Overview

URLmonthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966/
IP 3.212.250.95 (United States)
ASN#14618 AMAZON-AES
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-31 18:11:38 UTC
StatusLoading report..
IDS alerts0
Blocklist alert6
urlquery alerts No alerts detected
Tags None

Domain Summary (34)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-30 17:13:18 UTC 34.117.237.239
cdnjs.cloudflare.com (2) 235 2012-05-23 12:49:49 UTC 2023-01-31 02:26:46 UTC 104.17.24.14
ldsapi.tmginteractive.com (4) 85617 2017-02-02 01:31:46 UTC 2023-01-30 18:07:02 UTC 209.151.244.116
www.google-analytics.com (1) 40 2012-05-21 09:41:50 UTC 2023-01-31 02:52:03 UTC 142.250.74.110
cdn.trustedform.com (2) 24659 2020-08-26 23:38:48 UTC 2023-01-31 07:45:59 UTC 54.230.111.103
monthlysweeps.us (14) 0 2017-12-18 20:14:21 UTC 2023-01-30 18:06:59 UTC 107.23.100.94 Unknown ranking
fonts.googleapis.com (1) 8877 2012-05-23 12:41:44 UTC 2023-01-30 20:34:06 UTC 142.250.74.106
ocsp.usertrust.com (1) 899 2012-05-21 15:43:18 UTC 2023-01-30 17:12:24 UTC 172.64.155.188
ocsp.pki.goog (12) 175 2017-06-14 07:23:31 UTC 2023-01-30 17:12:02 UTC 142.250.74.131
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-30 17:15:40 UTC 54.186.169.128
api.trustedform.com (2) 23021 2012-10-29 05:30:13 UTC 2023-01-31 07:45:59 UTC 67.202.17.219
deviceid.trueleadid.com (1) 2097 2018-07-10 05:19:41 UTC 2023-01-31 07:46:00 UTC 52.0.161.213
use.fontawesome.com (3) 942 2017-01-30 04:43:25 UTC 2023-01-30 17:13:19 UTC 172.64.133.15
create.leadid.com (3) 14598 2014-01-22 13:55:11 UTC 2023-01-31 07:45:59 UTC 34.203.172.198
tmgassets.azureedge.net (10) 0 2022-06-26 22:01:19 UTC 2023-01-30 18:07:01 UTC 13.107.238.53 Domain (azureedge.net) ranked at: 2986
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-30 22:05:30 UTC 34.120.237.76
script.hotjar.com (1) 887 2020-11-05 10:14:15 UTC 2023-01-31 02:55:38 UTC 54.230.111.79
www.google.com (1) 7 2012-11-08 00:08:21 UTC 2023-01-31 02:27:44 UTC 142.250.74.164
fonts.gstatic.com (3) 0 2014-04-02 10:51:04 UTC 2023-01-31 02:51:47 UTC 142.250.74.35 Domain (gstatic.com) ranked at: 540
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-30 17:12:02 UTC 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-30 17:40:18 UTC 34.160.144.191
ocsp.sca1b.amazontrust.com (5) 1015 2016-02-14 02:37:56 UTC 2019-03-27 04:05:54 UTC 54.230.245.110
cdn.jsdelivr.net (2) 439 2012-09-30 00:15:09 UTC 2023-01-30 17:47:48 UTC 151.101.129.229
ocsp.digicert.com (7) 86 2012-05-21 07:02:23 UTC 2023-01-31 01:22:54 UTC 93.184.220.29
