d4104beef3c515475c
2588cd75a75cc3697fb012aeb5351b906dd3643e
fdbcccbeaf42877b5d30f793ca0363a13d7e61e970ff767a6b584752818d1b2c
GET /wp-content/uploads/2015/12/io1Wf4rSHtoZ1h526tBordIxO5M-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 19:13:46 GMT
etag: "108b-5cc35bb09d0b5"
accept-ranges: bytes
content-length: 4235
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/01/3T3WJXA46INUXVHMZWIW2OP4FE-cr-1400-255x135.jpg
8.38.122.197200 OK 7.1 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/01/3T3WJXA46INUXVHMZWIW2OP4FE-cr-1400-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash ff6ba712527af496379f7f7604c6d5e7
1cb8ac447959e55f1e061cc1a68295036974f1ec
0e67156167f5722bdb7bda65451d3a46887d994d01d24ab77bd8f9a158f10a5b
GET /wp-content/uploads/2022/01/3T3WJXA46INUXVHMZWIW2OP4FE-cr-1400-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 10 Jan 2022 17:26:35 GMT
etag: "1bba-5d53da36e24c6"
accept-ranges: bytes
content-length: 7098
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/01/NQN53HOWVI7RM5YQ6SKVFOK3GE-cr-860-255x135.jpg
8.38.122.197200 OK 6.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/01/NQN53HOWVI7RM5YQ6SKVFOK3GE-cr-860-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash f327702125a762eb039fe4b5d80c205a
46b97ec409c19ff74b50c722b46057d5b9259e47
5ef090f8cdb84f4b9c93140992d56e02fab63d8c8843c13a7ca1dd56933e5701
GET /wp-content/uploads/2022/01/NQN53HOWVI7RM5YQ6SKVFOK3GE-cr-860-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 10 Jan 2022 17:02:36 GMT
etag: "19cc-5d53d4db4a844"
accept-ranges: bytes
content-length: 6604
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2022/01/2022-audi-a3-exterior-3-255x135.jpg
8.38.122.197200 OK 8.7 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2022/01/2022-audi-a3-exterior-3-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash 5755a004944727d1d19720ee4c1e621e
757fabc9eb3166e810dd69667a72c5cf298fbd0d
b8c5215277dc00ca259bc091c029530c8e510bd441ff5fd5eaaa4ab9090a6406
GET /wp-content/uploads/2022/01/2022-audi-a3-exterior-3-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 06 Jan 2022 19:14:05 GMT
etag: "21d2-5d4eeac8fc84d"
accept-ranges: bytes
content-length: 8658
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2021/09/Land-Rover-2020-7-255x135.jpg
8.38.122.197200 OK 5.9 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2021/09/Land-Rover-2020-7-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash 26b2a4a9a0593c8f2058947b563d3c27
7bbc565109e384c149d57118c992eb97226468eb
acb2b9280e4a709120c9701a3208b2e62b51e8fe6b27251a1b69a5a2d3494741
GET /wp-content/uploads/2021/09/Land-Rover-2020-7-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 18:33:17 GMT
etag: "1713-5cc352a37a9f0"
accept-ranges: bytes
content-length: 5907
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
rtclx.com/s/?p=7279
52.204.72.177204 No Content 0 B IP 52.204.72.177:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /s/?p=7279 HTTP/1.1
Host: rtclx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 220
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
date: Thu, 08 Dec 2022 22:46:51 GMT
access-control-allow-origin: https://www.cardealsnearyou.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,X-Forwarded-Proto,If-Modified-Since,referer,Cache-Control,Content-Type,Range,Pragma,Accept,Accept-Encoding,Accept-Language
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2017/09/2018-toyota-camry-255x135.jpg
8.38.122.197200 OK 5.6 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2017/09/2018-toyota-camry-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash d2d370f81b534ab16ebdcdc6ba0e3add
792ca4fdb404b56101a3a9b64c1fcd814f43362b
b998dd034eda10934f1fb5ce7b5d050c5fecf13a128d5554d4a654a2715dd5a1
GET /wp-content/uploads/2017/09/2018-toyota-camry-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Wed, 17 Nov 2021 23:18:02 GMT
etag: "15af-5d10440e9b570"
accept-ranges: bytes
content-length: 5551
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2015/12/6-255x135.jpg
8.38.122.197200 OK 6.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2015/12/6-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash b22f163d8dd9f8686b1b33f48c05bf4f
7cfe5db549a478ede241bf589350fd5ff9f06045
5faa004936437d1e03a1bddc087770ee81bb840184669c6e46730a8fc4864f49
GET /wp-content/uploads/2015/12/6-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 18:57:33 GMT
etag: "1a73-5cc35810a54b3"
accept-ranges: bytes
content-length: 6771
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/service-worker.js
8.38.122.197200 OK 106 B URL HTTP/2 www.cardealsnearyou.com/service-worker.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type ASCII text, with no line terminators
Hash c7c0044df4e13403015baf77b1bb5a2f
95b41a3bac71a03a227348d758fbff4447aa8d07
f8aa7d28657b722d4ac9cf4875dcc7e3bae24827acbb8264b60c147bc77c0c69
Analyzer Verdict Alert fortinet Phishing
GET /service-worker.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 08 Dec 2022 22:46:44 GMT
etag: "6a-5ef58cfb7d7f3"
accept-ranges: bytes
content-length: 106
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2015/12/hondaaccord1-255x135.jpg
8.38.122.197200 OK 7.2 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2015/12/hondaaccord1-255x135.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 255x135, components 3\012- data
Hash 1354b99ee4e1ea202f38d762968685ec
3bb97d0707619d1b1ab5c46a3f17b43875095984
25e6ce80e7820c2e38de6bebfa3a9f85fd1022b36a746bd6a6b8f48f12566a20
GET /wp-content/uploads/2015/12/hondaaccord1-255x135.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 19:05:06 GMT
etag: "1c24-5cc359c00e8d9"
accept-ranges: bytes
content-length: 7204
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
i.liadm.com/s/56408?bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID
44.209.26.9303 See Other 0 B URL HTTP/1.1 i.liadm.com/s/56408?bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID
IP 44.209.26.9:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s/56408?bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID HTTP/1.1
Host: i.liadm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 303 See Other
Date: Thu, 08 Dec 2022 22:46:51 GMT
Content-Length: 0
Connection: keep-alive
Location: /s/56408?redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID&bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&_li_chk=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&previous_uuid=ee598186ab194b6aa038137f90a8d249
Set-Cookie: lidid=ee598186-ab19-4b6a-a038-137f90a8d249; Max-Age=63072000; Expires=Sat, 07 Dec 2024 22:46:51 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure
Request-Time: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains
a.clickcertain.com/px/ta/?done=true&ta_id=2051cffa-bc04-4aa2-b37a-b250baf55b5c
172.67.74.207204 No Content 0 B URL HTTP/2 a.clickcertain.com/px/ta/?done=true&ta_id=2051cffa-bc04-4aa2-b37a-b250baf55b5c
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/ta/?done=true&ta_id=2051cffa-bc04-4aa2-b37a-b250baf55b5c HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Thu, 08 Dec 2022 22:46:51 GMT
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:51 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-5lbfh:cc-nginx-554675d589-5lbfh
x-requestid: e9bade5c-2632-4a9f-84de-f570b31f9ff5
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OSX0oEZ1W%2Bj8e5R5V%2B6DFyGbuOCena1ZDDbU%2BzcO%2Fq5SYb5bhy8422%2BYGLevJwnSB%2Fa3nWtImX83UM09d77FF2VV1dYdyFBy3TO2iyOn21W5DQkRzn9fhePk7aOOOo2wFbVwQA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1b6e38b503-OSL
X-Firefox-Spdy: h2
i.liadm.com/s/56408?redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID&bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&_li_chk=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&previous_uuid=ee598186ab194b6aa038137f90a8d249