code.jquery.com (1) 634 2012-05-21 17:28:02 UTC 2023-01-30 17:12:05 UTC 69.16.175.42
www.gstatic.com (1) 0 2012-05-29 15:36:17 UTC 2023-01-31 02:54:40 UTC 142.250.74.35 Domain (gstatic.com) ranked at: 540
stats.g.doubleclick.net (1) 96 2012-07-01 17:13:23 UTC 2023-01-31 01:52:49 UTC 64.233.162.154
in.hotjar.com (1) 1746 2018-07-03 09:33:18 UTC 2023-01-30 17:13:17 UTC 99.80.223.252
ocsp.globalsign.com (1) 2075 2012-05-25 06:20:55 UTC 2023-01-30 17:21:08 UTC 104.18.20.226
pbid.pro-market.net (1) 6233 2012-10-30 05:59:16 UTC 2023-01-31 15:13:33 UTC 107.178.240.89
r3.o.lencr.org (7) 344 2020-12-02 08:52:13 UTC 2023-01-30 17:12:04 UTC 23.36.77.32
create.lidstatic.com (1) 24133 2015-09-23 19:42:02 UTC 2023-01-31 07:45:59 UTC 104.22.39.182
stackpath.bootstrapcdn.com (2) 2467 2018-04-05 04:41:29 UTC 2023-01-30 23:28:58 UTC 104.18.10.207
static.hotjar.com (1) 641 2014-11-01 05:14:27 UTC 2023-01-30 17:12:04 UTC 54.230.111.113

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-31 2 monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/assets/js/datepicker.js Phishing
2023-01-31 2 monthlysweeps.us/go/api/zip/undefined?get_param=value Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 3.212.250.95
Date UQ / IDS / BL URL IP
2023-02-06 21:11:00 +0000 0 - 0 - 3 monthlysweeps.us/go/to/cabunn/key/4c0aa3ee841 (...) 3.212.250.95
2023-02-06 18:55:48 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:46 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:29 +0000 0 - 0 - 6 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:51:43 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/1b23ce61749 (...) 3.212.250.95


Last 5 reports on ASN: AMAZON-AES
Date UQ / IDS / BL URL IP
2023-03-23 22:56:02 +0000 0 - 0 - 25 aboutfbmetarightviolaition.com/0BpKyN 52.2.56.64
2023-03-23 22:25:23 +0000 0 - 0 - 1 megahelp.net/verif-datainf-username-acc-rbunc (...) 3.210.1.197
2023-03-23 21:56:31 +0000 0 - 0 - 7 networkcuratedreporting.com/22650-162381/unsu (...) 54.167.34.126
2023-03-23 21:53:00 +0000 0 - 1 - 0 online-banking.kb4.io/XV1Vwdk9FRlRNM2xtVkVKWk (...) 44.207.93.179
2023-03-23 21:49:49 +0000 0 - 0 - 2 www1.naturalmedi.co/?tm=1&subid4=1668677353.0 (...) 34.226.92.49


Last 5 reports on domain: monthlysweeps.us
Date UQ / IDS / BL URL IP
2023-03-22 12:15:28 +0000 0 - 0 - 2 monthlysweeps.us/go/to/59bdf0/key/b8253255ad5 (...) 3.228.163.244
2023-03-22 10:25:29 +0000 0 - 0 - 3 monthlysweeps.us/go/to/4mmjuy/key/fddbe96e828 (...) 3.228.163.244
2023-03-20 22:57:45 +0000 0 - 0 - 1 monthlysweeps.us/go/to/e91247/key/3f3e591250a (...) 54.144.195.192
2023-03-20 22:15:00 +0000 0 - 0 - 2 monthlysweeps.us/go/to/e91247/key/3f3e591250a (...) 3.228.163.244
2023-03-20 00:16:06 +0000 0 - 0 - 3 monthlysweeps.us/go/to/4mmjuy/key/b0d1864016f (...) 54.144.195.192


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-03-01 00:09:44 +0000 0 - 0 - 6 monthlysweeps.us/go/to/4mmjuy/key/4ca26d0ba76 (...) 3.218.15.210
2023-03-01 00:09:39 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/4ca26d0ba76 (...) 3.222.87.17
2023-02-28 00:20:57 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/b23ae7c999a (...) 3.222.87.17
2023-02-28 00:20:55 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/b23ae7c999a (...) 3.218.15.210
2023-02-28 00:20:52 +0000 0 - 0 - 5 monthlysweeps.us/go/to/4mmjuy/key/b23ae7c999a (...) 3.218.15.210

JavaScript

Executed Scripts (49)

Executed Evals (9)
#1 JavaScript::Eval (size: 15561) - SHA256: d90538b891b0faa88bb08314660918942260c2ace5720f0bb44498bd13171c76
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var r = this || self,
        h = function(p, m) {
            if (!(p = (m = r.trustedTypes, null), m) || !m.createPolicy) return p;
            try {
                p = m.createPolicy("bg", {
                    createHTML: O,
                    createScript: O,
                    createScriptURL: O
                })
            } catch (g) {
                r.console && r.console.error(g.message)
            }
            return p
        },
        O = function(p) {
            return p
        };
    (0, eval)(function(p, m) {
        return (m = h()) && 1 === p.eval(m.createScript("1")) ? function(g) {
            return m.createScript(g)
        } : function(g) {
            return "" + g
        }
    }(r)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var b,l=function(p,m,r,h){for(h=(p|(r=[],0))-1;0<=h;h--)r[(p|0)-1-(h|0)]=m>>8*h&255;return r},Q=function(p,m,r){if(428==m||176==m)p.B[m]?p.B[m].concat(r):p.B[m]=p8(r,p);else{if(p.Y&&191!=m)return;120==m||346==m||443==m||294==m||336==m?p.B[m]||(p.B[m]=mS(p,m,30,r)):p.B[m]=mS(p,m,137,r)}191==m&&(p.l=d(false,32,p),p.Z=void 0)},g0=function(p,m,r,h){function H(){}return r=sz(p,function(g){H&&(m&&I(m),h=g,H(),H=void 0)},(h=void 0,!!m))[0],{invoke:function(g,O,t,F){function k(){h(function(K){I(function(){g(K)})},t)}if(!O)return O=r(t),g&&g(O),O;h?k():(F=H,H=function(){I((F(),k))})}}},r0=function(p,m){(m.push(p[0]<<24|p[1]<<16|p[2]<<8|p[3]),m.push(p[4]<<24|p[5]<<16|p[6]<<8|p[7]),m).push(p[8]<<24|p[9]<<16|p[10]<<8|p[11])},Oz=function(p,m){return(m=J(p),m&128)&&(m=m&127|J(p)<<7),m},mS=function(p,m,r,h,H,g,O,t){return((O=(h=[(H=hk,-97),-76,1,-9,-92,-60,h,-40,38,(t=r&7,-88)],a[p.K](p.Dc)),O)[p.K]=function(F){t+=6+(g=F,7*r),t&=7},O).concat=function(F){return((g=(F=+t+h[t+19&7]*(F=m%16+1,m)*F-57*m*m*g-F*g+57*g*g-4503*g- -4332*m*g+(H()|0)*F+1*m*m*F,void 