44.209.26.9303 See Other 0 B URL HTTP/1.1 i.liadm.com/s/56408?redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID&bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&_li_chk=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&previous_uuid=ee598186ab194b6aa038137f90a8d249
IP 44.209.26.9:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s/56408?redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID&bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&_li_chk=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&previous_uuid=ee598186ab194b6aa038137f90a8d249 HTTP/1.1
Host: i.liadm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 303 See Other
Date: Thu, 08 Dec 2022 22:46:51 GMT
Content-Length: 0
Connection: keep-alive
Location: https://a.clickcertain.com/px/li/?redir=https%3a%2f%2fcm%2eg%2edoubleclick%2enet%2fpixel%3fgoogle_nid%3dclickcertain%26google_cm%3d1%26google_sc%3d1%26redir%3dhttps%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuidu%253fhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fbidswitch%252f%253fdone%253dtrue%2526ccid%253d17e7c6fd%252dfd39%252d41ef%252db467%252d585c65734e94%2526anx_uId%253d%2524UID&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
Set-Cookie: _li_ss=MgYIkgEQ5RM; Max-Age=2592000; Expires=Sat, 07 Jan 2023 22:46:51 GMT; SameSite=None; Path=/s; Secure
lidid=af37bf55-2433-4011-9d8e-3247dca05249; Max-Age=63072000; Expires=Sat, 07 Dec 2024 22:46:51 GMT; SameSite=None; Path=/; Domain=liadm.com; Secure
Request-Time: 2
Strict-Transport-Security: max-age=31536000; includeSubDomains
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-brands-400.woff2
8.38.122.197200 OK 75 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-brands-400.woff2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type Web Open Font Format (Version 2), TrueType, length 75368, version 330.32636\012- data
Hash 859c4002d9954718cac1ddea5555698f
2392ce297c92bcf2c7d5a4c461a582dadc8039c8
5054ab369966fea3657ac6af00c3bc47bdc9e7b5114e61d1764be06213ca9781
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.7.0
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:31 GMT
etag: "12668-5d9e136b0fc7a"
accept-ranges: bytes
content-length: 75368
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 22:46:50 GMT
server: Apache
X-Firefox-Spdy: h2
a.usbrowserspeed.com/cs?puid=36181641-6c3b-5d5d-bd77-33ee966a008e&pid=lc&r=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2ft%2f%3fdone%3dtrue%26uid%3d%24%7bDEVICE_ID%7d%26hem%3d%24%7bHEM_SHA256_LOWERCASE%7d
44.229.119.75302 Found 119 B URL HTTP/2 a.usbrowserspeed.com/cs?puid=36181641-6c3b-5d5d-bd77-33ee966a008e&pid=lc&r=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2ft%2f%3fdone%3dtrue%26uid%3d%24%7bDEVICE_ID%7d%26hem%3d%24%7bHEM_SHA256_LOWERCASE%7d
IP 44.229.119.75:0
File type HTML document, ASCII text
Hash 6b39affb61ac80bdf5ed0ef46f753113
1f8f01cde9ca47d3c7e4a9f0a0c27c78f721fcc1
6481dd163a63855a0362b2188baf05b9b8da6d3c62460e9418712831c811d2b0
GET /cs?puid=36181641-6c3b-5d5d-bd77-33ee966a008e&pid=lc&r=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2ft%2f%3fdone%3dtrue%26uid%3d%24%7bDEVICE_ID%7d%26hem%3d%24%7bHEM_SHA256_LOWERCASE%7d HTTP/1.1
Host: a.usbrowserspeed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.clickcertain.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: awselb/2.0
date: Thu, 08 Dec 2022 22:46:51 GMT
content-type: text/html; charset=utf-8
content-length: 119
location: https://a.clickcertain.com/px/t/?done=true&uid=71dc0882-721d-4f3e-a679-7afb8fde3e82&hem=
set-cookie: tuid=71dc0882-721d-4f3e-a679-7afb8fde3e82; Path=/; Domain=a.usbrowserspeed.com; Max-Age=31536000; HttpOnly; Secure; SameSite=None
X-Firefox-Spdy: h2
a.clickcertain.com/px/t/?done=true&uid=71dc0882-721d-4f3e-a679-7afb8fde3e82&hem=
172.67.74.207204 No Content 0 B URL HTTP/2 a.clickcertain.com/px/t/?done=true&uid=71dc0882-721d-4f3e-a679-7afb8fde3e82&hem=
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/t/?done=true&uid=71dc0882-721d-4f3e-a679-7afb8fde3e82&hem= HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Thu, 08 Dec 2022 22:46:51 GMT
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:51 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-5lbfh:cc-nginx-554675d589-5lbfh
x-requestid: 9ce0dcde-f691-4302-abc3-61550d6a36dc
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dqGv9JxJom5b0onsV8OSGtElGXtY07BOLIIvbn%2B%2FsLy4Y13GFxyaYnOl9H1xGWZrKkTSdoCTlN%2FYyeiBYpq9BoKUiIsyOV70KHjuYQl5r3ou35v%2BQjsBBUgIGirjWEjvny2abA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1d1febb503-OSL
X-Firefox-Spdy: h2
a.clickcertain.com/px/li/?redir=https%3a%2f%2fcm%2eg%2edoubleclick%2enet%2fpixel%3fgoogle_nid%3dclickcertain%26google_cm%3d1%26google_sc%3d1%26redir%3dhttps%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuidu%253fhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fbidswitch%252f%253fdone%253dtrue%2526ccid%253d17e7c6fd%252dfd39%252d41ef%252db467%252d585c65734e94%2526anx_uId%253d%2524UID&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
172.67.74.207302 Found 0 B URL HTTP/2 a.clickcertain.com/px/li/?redir=https%3a%2f%2fcm%2eg%2edoubleclick%2enet%2fpixel%3fgoogle_nid%3dclickcertain%26google_cm%3d1%26google_sc%3d1%26redir%3dhttps%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuidu%253fhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fbidswitch%252f%253fdone%253dtrue%2526ccid%253d17e7c6fd%252dfd39%252d41ef%252db467%252d585c65734e94%2526anx_uId%253d%2524UID&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/li/?redir=https%3a%2f%2fcm%2eg%2edoubleclick%2enet%2fpixel%3fgoogle_nid%3dclickcertain%26google_cm%3d1%26google_sc%3d1%26redir%3dhttps%253a%252f%252fsecure%252eadnxs%252ecom%252fgetuidu%253fhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fbidswitch%252f%253fdone%253dtrue%2526ccid%253d17e7c6fd%252dfd39%252d41ef%252db467%252d585c65734e94%2526anx_uId%253d%2524UID&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94 HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:51 GMT
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3a%2f%2fsecure%2eadnxs%2ecom%2fgetuidu%3fhttps%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26ccid%3d17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94%26anx_uId%3d%24UID
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:51 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-q24rw:cc-nginx-554675d589-q24rw
x-requestid: 824947b5-3cd2-4734-a4b5-964076c7c16c
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cS8tOQU8uy81tmRCIAqxQjsyihaiRj9S9371FxLSi27XERmOVgleo82H5c%2Fj%2FfJFqGc2IATOpBeDxyh3En3c%2B%2FND1oC8nBXO%2F2ONGk9oflorlc4hT7AG3I8g1%2FW%2B%2F2nwCGufkw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1cbf71b503-OSL
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 2556512b197b09798af71bea10bb4bbb
23b647aca5f8294ae82fa8cc7e2215ebe3347b60
3b5bd592342d978bcf8919d1a1e2f87295e2e4af5b5b266e6017b7a25725d08d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3a%2f%2fsecure%2eadnxs%2ecom%2fgetuidu%3fhttps%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26ccid%3d17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94%26anx_uId%3d%24UID
142.250.74.130302 Found 509 B URL HTTP/2 cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3a%2f%2fsecure%2eadnxs%2ecom%2fgetuidu%3fhttps%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26ccid%3d17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94%26anx_uId%3d%24UID
IP 142.250.74.130:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (332), with CRLF, LF line terminators
Hash 21ec892291ebe11dd57177ba9cbdf04d
637447d61ab0451381a44b3612277a1db5cf263d
e56b906f52238da37b20c8ab3d261da3c2a88887ab6bf5756f97c353b3039848
GET /pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3a%2f%2fsecure%2eadnxs%2ecom%2fgetuidu%3fhttps%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26ccid%3d17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94%26anx_uId%3d%24UID HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_tc=
date: Thu, 08 Dec 2022 22:46:51 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 509
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 08-Dec-2022 23:01:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/2021/09/02.jpg
8.38.122.197200 OK 271 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/2021/09/02.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, baseline, precision 8, 1920x450, components 3\012- data
Size 271 kB (271281 bytes)
Hash 054f6ba2c1b361dbfee5d38a63d0126c
b7cce95247af8bb050e92ee4cc9f06bda213f0ac
89f03002262b38ce4d110d2e2a95a68fea59392a13c72c3d84384e9c094ee598
GET /wp-content/uploads/2021/09/02.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 22:18:11 GMT
etag: "423b1-5cc384e91f130"
accept-ranges: bytes
content-length: 271281
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:51 GMT
server: Apache
X-Firefox-Spdy: h2
cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_tc=
142.250.74.130302 Found 455 B URL HTTP/2 cm.g.doubleclick.net/pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_tc=
IP 142.250.74.130:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash aad2ecb90125dc83a6dc872d01b5c84b
d228503cd04464077ba766873650ef97508aa847
096c62ed69eccbed677cdd3d351036230465799b2ce909bbe7f421233671bb8c
GET /pixel?google_nid=clickcertain&google_cm=1&google_sc=1&redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_tc= HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
location: https://a.clickcertain.com/px/img/g/?redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_error=3
date: Thu, 08 Dec 2022 22:46:51 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 455
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.5.11
8.38.122.197200 OK 472 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.5.11
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash 2556512b197b09798af71bea10bb4bbb
23b647aca5f8294ae82fa8cc7e2215ebe3347b60
3b5bd592342d978bcf8919d1a1e2f87295e2e4af5b5b266e6017b7a25725d08d
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.5.11 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:11 GMT
etag: "1e4e6-5d9e13571c2f4"
accept-ranges: bytes
content-length: 124134
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
date: Thu, 08 Dec 2022 22:46:49 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/assets/loader.gif
8.38.122.197200 OK 2.5 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/assets/loader.gif
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type GIF image data, version 89a, 24 x 24\012- data
Hash 4b3afb84b2b71ef56df09997a350bd04
accdac8a7abeab0e21c49539aad0a973addb28ef
9034d5d34015e4b05d2c1d1a8dc9f6ec9d59bd96d305eb9e24e24e65c591a645
GET /wp-content/plugins/revslider/public/assets/assets/loader.gif HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.5.11
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:09 GMT
etag: "9f1-5d9e135543fa6"
accept-ranges: bytes
content-length: 2545
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
date: Thu, 08 Dec 2022 22:46:52 GMT
server: Apache
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/stm-slide-2-50x100.jpg
8.38.122.197200 OK 1.8 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/stm-slide-2-50x100.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x100, components 3\012- data
Hash 8221013173b2d9bbba64fe5b414d8656
7093ef97cd16becf037f06a76eec9a238a6d0455
28da6b49c7d5ef55c4dddeb68cf86bfbe43f43b39a03385b19e9ec6124165b59
GET /wp-content/uploads/revslider/home_slider/stm-slide-2-50x100.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 21:37:23 GMT
etag: "713-5cc37bc9edf1d"
accept-ranges: bytes
content-length: 1811
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:52 GMT
server: Apache
X-Firefox-Spdy: h2
a.clickcertain.com/px/img/g/?redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_error=3
172.67.74.207302 Found 0 B URL HTTP/2 a.clickcertain.com/px/img/g/?redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_error=3
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/img/g/?redir=https%3A%2F%2Fsecure%2Eadnxs%2Ecom%2Fgetuidu%3Fhttps%3A%2F%2Fa%2Eclickcertain%2Ecom%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd%2Dfd39%2D41ef%2Db467%2D585c65734e94%26anx_uId%3D%24UID&google_error=3 HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:52 GMT
content-type: text/html
location: https://secure.adnxs.com/getuidu?https://a.clickcertain.com/px/img/bidswitch/?done=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&anx_uId=$UID
x-frontend: cc-nginx-554675d589-2qlzc:cc-nginx-554675d589-2qlzc
x-requestid: b88ce17e-4b1d-4e4c-bc37-291dc18c14db
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N4EkbgEHncO0oCTZPzEnWv%2FsOCndWR0nvpA3s80Ge1oAM2Tj0ehkWLxtnz0L9ZSBjX8c1TNhA4VTaKJkx4mxiRb5CYsE34sDD%2ByQeEGNR0eTDXqEZW0%2FjPFHu4EGBFkvVQ7f0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1f0a06b503-OSL
X-Firefox-Spdy: h2
secure.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.clickcertain.com%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd-fd39-41ef-b467-585c65734e94%26anx_uId%3D%24UID
37.252.171.21302 Found 0 B URL HTTP/1.1 secure.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.clickcertain.com%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd-fd39-41ef-b467-585c65734e94%26anx_uId%3D%24UID
IP 37.252.171.21:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.clickcertain.com%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26ccid%3D17e7c6fd-fd39-41ef-b467-585c65734e94%26anx_uId%3D%24UID HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.21.3
Date: Thu, 08 Dec 2022 22:46:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://a.clickcertain.com/px/img/bidswitch/?done=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&anx_uId=0
AN-X-Request-Uuid: a64b9513-c405-478b-8ae2-64c2fe65d43d
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 07a86cf9d9c8389ebd9c52303c83b27f
fd3524d701bdf111c541b6fc9e038bffcc3b5d6c
de08c944b2cb2671078e452d870757622e286f7214d736ab2c1b1d1c2ab8dcfb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 8274b291596906eb3779dccb82ec41cb
b2ec554df1fa55e18a4316b76ac617dc626b7598
69129be0a1c2e3d1dfc602aea4ef004ea01b3bfa6c5863bd225843472f1bb7c8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.taboola.com/libtrc/siteimpact-network/loader.js
151.101.129.44200 OK 27 kB URL HTTP/2 cdn.taboola.com/libtrc/siteimpact-network/loader.js
IP 151.101.129.44:0
File type ASCII text, with very long lines (65168)
Hash f73495b7223dfea7b05956a40091b37d
3bbf41b2db0da0e2fc95f0215ac7c5d1dbe1c45b
cf4ecb54327a233b2c0d5a9964b08cb62d2909d264e779ba12a30cc6d9b87b81
GET /libtrc/siteimpact-network/loader.js HTTP/1.1
Host: cdn.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: gzip
etag: "260dc8c35458e6ab3c13b28592b1139cb977195a"
last-modified: Thu, 08 Dec 2022 22:32:59 UTC
x-amz-id-2: uYrGWFsOBJzphMZGtSl3t6Wo6RarprV6fb+ip1G2svOZ+3djn3spwNjrW4GI1WRFGis+9n1GTTE=
x-amz-request-id: SS4CGP9C4JJQXT1V
x-amz-version-id: XbTGhIa_AZwLJtmXDWOBXY0Bg6OnB3Ai
x-from-cache: 1
x-envoy-upstream-service-time: 7
accept-ranges: bytes
date: Thu, 08 Dec 2022 22:46:52 GMT
via: 1.1 varnish
age: 832
x-served-by: cache-bma1676-BMA
x-cache: HIT
x-cache-hits: 1
x-timer: S1670539612.425269,VS0,VE1
cache-control: private,max-age=14400
vary: Accept-Encoding, Accept-Encoding
abp: 27
content-length: 26855
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0c89743226644fddacbe5d50c110b950
b343ae9eb9047cf764b518083d612ffd3652b209
1bf675bb6e12e913a98cd8849c1af9a0c50b0bb8bfa670c86419b41782e06e47
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/analytics.js
142.250.74.110200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP 142.250.74.110:0