0),F=h[F],h)[(t+45&7)+(r&2)]=F,h)[t+(r&2)]=-76,F},O},p8=function(p,m,r){return(r=a[m.K](m.eq),r[m.K]=function(){return p},r).concat=function(h){p=h},r},tk=function(p,m,r,h,H){for(H=(h=0,p)[2]|0,p=p[3]|0;14>h;h++)m=m>>>8|m<<24,m+=r|0,r=r<<3|r>>>29,m^=H+1656,p=p>>>8|p<<24,r^=m,p+=H|0,p^=h+1656,H=H<<3|H>>>29,H^=p;return[r>>>24&255,r>>>16&255,r>>>8&255,r>>>0&255,m>>>24&255,m>>>16&255,m>>>8&255,m>>>0&255]},HO=function(p,m,r,h,H){(H=P(p,(h=(H=(m&=(r=m&3,4),R(p)),R)(p),H)),m&&(H=Fe(""+H)),r)&&z(p,h,l(2,H.length)),z(p,h,H)},bY=function(p){return p},eR=function(p,m,r,h,H){if(H=p[0],H==C)m.A=25,m.N(p);else if(H==G){r=p[1];try{h=m.W||m.N(p)}catch(g){w(g,m),h=m.W}r(h)}else if(H==lY)m.N(p);else if(H==X)m.N(p);else if(H==d0){try{for(h=0;h<m.L.length;h++)try{r=m.L[h],r[0][r[1]](r[2])}catch(g){}}catch(g){}(0,p[1])(function(g,O){m.j(g,true,O)},(m.L=[],function(g){(E(m,(g=!m.I.length,[K8])),g)&&A(true,m,false)}))}else{if(H==y)return h=p[2],Q(m,499,p[6]),Q(m,33,h),m.N(p);H==K8?(m.P=[],m.s=[],m.B=null):H==Qb&&"loading"===U.document.readyState&&(m.h=function(g,O){function t(){O||(O=true,g())}U.document.addEventListener("DOMContentLoaded",(O=false,t),u),U.addEventListener("load",t,u)})}},J=function(p){return p.X?oD(p,p.R):d(true,8,p)},DG=function(p,m,r){if(3==p.length){for(r=0;3>r;r++)m[r]+=p[r];for(p=0,r=[13,8,13,12,16,5,3,10,15];9>p;p++)m[3](m,p%3,r[p])}},oD=function(p,m){return(m=m.create().shift(),p.X.create()).length||p.R.create().length||(p.R=void 0,p.X=void 0),m},xE=function(p,m,r,h){try{h=p[((m|0)+2)%3],p[m]=(p[m]|0)-(p[((m|0)+1)%3]|0)-(h|0)^(1==m?h<<r:h>>>r)}catch(H){throw H;}},ID=function(p,m,r){if("object"==(m=typeof p,m))if(p){if(p instanceof Array)return"array";if(p instanceof Object)return m;if((r=Object.prototype.toString.call(p),"[object Window]")==r)return"object";if("[object Array]"==r||"number"==typeof p.length&&"undefined"!=typeof p.splice&&"undefined"!=typeof p.propertyIsEnumerable&&!p.propertyIsEnumerable("splice"))return"array";if("[object Function]"==r||"undefined"!=typeof p.call&&"undefined"!=typeof p.propertyIsEnumerable&&!p.