File type ASCII text, with very long lines (1325)
Hash 47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Thu, 08 Dec 2022 22:41:08 GMT
expires: Fri, 09 Dec 2022 00:41:08 GMT
cache-control: public, max-age=7200
age: 344
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
googleads.g.doubleclick.net/pagead/viewthroughconversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&fmt=3&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&ct_cookie_present=1
142.250.74.98200 OK 42 B URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&fmt=3&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&ct_cookie_present=1
IP 142.250.74.98:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/viewthroughconversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&fmt=3&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&ct_cookie_present=1 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 22:46:52 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 08-Dec-2022 23:01:52 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.google.com/pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4
216.58.211.4302 Found 63 B URL HTTP/2 www.google.com/pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4
IP 216.58.211.4:0
File type ASCII text, with no line terminators
Hash 0339f8f57d1bf75003db591e28957e45
ae2286e497c9f76a02cb40c40a674b73bd293b76
609cd8e12464fe137cfaa9f1ab6637150d44e105559c901b6df50303fd05aa26
GET /pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 22:46:52 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0
content-type: text/javascript; charset=UTF-8
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0c89743226644fddacbe5d50c110b950
b343ae9eb9047cf764b518083d612ffd3652b209
1bf675bb6e12e913a98cd8849c1af9a0c50b0bb8bfa670c86419b41782e06e47
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 07a86cf9d9c8389ebd9c52303c83b27f
fd3524d701bdf111c541b6fc9e038bffcc3b5d6c
de08c944b2cb2671078e452d870757622e286f7214d736ab2c1b1d1c2ab8dcfb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash a938af990a97b9856e1174d11c72cbf7
b57716fd0ea9a1e9e0a0595ff593f939560c0abf
6ab769333b231097d077edfbc1c3fc9560de5ae9bfeb5b8360dea8b7fadbcb44
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
vars.hotjar.com/box-5e66f98b4ee957db209dc6f63e3d59dd.html
143.204.55.20200 OK 1.0 kB URL HTTP/2 vars.hotjar.com/box-5e66f98b4ee957db209dc6f63e3d59dd.html
IP 143.204.55.20:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Hash e0652b84b7b3b650769c759fc520c3f8
0b55d6e28613350c7f41b88f19e726e6751ad03b
94b4c240f83065223dcacdd3f8b69cb229d0616edc3e2041eef3e270d859fc3d
GET /box-5e66f98b4ee957db209dc6f63e3d59dd.html HTTP/1.1
Host: vars.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html
content-length: 1035
date: Wed, 23 Nov 2022 13:10:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a6d89f7e2d55548b941f1ff5d5b3c8d4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: cohta1z8AeVYsm9TnMa8J0p_YT6xIH4gC6LIsF3oqrUEOBF1b5rskA==
age: 1330606
X-Firefox-Spdy: h2
cdn.taboola.com/libtrc/unip/1122536/tfa.js
151.101.129.44200 OK 18 kB URL HTTP/2 cdn.taboola.com/libtrc/unip/1122536/tfa.js
IP 151.101.129.44:0
File type ASCII text, with very long lines (58991)
Hash 47f3f6fc8d8a73da3ddb75b9a77677cc
b23a50c4695606f1be848a52c9e107747a083d5f
86ed70240d3ef3e86971403032af8adf4a0ec6198560d5f61a5db13576014fa1
GET /libtrc/unip/1122536/tfa.js HTTP/1.1
Host: cdn.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: iCEypxN+3zUvN3YoxHm/cFE/CKEFHvojEXpOlpQnHVyVOMWoxQQAawUlxy7vx1Sy3Utv+rEWB8Y=
x-amz-request-id: 8JFB4WJ89XRXZ839
x-amz-replication-status: COMPLETED
last-modified: Tue, 06 Dec 2022 13:05:37 GMT
etag: "24ca8673dd129193bf9c90575d652f98"
x-amz-version-id: BR5rKB3oGvoEHTO.qt5dnuzX3QE_r6Nk
content-type: application/javascript; charset=utf-8
server: AmazonS3
content-encoding: gzip
accept-ranges: bytes
date: Thu, 08 Dec 2022 22:46:52 GMT
via: 1.1 varnish
age: 0
x-served-by: cache-bma1676-BMA
x-cache: HIT
x-cache-hits: 1
x-timer: S1670539612.429892,VS0,VE190
cache-control: private,max-age=14401
vary: Accept-Encoding
abp: 12
content-length: 18132
X-Firefox-Spdy: h2
a.clickcertain.com/px/r/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
172.67.74.207302 Found 56 kB URL HTTP/2 a.clickcertain.com/px/r/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
IP 172.67.74.207:0
Hash ecc6c13de68550da4e73b6883a750f06
a19c1b6b245664ceeef7a2b9dde353545733bd8f
930bc251a0715ab443b9e3af897d61278f5917ea095156708cc1d29e0859867d
GET /px/r/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94 HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.clickcertain.com/px/cont/?c=243b667b11e7ebf&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&cn=NO
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:50 GMT
content-type: text/html
location: https://i.liadm.com/s/56408?bidder_id=200441&bidder_uuid=17e7c6fd-fd39-41ef-b467-585c65734e94&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&redir=https%253a%252f%252fcm%252eg%252edoubleclick%252enet%252fpixel%253fgoogle_nid%253dclickcertain%2526google_cm%253d1%2526google_sc%253d1%2526redir%253dhttps%25253a%25252f%25252fsecure%25252eadnxs%25252ecom%25252fgetuidu%25253fhttps%25253a%25252f%25252fa%25252eclickcertain%25252ecom%25252fpx%25252fimg%25252fbidswitch%25252f%25253fdone%25253dtrue%252526ccid%25253d17e7c6fd%25252dfd39%25252d41ef%25252db467%25252d585c65734e94%252526anx_uId%25253d%252524UID
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:50 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-dhtqj:cc-nginx-554675d589-dhtqj
x-requestid: e236097d-389e-401e-9379-27c66fa7b02a
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vMcd5Ok8T4cWBHun8LmU8xofi2mzqmmltzJ%2B3UVfwy1yGVI2WT4pWBs1cZL9dcGdFW33gGf3AFHy5g9SYjj54MNUVgaOaBNAxWOHl3sW4CjsAoXQuanH4%2FaMDfAozm1%2BmtRGVA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1789e6b503-OSL
X-Firefox-Spdy: h2
script.hotjar.com/modules.bc0a4c72d88d266f15af.js
143.204.55.46200 OK 69 kB URL HTTP/2 script.hotjar.com/modules.bc0a4c72d88d266f15af.js
IP 143.204.55.46:0
File type Unicode text, UTF-8 text, with very long lines (48638)
Hash 2375e31c5dc0ca09d740bee5c1486c2b
d68ad5ffd79e99af40377945f2f41db8b6f00ad0
2197593e6c85391abbb9c0cba866862dc84bad91aedbe5d90d374e413504f5cb
GET /modules.bc0a4c72d88d266f15af.js HTTP/1.1
Host: script.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
content-length: 68590
date: Wed, 07 Dec 2022 14:35:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "2375e31c5dc0ca09d740bee5c1486c2b"
last-modified: Wed, 07 Dec 2022 14:34:24 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: LUvpAaXgPYxHvhro_0ZWZPq00ZPAuH0fZfn_P_gnyDXqEaHl93K48w==
age: 115906
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/slide-1.jpg
8.38.122.197200 OK 397 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/slide-1.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x599, components 3\012- data
Size 397 kB (396968 bytes)
Hash 8c05c26f1076baa2687a3710eaf10563
65f7011a1ed66f6a564708a93b311811e1de9c0f
0470dc5271de8c95437a5d7d31eaa606b7876c6ec3c7db4f7ab7723eb5a6769d
GET /wp-content/uploads/revslider/home_slider/slide-1.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 17:51:18 GMT
etag: "60ea8-5cc349410290a"
accept-ranges: bytes
content-length: 396968
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:52 GMT
server: Apache
X-Firefox-Spdy: h2
cdn.taboola.com/libtrc/impl.20220503-18-RELEASE.js
151.101.129.44200 OK 133 kB URL HTTP/2 cdn.taboola.com/libtrc/impl.20220503-18-RELEASE.js
IP 151.101.129.44:0
File type ASCII text, with very long lines (65508)
Size 133 kB (132588 bytes)
Hash defdab8a5f7034eb7f08c19866fa7ac5
d180f795a8cd7f7164c71ee54af461e4a70080e6
2dd0eacab9c1b4b02cbc7e3a20fbc950f6823d34473fa63dcbebf7376a51cf5b
GET /libtrc/impl.20220503-18-RELEASE.js HTTP/1.1