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==m&&"undefined"==typeof p.call)return"object";return m},Y=function(p,m,r){(Q(p,r,m),m)[Qb]=2796},f8=function(p,m,r,h,H,g){if(!p.W){p.G++;try{for(h=(H=(g=p.H,0),void 0);--m;)try{if(r=void 0,p.X)h=oD(p,p.X);else{if((H=P(p,428),H)>=g)break;h=P((r=(Q(p,176,H),R(p)),p),r)}W(false,p,(h&&h[K8]&2048?h(p,m):M(0,p,[v,21,r]),m),false)}catch(O){P(p,216)?M(22,p,O):Q(p,216,O)}if(!m){if(p.H$){f8((p.G--,p),473199118497);return}M(0,p,[v,33])}}catch(O){try{M(22,p,O)}catch(t){w(t,p)}}p.G--}},Jk=function(p,m){return p[m]<<24|p[(m|0)+1]<<16|p[(m|0)+2]<<8|p[(m|0)+3]},aD=function(p,m,r,h,H,g){function O(){if(p.D==p){if(p.B){var t=[y,r,h,void 0,H,g,arguments];if(2==m)var F=A(false,p,(E(p,t),false));else if(1==m){var k=!p.I.length;E(p,t),k&&A(false,p,false)}else F=eR(t,p);return F}H&&g&&H.removeEventListener(g,O,u)}}return O},RD=function(p,m,r){return p.j(function(h){r=h},false,m),r},U=this||self,sz=function(p,m,r,h){return(h=Z[p.substring(0,3)+"_"])?h(p.substring(3),m,r):SR(m,p)},u={passive:true,capture:true},SR=function(p,m){return p(function(r){r(m)}),[function(){return m}]},d=function(p,m,r,h,H,g,O,t,F,k,K,D,e,x){if((x=P(r,428),x)>=r.H)throw[v,31];for(g=(h=(k=(H=x,0),m),r.lX).length;0<h;)F=H>>3,t=r.P[F],K=H%8,e=8-(K|0),e=e<h?e:h,p&&(D=r,D.Z!=H>>6&&(D.Z=H>>6,O=P(D,191),D.C=tk([0,0,O[1],O[2]],D.Z,D.l)),t^=r.C[F&g]),k|=(t>>8-(K|0)-(e|0)&(1<<e)-1)<<(h|0)-(e|0),h-=e,H+=e;return Q(r,428,(p=k,(x|0)+(m|0))),p},I=U.requestIdleCallback?function(p){requestIdleCallback(function(){p()},{timeout:4})}:U.setImmediate?function(p){setImmediate(p)}:function(p){setTimeout(p,0)},cO=function(p,m,r,h,H,g){for(H=(r=R((m=(h=(g=p[q0]||{},R(p)),g.W$=R(p),g.V=[],p.D==p)?(J(p)|0)-1:1,p)),0);H<m;H++)g.V.push(R(p));for(g.B$=P(p,r);m--;)g.V[m]=P(p,g.V[m]);return g.o=P(p,h),g},n8=function(p,m,r,h,H){for(H=(p.eq=(p.Dc=(p.P$=(p.k6=(p.lX=p[G],zz),PO),C8(p.K,{get:function(){return this.concat()}})),a[p.K](p.Dc,{value:{value:{}}})),h=0,[]);393>h;h++)H[h]=String.fromCharCode(h);(E(p,(E(p,(E(p,(Y(p,function(g){w0(g,1)},(Y(p,(Q(p,51,(Y(p,(Q((Y((Y(p,(Q(p,294,((Y(p,(Y(p,function(g,O,t){W(false,g,O,true)||(O=R(g),t=R(g),Q(g,t,function(F){return eval(F)}(Tz(P(g.D,O)))))},(Y((Q(p,460,(Y(p,(Y(p,function(g,O){(g=(O=R(g),P(g.D,O)),g)[0].removeEventListener(g[1],g[2],u)},((p.Qw=(Y(p,(Y(p,(Q(p,82,(Y(p,(Y(p,(Y(p,(Y(p,(((Q(p,346,(Q(p,(Y(p,(Q(p,120,[(Y(p,function(g,O,t){Q(g,(t=R(g),O=R(g),O),""+P(g,t))},(Q((Q(p,33,(Y(p,(Q(p,49,(Y((Y(p,function(g,O,t,F){Q(g,(F=P(g,(O=(t=(F=R((O=R(g),g)),R)(g),P)(g,O),F)),t),O in F|0)},(Y(p,function(){},(Q(p,443,(Q((Q(p,(p.Y=!