Host: cdn.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
x-amz-id-2: vUYHuaWuGhSkWG7tmaVV+/AraDrOSmGxQZ9vSGtz3bgkcdWKmmHv3zMnmv3DKL0FrDiemFhfRGY=
x-amz-request-id: PQMF8MZ1CYSKEAH7
last-modified: Sun, 08 May 2022 10:32:39 GMT
etag: "defdab8a5f7034eb7f08c19866fa7ac5"
content-encoding: br
x-amz-version-id: 18oAbik0LYD7YzztmCIoH2rcA8SpF7lR
content-type: application/javascript
accept-ranges: bytes
date: Thu, 08 Dec 2022 22:46:52 GMT
via: 1.1 varnish
age: 16769
x-served-by: cache-bma1676-BMA
x-cache: HIT
x-cache-hits: 1
x-timer: S1670539613.681267,VS0,VE5
cache-control: private,max-age=31536000
vary: Accept-Encoding
abp: 12
server: AmazonS3-br
content-length: 132588
X-Firefox-Spdy: h2
www.cardealsnearyou.com/favicon.ico
8.38.122.197404 Not Found 196 B URL HTTP/2 www.cardealsnearyou.com/favicon.ico
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
GET /favicon.ico HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
content-length: 196
content-type: text/html; charset=iso-8859-1
date: Thu, 08 Dec 2022 22:46:52 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 32d90ff0cc366730c3633c1201b4c058
f4175292b607197a15085e14bf69df301dff6706
b4b2f80fbe9b02f3d54dc35a3738c31a4d7cb5a5e528fcbce50263d8c458231a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.no/pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0
142.250.74.67200 OK 63 B URL HTTP/2 www.google.no/pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0
IP 142.250.74.67:0
File type ASCII text, with no line terminators
Hash 0339f8f57d1bf75003db591e28957e45
ae2286e497c9f76a02cb40c40a674b73bd293b76
609cd8e12464fe137cfaa9f1ab6637150d44e105559c901b6df50303fd05aa26
GET /pagead/1p-conversion/756219746/?random=1670539610195&cv=11&fst=1670539610195&bg=ffffff&guid=ON&async=1>m=2wgbu0&u_w=1280&u_h=1024&label=n0T0CLD9kuMBEOL-y-gC&hn=www.google.com&frm=0&url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&tiba=Front%20page%20-%20Car%20Deals%20Near%20You&value=0&bttype=purchase&auid=2143217736.1670539610&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.cardealsnearyou.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 22:46:52 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript; charset=UTF-8
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 32d90ff0cc366730c3633c1201b4c058
f4175292b607197a15085e14bf69df301dff6706
b4b2f80fbe9b02f3d54dc35a3738c31a4d7cb5a5e528fcbce50263d8c458231a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&cs_it=b3&cv=3.8.0.210223&ns__t=1670539612057&ns_c=UTF-8&c7=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&c8=Front%20page%20-%20Car%20Deals%20Near%20You&c9=
143.204.55.94204 No Content 0 B URL HTTP/2 sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&cs_it=b3&cv=3.8.0.210223&ns__t=1670539612057&ns_c=UTF-8&c7=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&c8=Front%20page%20-%20Car%20Deals%20Near%20You&c9=
IP 143.204.55.94:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b?c1=7&c2=34354936&c3=1&cs_it=b3&cv=3.8.0.210223&ns__t=1670539612057&ns_c=UTF-8&c7=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&c8=Front%20page%20-%20Car%20Deals%20Near%20You&c9= HTTP/1.1
Host: sb.scorecardresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Thu, 08 Dec 2022 22:46:52 GMT
set-cookie: UID=1AC0acb1e3d1a67bf3dfebf1670539612; domain=.scorecardresearch.com; path=/; max-age=62208000
x-cache: Miss from cloudfront
via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: sACn1qJDta6jnf3prEnF5wLgZ1tToO6g8tQ7eiKU-K2bBbY00-Wk7g==
X-Firefox-Spdy: h2
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-172606863-1&cid=1150370129.1670539612&jid=196012808&gjid=982079720&_gid=1995541981.1670539612&_u=YEBAAEAAAAAAACAAI~&z=708111488
108.177.14.157200 OK 1 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-172606863-1&cid=1150370129.1670539612&jid=196012808&gjid=982079720&_gid=1995541981.1670539612&_u=YEBAAEAAAAAAACAAI~&z=708111488
IP 108.177.14.157:0
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-172606863-1&cid=1150370129.1670539612&jid=196012808&gjid=982079720&_gid=1995541981.1670539612&_u=YEBAAEAAAAAAACAAI~&z=708111488 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://www.cardealsnearyou.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 08 Dec 2022 22:46:52 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
216.58.207.227200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP 216.58.207.227:0
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 07 Dec 2022 19:34:15 GMT
expires: Thu, 07 Dec 2023 19:34:15 GMT
cache-control: public, max-age=31536000
age: 97957
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/stm-slide-2.jpg
8.38.122.197200 OK 112 kB URL HTTP/2 www.cardealsnearyou.com/wp-content/uploads/revslider/home_slider/stm-slide-2.jpg
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1600x598, components 3\012- data
Size 112 kB (112017 bytes)
Hash 292610641309e71ddefc485b28a9637e
d43e9e9cc91a96d19957bc17fbc20c044f9196f6
78c6eb9fa4fc7bbf980f1c3684a004ec442a2ce8f3046d6eabc23042f87095df
GET /wp-content/uploads/revslider/home_slider/stm-slide-2.jpg HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610; _ga=GA1.2.1150370129.1670539612; _gid=GA1.2.1995541981.1670539612; _gat_UA-172606863-1=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 17 Sep 2021 17:51:18 GMT
etag: "1b591-5cc349411bb6b"
accept-ranges: bytes
content-length: 112017
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
date: Thu, 08 Dec 2022 22:46:52 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 313 B IP 93.184.220.29:0
Hash 15e3b0c296969f81335cfd2dc136478a
45c617468feb907652356179090be9fc36790b03
0388ea0c98ed3ab0a27735128f347d2c626997fb1406dfe7e54796c3245cf8d4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4928
Cache-Control: max-age=135720
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:53 GMT
Etag: "6391c545-139"
Expires: Sat, 10 Dec 2022 12:28:53 GMT
Last-Modified: Thu, 08 Dec 2022 11:06:45 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 313
trc-events.taboola.com/siteimpact-cardealsnearyou/log/2/debug?tim=22%3A46%3A52.273&type=usage&msg=rtus&llvl=2&id=30&cv=20220503-18-RELEASE<=deflated&file=rtus.js&method=injectRtus&position=default&extraData=%7B%7D
141.226.228.48204 No Content 0 B URL HTTP/2 trc-events.taboola.com/siteimpact-cardealsnearyou/log/2/debug?tim=22%3A46%3A52.273&type=usage&msg=rtus&llvl=2&id=30&cv=20220503-18-RELEASE<=deflated&file=rtus.js&method=injectRtus&position=default&extraData=%7B%7D
IP 141.226.228.48:0
ASN #200478 Taboola.com ltd
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /siteimpact-cardealsnearyou/log/2/debug?tim=22%3A46%3A52.273&type=usage&msg=rtus&llvl=2&id=30&cv=20220503-18-RELEASE<=deflated&file=rtus.js&method=injectRtus&position=default&extraData=%7B%7D HTTP/1.1
Host: trc-events.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
server: nginx
date: Thu, 08 Dec 2022 22:46:53 GMT
x-fastly-to-nlb-rtt: 22083
access-control-allow-credentials: true
X-Firefox-Spdy: h2
vc.hotjar.io/sessions/1899855?s=0.25&r=0.10644696290411837
54.230.111.70204 No Content 0 B URL HTTP/2 vc.hotjar.io/sessions/1899855?s=0.25&r=0.10644696290411837
IP 54.230.111.70:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sessions/1899855?s=0.25&r=0.10644696290411837 HTTP/1.1
Host: vc.hotjar.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
access-control-allow-origin: *
cache-control: no-store
date: Thu, 08 Dec 2022 22:46:53 GMT
server: Python/3.7 aiohttp/3.5.4
x-cache: Miss from cloudfront
via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: iFThKCkpCnlFQYzGySBHh0k1QWuHqsNX2yOM9xNatpg8WFcB_5NNew==
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
143.204.42.165200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP 143.204.42.165:0
Hash 1f5e215f8a7a02c43465654c397e0bbd
167bfd0fe3b0bba7170f6d2b9e345ef6b3b6dfd7
ea8f444a8683640e753d493f1ffed8356ad3280f8e64f5e38e95b6551e84b383
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Thu, 08 Dec 2022 22:46:53 GMT
Last-Modified: Thu, 08 Dec 2022 21:24:06 GMT
Server: ECS (nyb/1D33)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: PSli6fqO_9TOZC5fQHkWn5GuI_MPVitqwLTuV3sStLTXD3RO1mqtuQ==
Age: 4967
in.hotjar.com/api/v2/client/sites/1899855/visit-data?sv=6
52.49.107.217200 OK 95 B URL HTTP/2 in.hotjar.com/api/v2/client/sites/1899855/visit-data?sv=6
IP 52.49.107.217:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 039d32f7359c34eee13f02bae640eff7
7550a24e404da6c533fa8597113eec17a6d55f4c
1874a3ed03bfe4289ca3a8cc3c495a498033ddb248a6fbdcdce02e70065eca54
POST /api/v2/client/sites/1899855/visit-data?sv=6 HTTP/1.1
Host: in.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 129
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:53 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2
www.cardealsnearyou.com/service-worker.js
8.38.122.197304 Not Modified 0 B URL HTTP/2 www.cardealsnearyou.com/service-worker.js
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Phishing
GET /service-worker.js HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610; _ga=GA1.2.1150370129.1670539612; _gid=GA1.2.1995541981.1670539612; _gat_UA-172606863-1=1; _hjSessionUser_1899855=eyJpZCI6ImM4MmVjZWIxLTY5YzYtNTE3My1hYzY3LTlkM2RiOGQ3MTYzYiIsImNyZWF0ZWQiOjE2NzA1Mzk2MTIxMTYsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=1; _hjSession_1899855=eyJpZCI6ImRiMjEwM2NjLWQyNmItNDEwOS1hMjk4LTY5NmFjMzZiNjZhMiIsImNyZWF0ZWQiOjE2NzA1Mzk2MTI0MzgsImluU2FtcGxlIjp0cnVlfQ==; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
If-Modified-Since: Thu, 08 Dec 2022 22:46:44 GMT
If-None-Match: "6a-5ef58cfb7d7f3"
Cache-Control: max-age=0
TE: trailers
HTTP/2 304 Not Modified
last-modified: Thu, 08 Dec 2022 22:46:44 GMT
etag: "6a-5ef58cfb7d7f3"
accept-ranges: bytes
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 22:46:53 GMT
server: Apache
X-Firefox-Spdy: h2
trc-events.taboola.com/1122536/log/3/unip?en=pre_d_eng_tb&tos=1760&scd=18&ssd=1&est=1670539611883&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1670539613644&vi=1670539611881&ri=ef7e5e794c2960f9d6b645662ba10916&ref=null&cv=20221206-9-RELEASE&item-url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&ler=other
141.226.228.48204 No Content 0 B URL HTTP/2 trc-events.taboola.com/1122536/log/3/unip?en=pre_d_eng_tb&tos=1760&scd=18&ssd=1&est=1670539611883&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1670539613644&vi=1670539611881&ri=ef7e5e794c2960f9d6b645662ba10916&ref=null&cv=20221206-9-RELEASE&item-url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&ler=other
IP 141.226.228.48:0
ASN #200478 Taboola.com ltd
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /1122536/log/3/unip?en=pre_d_eng_tb&tos=1760&scd=18&ssd=1&est=1670539611883&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1670539613644&vi=1670539611881&ri=ef7e5e794c2960f9d6b645662ba10916&ref=null&cv=20221206-9-RELEASE&item-url=https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term&ler=other HTTP/1.1
Host: trc-events.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Thu, 08 Dec 2022 22:46:54 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.cardealsnearyou.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
X-Firefox-Spdy: h2
api.pushnami.com/scripts/v2/pushnami-sw/6307cede82599900146a1edc
54.230.111.53200 OK 2.4 kB URL HTTP/2 api.pushnami.com/scripts/v2/pushnami-sw/6307cede82599900146a1edc
IP 54.230.111.53:0
Hash 32c79be0384bf32491dc2722c478db8d
78f3ac790776c1cdcad9c985addaf182f3526974
ad93ddbc45ac54467adad61deea5bc104cf4aa2b93e44ed3e834d209b7471a64
GET /scripts/v2/pushnami-sw/6307cede82599900146a1edc HTTP/1.1
Host: api.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Thu, 08 Dec 2022 22:40:00 GMT
cache-control: no-cache
content-encoding: gzip
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: Qe1p9YfFkfxlui5cjPfsyoqh6hT7aADeaVHL_UV-JHpt82Go0f0lHw==
age: 413
X-Firefox-Spdy: h2
a.clickcertain.com/px/img/bidswitch/?done=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&anx_uId=0
172.67.74.207302 Found 0 B URL HTTP/2 a.clickcertain.com/px/img/bidswitch/?done=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&anx_uId=0
IP 172.67.74.207:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/img/bidswitch/?done=true&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&anx_uId=0 HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:54 GMT
content-type: text/html
location: https://x.bidswitch.net/sync?dsp_id=179&user_id=17e7c6fd-fd39-41ef-b467-585c65734e94&expires=5&user_group=0
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:54 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-v2vf9:cc-nginx-554675d589-v2vf9
x-requestid: 8ffe7b1d-2afa-436f-bf78-85593f7e5192
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zjSjwH2i3TQI2FwKh0Q0PzidJ5OC%2F5z6XoTP%2FOv58%2FYpxrIWAIE95Ba%2Ft56rl092zx30dGBmOt2Ia9Prltu3wNzdO6vzJSAVkiy2D7VNNIt1TLGUvf3DKJG2msSMNlRhtKxCqw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a20fc60b503-OSL
X-Firefox-Spdy: h2
x.bidswitch.net/ul_cb/sync?dsp_id=179&user_id=17e7c6fd-fd39-41ef-b467-585c65734e94&expires=5&user_group=0
35.158.31.44200 OK 43 B URL HTTP/2 x.bidswitch.net/ul_cb/sync?dsp_id=179&user_id=17e7c6fd-fd39-41ef-b467-585c65734e94&expires=5&user_group=0
IP 35.158.31.44:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /ul_cb/sync?dsp_id=179&user_id=17e7c6fd-fd39-41ef-b467-585c65734e94&expires=5&user_group=0 HTTP/1.1
Host: x.bidswitch.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a.clickcertain.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:54 GMT
content-type: image/gif
content-length: 43
cache-control: no-cache, no-store, must-revalidate
X-Firefox-Spdy: h2
gum.criteo.com/syncframe?origin=rtus&topUrl=www.cardealsnearyou.com
178.250.0.157200 OK 5.1 kB URL HTTP/2 gum.criteo.com/syncframe?origin=rtus&topUrl=www.cardealsnearyou.com
IP 178.250.0.157:0
Hash a6820e1953c85b5f613de466ec9a85cd
dd4e16380cd9d07a117477381316aba6a3aa76bb
a64980c2927147f21654446a14b8c939e232b01b3fe53842bf5a9e465a4d5720
GET /syncframe?origin=rtus&topUrl=www.cardealsnearyou.com HTTP/1.1
Host: gum.criteo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:53 GMT
content-type: text/html; charset=utf-8
server: Kestrel
cache-control: private, max-age=3600
set-cookie: optout=0; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=.criteo.com; path=/
uid=4a90ca36-1f13-4d4f-b8b7-0e6e4890af71; expires=Tue, 02 Jan 2024 22:46:54 GMT; domain=.criteo.com; path=/; secure; samesite=none
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 514966
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 313 B IP 93.184.220.29:0
Hash 61774d39caf6116c5f631a66e57630f4
5e26a41cc5e6409e441b1a40a150e70e331fe58a
a98d67df9ebfa7282ceec988489abadc2737b5e029e1f1cc514612681ec0ca80
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4751
Cache-Control: max-age=159339
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:55 GMT
Etag: "6392223a-139"
Expires: Sat, 10 Dec 2022 19:02:33 GMT
Last-Modified: Thu, 08 Dec 2022 17:43:22 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 313
dnacdn.net/dna
178.250.2.146200 OK 0 B IP 178.250.2.146:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /dna HTTP/1.1
Host: dnacdn.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gum.criteo.com/
Origin: https://gum.criteo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:54 GMT
server: Kestrel
content-length: 0
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
set-cookie: browser_data=EIYg4F80M0RITmhlJTJCZkMwOUJGQlhaMUN2czRiSHdya0c1JTJGbGNmcSUyQmZlZE8xaEdidVBOYnpET1JZMGdXU2FYTiUyRmNUSTI; expires=Tue, 02 Jan 2024 22:46:55 GMT; domain=dnacdn.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://gum.criteo.com