((p.O=1,p.g=0,p.X=(p.G=0,h=(p.J=0,p.S=0,p.P=[],p.mQ=[],(p.KS=function(g){this.D=g},p).C=void 0,p.F=0,(p.u=false,p).D=p,p.l=void 0,((p.pS=(p.v=((p.s=[],p).R=(p.L=[],void 0),p.h=null,8001),0),p.Im=false,p).W=void 0,p.I=[],p).B=(p.H=0,p.T=void 0,p.A=(p.Z=void 0,25),[]),window.performance||{}),void 0),p).Zc=h.timeOrigin||(h.timing||{}).navigationStart||0,1),428),0),p),176,0),[])),306)),44)),p),function(g,O,t,F,k,K,D){for(F=(D=P(g,(t=(K=R(g),k=Oz(g),""),281)),D.length),O=0;k--;)O=((O|0)+(Oz(g)|0))%F,t+=H[D[O]];Q(g,K,t)},9),2048)),function(g,O,t,F){(t=(F=R(g),R(g)),O=R(g),g).D==g&&(O=P(g,O),t=P(g,t),P(g,F)[t]=O,191==F&&(g.Z=void 0,2==t&&(g.l=d(false,32,g),g.Z=void 0)))}),328),{})),p),0,p),329)),160),0,0]),function(g,O,t,F){Q(g,(t=P(g,(F=P(g,(O=(t=R(g),R)(g),O)),t)),O),F+t)}),104),Y(p,function(g,O,t,F,k,K){W(false,g,O,true)||(F=cO(g.D),K=F.B$,O=F.W$,t=F.V,F=F.o,k=t.length,K=0==k?new K[F]:1==k?new K[F](t[0]):2==k?new K[F](t[0],t[1]):3==k?new K[F](t[0],t[1],t[2]):4==k?new K[F](t[0],t[1],t[2],t[3]):2(),Q(g,O,K))},299),Y(p,function(g){HO(g,3)},455),Y(p,function(g,O,t,F,k){for(k=(t=Oz((F=R(g),g)),O=0,[]);O<t;O++)k.push(J(g));Q(g,F,k)},219),216),644),B(4))),p).w_=0,Y)(p,function(g,O,t,F){Q(g,(F=(O=(t=R(g),R)(g),R(g)),F),P(g,t)||P(g,O))},393),function(g,O){Gz((O=P(g,R(g)),g).D,O)}),343),function(g){w0(g,4)}),217),function(g,O,t,F){Q(g,(O=P(g,(t=(t=R((O=R(g),g)),F=R(g),P(g,t)),O))==t,F),+O)}),462),function(g,O,t,F){!W(false,g,O,true)&&(O=cO(g),F=O.o,t=O.B$,g.D==g||F==g.KS&&t==g)&&(Q(g,O.W$,F.apply(t,O.V)),g.g=g.i())}),363),0)),function(g){HO(g,4)}),486),function(g,O,t,F){Q(g,(F=(t=P((t=(F=R(g),R(g)),O=R(g),g),t),P(g,F)),O),F[t])}),340),0),p).Sq=0,171)),function(g,O,t){0!=P((t=P(g,(t=(O=R(g),R(g)),t)),g),O)&&Q(g,428,t)}),88),U)),Y(p,function(g,O,t,F){if(t=g.mQ.pop()){for(O=J(g);0<O;O--)F=R(g),t[F]=g.B[F];g.B=(t[294]=g.B[294],t[49]=g.B[49],t)}else Q(g,428,g.H)},424),p),function(g){Xe(g,4)},373),94)),function(g,O,t,F){Q(g,(O=(F=R(g),t=J(g),R)(g),O),P(g,F)>>>t)}),206),Y)(p,function(g,O,t,F,k,K){if(!W(true,g,O,true)){if(g=P((k=(K=(O=R((F=R(g),g)),R)(g),k=R(g),O=P(g,O),K=P(g,K),P(g,k)),g),F),"object"==ID(g)){for(t in F=[],g)F.push(t);g=F}for(F=(K=(t=g.length,0<K?K:1),0);F<t;F+=K)O(g.slice(F,(F|0)+(K|0)),k)}},202),[])),function(g,O,t){Q(g,(t=ID((t=P(g,(O=(t=R(g),R)(g),t)),t)),O),t)}),249),p),function(g,O,t,F,k,K,D,e,x,f,q,S){function n(c,T){for(;S<c;)D|=J(g)<<S,S+=8;return T=D&((S-=c,1)<<c)-1,D>>=c,T}for(x=(f=O=(q=(t=((D=S=(K=R(g),0),n)(3)|0)+1,n(5)),0),[]);O<q;O++)k=n(1),x.push(k),f+=k?0:1;for(F=(O=((f|0)-1).toString(2).length,[]),f=0;f<q;f++)x[f]||(F[f]=n(O));for(O=0;O<q;O++)x[O]&&(F[O]=R(g));for(e=[];t--;)e.push(P(g,R(g)));Y(g,function(c,T,L,V,kE){for(V=[],L=0,kE=[];L<q;L++){if(!(T=F[L],x)[L]){for(;T>=V.length;)V.push(R(c));T=V[T]}kE.push(T)}(c.X=p8(e.slice(),c),c).R=p8(kE,c)},K)},181),p),336,[0,0,0]),function(g,O,t,F,k){t=(O=P(g,(F=P(g,(k=(k=R((F=R((t=R(g),O=R(g),g)),g)),P(g,k)),F)),O)),P(g.D,t)),0!==t&&(k=aD(g,1,F,k,t,O),t.addEventListener(O,k,u),Q(g,82,[t,O,k]))}),354),0)),function(g,O,t,F,k){Q(g,(k=(O=(t=P(g,(k=(O=R((F=R(g),t=R(g),g)),R(g)),t)),P(g,O)),P(g,k)),F),aD(g,k,t,O))}),501),210)),[Qb])),[X,r])),[d0,m])),A)(true,p,true)},Ez=function(p,m,r,h){return P(p,(Q(p,(f8((h=P(p,428),p.P&&h<p.H?(Q(p,428,p.H),Gz(p,r)):Q(p,428,r),p),m),428),h),33))},w0=function(p,m,r,h){z(p,(h=R(p),r=R(p),r),l(m,P(p,h)))},W=function(p,m,r,h,H,g,O,t,F){if((m.D=(m.O+=(t=(g=(H=4==(F=(h||m.T++,0<m.F&&m.u&&m.Im&&1>=m.G&&!m.X&&!m.h&&(!h||1<m.v-r)&&0==document.hidden),m.T))||F?m.i():m.g,g-m.g),O=t>>14,m.l&&(m.l^=O*(t<<2)),O),O||m.D),H)||F)m.g=g,m.T=0;if(!F||g-m.S<m.F-(p?255:h?5:2))return false;return!(Q(m,428,(m.v=r,p=P(m,h?176:428),m.H)),m.I.push([lY,p,h?r+1:r]),m.h=I,0)},Xe=function(p,m,r,h){for(r=R(p),h=0;0<m;m--)h=h<<8|J(p);Q(p,r,h)},B=function(p,m){for(m=[];p--;)m.push(255*Math.random()|0);return m},Fe=function(p,m,r,h,H){for(H=(h=(p=p.replace(/\\r\\n/g,"\\n"),r=0),[]);r<p.length;r++)m=p.charCodeAt(r),128>m?H[h++]=m:(2048>m?H[h++]=m>>6|192:(55296==(m&64512)&&r+1<p.length&&56320==(p.charCodeAt(r+1)&64512)?(m=65536+((m&1023)<<10)+(p.charCodeAt(++r)&1023),H[h++]=m>>18|240,H[h++]=m>>12&63|128):H[h++]=m>>12|224,H[h++]=m>>6&63|128),H[h++]=m&63|128);return H},P=function(p,m){if(void 0===(p=p.B[m],p))throw[v,30,m];if(p.value)return p.create();return p.create(1*m*m+-76*m+79),p.prototype},z=function(p,m,r,h,H,g){if(p.D==p)for(H=P(p,m),346==m?(m=function(O,t,F,k){if((k=(F=H.length,F|0)-4>>3,H.iX)!=k){k=(t=[0,0,g[1],(H.iX=k,g)[2]],k<<3)-4;try{H.am=tk(t,Jk(H,(k|0)+4),Jk(H,k))}catch(K){throw K;}}H.push(H.am[F&7]^O)},g=P(p,336)):m=function(O){H.push(O)},h&&m(h&255),p=r.length,h=0;h<p;h++)m(r[h])},Gz=function(p,m){(p.mQ.push(p.B.slice()),p).B[428]=void 0,Q(p,428,m)},Ak=function(p,m,r,h){for(;p.I.length;){h=(p.h=null,p.I.pop());try{r=eR(h,p)}catch(H){w(H,p)}if(m&&p.h){m=p.h,m(function(){A(true,p,true)});break}}return r},Z,E=function(p,m){p.I.splice(0,0,m)},w=function(p,m){m.W=((m.W?m.W+"~":"E:")+p.message+":"+p.stack).slice(0,2048)},A=function(p,m,r,h,H,g){if(m.I.length){m.Im=(m.u=(m.u&&0(),true),p);try{g=m.i(),m.T=0,m.S=g,m.g=g,h=Ak(m,p),H=m.i()-m.S,m.J+=H,H<(r?0:10)||0>=m.A--||(H=Math.floor(H),m.s.push(254>=H?H:254))}finally{m.u=false}return h}},R=function(p,m){if(p.X)return oD(p,p.R);return m=d(true,8,p),m&128&&(m^=128,p=d(true,2,p),m=(m<<2)+(p|0)),m},yb=function(p,m){if((m=(p=null,U).trustedTypes,!m)||!m.createPolicy)return p;try{p=m.createPolicy("bg",{createHTML:bY,createScript:bY,createScriptURL:bY})}catch(r){U.console&&U.console.error(r.message)}return p},N=function(p,m,r){r=this;try{n8(this,m,p)}catch(h){w(h,this),m(function(H){H(r.W)})}},M=function(p,m,r,h,H,g){if(!m.Y){if(3<(r=P(m,((p=(0==(h=P(m,((g=void 0,r)&&r[0]===v&&(p=r[1],g=r[2],r=void 0),294)),h.length)&&(H=P(m,176)>>3,h.push(p,H>>8&255,H&255),void 0!