server-processing-duration-in-ticks: 276280
strict-transport-security: max-age=31536000; preload;
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 313 B IP 93.184.220.29:0
Hash b9fca58b89602b3894ef9642bc27ea3a
e6e8e93b2e314a95eedf178e69c20c4e4a2c55b8
ec626f763a90a8ffcd5979a3a862b6f36a2ae70c17c3e48d9d6b439e2997d943
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4954
Cache-Control: max-age=131798
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:55 GMT
Etag: "6391b5db-139"
Expires: Sat, 10 Dec 2022 11:23:33 GMT
Last-Modified: Thu, 08 Dec 2022 10:00:59 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 313
ocsp.digicert.com/
93.184.220.29200 OK 313 B IP 93.184.220.29:0
Hash b9fca58b89602b3894ef9642bc27ea3a
e6e8e93b2e314a95eedf178e69c20c4e4a2c55b8
ec626f763a90a8ffcd5979a3a862b6f36a2ae70c17c3e48d9d6b439e2997d943
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4954
Cache-Control: max-age=131798
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 22:46:55 GMT
Etag: "6391b5db-139"
Expires: Sat, 10 Dec 2022 11:23:33 GMT
Last-Modified: Thu, 08 Dec 2022 10:00:59 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 313
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg
34.120.237.76200 OK 5.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash fba9a3854df65740512f96efe7442e58
8fbff7725c842d70e047c635a725723a9dc9c55a
6e639298ebc82343cee9267d2910d15735af55f910e2c3de9218266b7c6fffc9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 5188
x-amzn-requestid: afb8cbd2-3674-4dac-9cd9-9ff83618ac0a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ck2-5G9joAMFlPA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638b6b92-2979ff216b9028aa70baef8b;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 15:30:26 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 7Dp35PIr_WYUI1bBa21AvmCMEPi0d3jnhuS8eEk3Q3CXRcGWAnkD8g==
via: 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 17:01:04 GMT
age: 20751
etag: "8fbff7725c842d70e047c635a725723a9dc9c55a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
trc.taboola.com/1122536/trc/3/json?tim=1670539611885&data=%7B%22id%22%3A646%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1670539611881%2C%22cv%22%3A%2220221206-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtaboolaaccount-trafficsourcedeliverymarketercom%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1670539611885%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A18%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i
151.101.129.44200 OK 0 B URL HTTP/2 trc.taboola.com/1122536/trc/3/json?tim=1670539611885&data=%7B%22id%22%3A646%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1670539611881%2C%22cv%22%3A%2220221206-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtaboolaaccount-trafficsourcedeliverymarketercom%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1670539611885%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A18%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i
IP 151.101.129.44:0
GET /1122536/trc/3/json?tim=1670539611885&data=%7B%22id%22%3A646%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1670539611881%2C%22cv%22%3A%2220221206-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtaboolaaccount-trafficsourcedeliverymarketercom%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1670539611885%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.cardealsnearyou.com%2F%3Futm_source%3D709%26utm_medium%3Dcpc%26utm_campaign%3D8760%26utm_content%26utm_term%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A18%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i HTTP/1.1
Host: trc.taboola.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
content-encoding: gzip
accept-ranges: bytes
date: Thu, 08 Dec 2022 22:46:52 GMT
via: 1.1 varnish
x-served-by: cache-bma1676-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1670539613.734529,VS0,VE106
vary: Accept-Encoding
x-vcl-time-ms: 106
X-Firefox-Spdy: h2
a.clickcertain.com/px/cont/?c=243b667b11e7ebf&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&cn=NO
172.67.74.207200 OK 0 B URL HTTP/2 a.clickcertain.com/px/cont/?c=243b667b11e7ebf&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&cn=NO
IP 172.67.74.207:0
GET /px/cont/?c=243b667b11e7ebf&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&cn=NO HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:50 GMT
content-type: text/html
etag: W/"MTdlN2M2ZmRnZmQzOWc0MWVmZ2I0NjdnNTg1YzY1NzM0ZTk0LXow"
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:50 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-mrk8d:cc-nginx-554675d589-mrk8d
x-requestid: 2617486e-5950-4388-8f67-b1884d1e6450
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n4K4sVUUD03%2FUvD%2BkR3MkP0Wj9TM3DiPoyD630l1aYsW7%2Ffu7T70l6o%2ByDPz59PlO52N%2Fwuc9OVZ3gXrzVucWqEGgNdNx2bkMNtC%2BezB2klDdseODwV7JRvlzP3XJUc%2Fd%2BH%2B%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a147e1fb503-OSL
content-encoding: br
X-Firefox-Spdy: h2
static.hotjar.com/c/hotjar-1899855.js?sv=6
143.204.55.84200 OK 0 B URL HTTP/2 static.hotjar.com/c/hotjar-1899855.js?sv=6
IP 143.204.55.84:0
GET /c/hotjar-1899855.js?sv=6 HTTP/1.1
Host: static.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Thu, 08 Dec 2022 22:46:52 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
etag: W/b02828c6207a10564c49d0c3c822d27e
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: mWtDY0F9qER3R92hzJipUNHq-qOXAMphDNmGrVl5128KPLqnoLUsjA==
X-Firefox-Spdy: h2
ws44.hotjar.com/api/v2/sites/1899855/recordings/content
54.75.47.87200 OK 0 B URL HTTP/2 ws44.hotjar.com/api/v2/sites/1899855/recordings/content
IP 54.75.47.87:0
POST /api/v2/sites/1899855/recordings/content HTTP/1.1
Host: ws44.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 448864
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:53 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2
ag.gbc.criteo.com/newidsd
178.250.6.58200 OK 0 B URL HTTP/2 ag.gbc.criteo.com/newidsd
IP 178.250.6.58:0
GET /newidsd HTTP/1.1
Host: ag.gbc.criteo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gum.criteo.com/
Origin: https://gum.criteo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:55 GMT
content-type: application/json; charset=utf-8
server: Kestrel
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://gum.criteo.com
server-processing-duration-in-ticks: 69371
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding
X-Firefox-Spdy: h2
gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
178.250.0.157200 OK 0 B URL HTTP/2 gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
IP 178.250.0.157:0
GET /sync?c=72&r=2&j=TRC.getRTUS HTTP/1.1
Host: gum.criteo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:53 GMT
content-type: text/javascript; charset=utf-8
server: Kestrel
cache-control: private, max-age=3600
expires: 60
server-processing-duration-in-ticks: 710783
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding
X-Firefox-Spdy: h2
psp.pushnami.com/api/psp
3.216.213.114200 OK 0 B IP 3.216.213.114:0
OPTIONS /api/psp HTTP/1.1
Host: psp.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: key
Referer: https://www.cardealsnearyou.com/
Origin: https://www.cardealsnearyou.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:55 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.cardealsnearyou.com
access-control-allow-credentials: true
access-control-expose-headers: content-type, content-length, etag
access-control-max-age: 600
access-control-allow-headers: key
access-control-allow-methods: POST
cache-control: no-cache
vary: accept-encoding
content-encoding: gzip
X-Firefox-Spdy: h2
www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-solid-900.woff2
8.38.122.197200 OK 0 B URL HTTP/2 www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-solid-900.woff2
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.7.0
Cookie: stm_visitor_1=58464791; _gcl_au=1.1.2143217736.1670539610; _ga=GA1.2.1150370129.1670539612; _gid=GA1.2.1995541981.1670539612; _gat_UA-172606863-1=1; _hjSessionUser_1899855=eyJpZCI6ImM4MmVjZWIxLTY5YzYtNTE3My1hYzY3LTlkM2RiOGQ3MTYzYiIsImNyZWF0ZWQiOjE2NzA1Mzk2MTIxMTYsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=1; _hjSession_1899855=eyJpZCI6ImRiMjEwM2NjLWQyNmItNDEwOS1hMjk4LTY5NmFjMzZiNjZhMiIsImNyZWF0ZWQiOjE2NzA1Mzk2MTI0MzgsImluU2FtcGxlIjp0cnVlfQ==; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _ga_NYVK3745TE=GS1.1.1670539614.1.0.1670539614.0.0.0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 10 Mar 2022 18:16:32 GMT
etag: "127f0-5d9e136b1891d"
accept-ranges: bytes
content-length: 75760
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 08 Dec 2022 22:46:55 GMT
server: Apache
X-Firefox-Spdy: h2
api.pushnami.com/scripts/v2/pushnami-sw/6307cede82599900146a1edc
54.230.111.33200 OK 0 B URL HTTP/2 api.pushnami.com/scripts/v2/pushnami-sw/6307cede82599900146a1edc
IP 54.230.111.33:0
GET /scripts/v2/pushnami-sw/6307cede82599900146a1edc HTTP/1.1
Host: api.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Thu, 08 Dec 2022 22:40:00 GMT
cache-control: no-cache
content-encoding: gzip
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: zZzcCPbMa1LU26KXhPb1IRXaq4ibpAqv9TCYCO4Bmt52G9rE0Vl0Og==
age: 411
X-Firefox-Spdy: h2
api.pushnami.com/scripts/v1/hub
54.230.111.33200 OK 0 B URL HTTP/2 api.pushnami.com/scripts/v1/hub
IP 54.230.111.33:0
GET /scripts/v1/hub HTTP/1.1
Host: api.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/html; charset=utf-8
date: Thu, 08 Dec 2022 22:10:20 GMT
access-control-allow-origin: *
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-headers: X-Requested-With
content-security-policy: default-src 'unsafe-inline' *
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *
cache-control: no-cache
content-encoding: gzip
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: bhyYk5TNf6iTDVp0OTmU6rfTlnKUsE9zaSeXMJJMvm4VMQrxeStHWg==
age: 2194
X-Firefox-Spdy: h2
sb.scorecardresearch.com/beacon.js
143.204.55.94200 OK 0 B URL HTTP/2 sb.scorecardresearch.com/beacon.js
IP 143.204.55.94:0
GET /beacon.js HTTP/1.1
Host: sb.scorecardresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
last-modified: Tue, 28 Jun 2022 13:19:23 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Thu, 08 Dec 2022 01:08:30 GMT
cache-control: max-age=86400
etag: W/"eaf85c1c6758e84acfe134efd70e9373"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 0MCpPXONFgEYs1KUJu5Tuv8TE4IOOJNLd6dkF0fDgf11mbb_QqDraw==
age: 77902
X-Firefox-Spdy: h2
a.clickcertain.com/px/ta/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
172.67.74.207302 Found 0 B URL HTTP/2 a.clickcertain.com/px/ta/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94
IP 172.67.74.207:0
GET /px/ta/?ccid=17e7c6fd-fd39-41ef-b467-585c65734e94 HTTP/1.1
Host: a.clickcertain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.clickcertain.com/px/cont/?c=243b667b11e7ebf&ccid=17e7c6fd-fd39-41ef-b467-585c65734e94&cn=NO
Cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; _ccpx_243b667b11e7ebf=1; _ccpx=243b667b11e7ebf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:50 GMT
content-type: text/html
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3318&partner_device_id=17e7c6fd-fd39-41ef-b467-585c65734e94&partner_url=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fta%2f%3fdone%3dtrue%26ta_id%3d%24%7bTA_DEVICE_ID%7d
set-cookie: _ccpx_u=17e7c6fd%2dfd39%2d41ef%2db467%2d585c65734e94; Expires=Fri, 08 Dec 2023 22:46:50 GMT; Path=/; HttpOnly; SameSite=None; Secure
x-frontend: cc-nginx-554675d589-q24rw:cc-nginx-554675d589-q24rw
x-requestid: 3ac64258-df69-4a92-9763-6eb802cb741e
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=snhdcHh7MJ60AurcYTzQgcSqRJgFCBXWolw3tOKaNnUxi0MnS4obwPTuM%2FQp9y10akxWw8b3tJjhLNSbcxVm6sA71tyanrkKL%2BU3nnhbAn1fDWraXcDiMxKXdE31RS8oc6seHw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a1789e0b503-OSL
X-Firefox-Spdy: h2
www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
8.38.122.197200 OK 0 B URL HTTP/2 www.cardealsnearyou.com/?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term
IP 8.38.122.197:0
ASN #40803 KNOWNWEBHOSTING
GET /?utm_source=709&utm_medium=cpc&utm_campaign=8760&utm_content&utm_term HTTP/1.1
Host: www.cardealsnearyou.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: stm_visitor_1=58464791
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 200 OK
x-b-cache: BYPASS
link: <https://www.cardealsnearyou.com/wp-json/>; rel="https://api.w.org/", <https://www.cardealsnearyou.com/wp-json/wp/v2/pages/1360>; rel="alternate"; type="application/json", <https://www.cardealsnearyou.com/>; rel=shortlink
vary: Accept-Encoding
content-encoding: gzip
x-signature: KUSANAGI
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 22:46:48 GMT
server: Apache
X-Firefox-Spdy: h2
a.remarketstats.com/px/smart/?c=243b667b11e7ebf
104.26.3.122302 Found 0 B URL HTTP/2 a.remarketstats.com/px/smart/?c=243b667b11e7ebf
IP 104.26.3.122:0
GET /px/smart/?c=243b667b11e7ebf HTTP/1.1
Host: a.remarketstats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Thu, 08 Dec 2022 22:46:49 GMT
content-type: text/html
location: https://a.clickcertain.com/px/smart/a/?c=243b667b11e7ebf
x-frontend: cc-nginx-554675d589-v2vf9:cc-nginx-554675d589-v2vf9
x-requestid: a967d77a-e29f-465a-a898-c42f4f29c6d4
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8JKKMG9yPBmfzEYpVDucoi%2Bkn59ZbkeRcWNCI4MPF7HD6Nd6WcP3ipgCLXi3Gc45dTHEQjc5VaVjKlHdJcOFI66oyZrodhpdy4gV1%2Bi6RK9CiR60LNGVwaGKqHwJYwHzHYmUAaU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77690a0cfa800b41-OSL
X-Firefox-Spdy: h2
api.pushnami.com/scripts/v1/pushnami-adv/6307cede82599900146a1edc
54.230.111.33200 OK 0 B URL HTTP/2 api.pushnami.com/scripts/v1/pushnami-adv/6307cede82599900146a1edc
IP 54.230.111.33:0
GET /scripts/v1/pushnami-adv/6307cede82599900146a1edc HTTP/1.1
Host: api.pushnami.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.cardealsnearyou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Thu, 08 Dec 2022 22:41:15 GMT
cache-control: no-cache
content-encoding: gzip
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: a0DK_yFvsLqGuqpWsfods_SKCXrQnpb0Lz7WexzmQXOp0AFb6kQKTg==
age: 335
X-Firefox-Spdy: h2
dnacdn.net/dna
178.250.2.146200 OK 0 B IP 178.250.2.146:0
GET /dna HTTP/1.1
Host: dnacdn.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gum.criteo.com/
Origin: https://gum.criteo.com
Connection: keep-alive
Cookie: browser_data=EIYg4F80M0RITmhlJTJCZkMwOUJGQlhaMUN2czRiSHdya0c1JTJGbGNmcSUyQmZlZE8xaEdidVBOYnpET1JZMGdXU2FYTiUyRmNUSTI
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:55 GMT
content-type: application/json; charset=utf-8
server: Kestrel
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
set-cookie: browser_data=OdvVy180M0RITmhlJTJCZkMwOUJGQlhaMUN2czRiSHdya0c1JTJGbGNmcSUyQmZlZE8xaEdhVXV6JTJGb2w2NFJHaUhiRkxQalBzUG0; expires=Tue, 02 Jan 2024 22:46:55 GMT; domain=dnacdn.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://gum.criteo.com
server-processing-duration-in-ticks: 332578
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding
X-Firefox-Spdy: h2
gem.gbc.criteo.com/newidsd
178.250.6.215200 OK 0 B URL HTTP/2 gem.gbc.criteo.com/newidsd
IP 178.250.6.215:0
GET /newidsd HTTP/1.1
Host: gem.gbc.criteo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gum.criteo.com/
Origin: https://gum.criteo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
date: Thu, 08 Dec 2022 22:46:54 GMT
content-type: application/json; charset=utf-8
server: Kestrel
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://gum.criteo.com
server-processing-duration-in-ticks: 134262
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding
X-Firefox-Spdy: h2