=g&&h.push(g&255)),""),r)&&(r.message&&(p+=r.message),r.stack&&(p+=":"+r.stack)),49)),r)){m.D=(g=(p=(r-=(p=p.slice(0,(r|0)-3),(p.length|0)+3),Fe(p)),m.D),m);try{z(m,346,l(2,p.length).concat(p),9)}finally{m.D=g}}Q(m,49,r)}},C8=function(p,m){return a[p](a.prototype,{call:m,floor:m,document:m,pop:m,length:m,parent:m,prototype:m,stack:m,splice:m,replace:m,console:m,propertyIsEnumerable:m})},q0=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),Qb=[],y=(N.prototype.H$=(N.prototype.U="toString",(N.prototype.Gi=void 0,N.prototype).fS=void 0,false),[]),K8=[],C=[],G=[],X=[],v={},lY=[],d0=[],hk=((((b=((r0,B,xE,function(){})(DG),N.prototype),b).Rm=function(){return Math.floor(this.J+(this.i()-this.S))},b.hU=function(p,m,r){return(m^=m<<13,m^=m>>17,(m=(m^m<<5)&r)||(m=1),p)^m},N).prototype.K="create",b.yw=function(p,m,r,h,H){for(H=h=0;H<p.length;H++)h+=p.charCodeAt(H),h+=h<<10,h^=h>>6;return(h=(h+=h<<3,h^=h>>11,p=h+(h<<15)>>>0,new Number(p&(1<<m)-1)),h)[0]=(p>>>m)%r,h},b).j=function(p,m,r,h,H){if(r="array"===ID(r)?r:[r],this.W)p(this.W);else try{H=[],h=!this.I.length,E(this,[C,H,r]),E(this,[G,p,H]),m&&!h||A(m,this,true)}catch(g){w(g,this),p(this.W)}},void 0),a=(b.i=(window.performance||{}).now?function(){return this.Zc+window.performance.now()}:function(){return+new Date},b.N5=(b.g_=function(p,m,r,h,H,g){for(g=H=0,h=[];H<p.length;H++)for(r=r<<m|p[H],g+=m;7<g;)g-=8,h.push(r>>g&255);return h},function(){return Math.floor(this.i())}),v).constructor,PO=((N.prototype.N=function(p,m){return m=(p={},hk=function(){return m==p?79:140},{}),function(r,h,H,g,O,t,F,k,K,D,e,x,f,q,S){m=(k=m,p);try{if(t=r[0],t==X){H=r[1];try{for(O=(h=(e=atob(H),g=0,[]),0);O<e.length;O++)x=e.charCodeAt(O),255<x&&(h[g++]=x&255,x>>=8),h[g++]=x;Q(((this.P=h,this).H=this.P.length<<3,this),191,[0,0,0])}catch(n){M(17,this,n);return}f8(this,8001)}else if(t==C)r[1].push(P(this,49),P(this,443).length,P(this,346).length,P(this,120).length),Q(this,33,r[2]),this.B[225]&&Ez(this,8001,P(this,225));else{if(t==G){D=l((g=r[2],2),(P(this,120).length|0)+2),K=this.D,this.D=this;try{q=P(this,294),0<q.length&&z(this,120,l(2,q.length).concat(q),10),z(this,120,l(1,this.O),109),z(this,120,l(1,this[G].length)),e=0,e-=(P(this,120).length|0)+5,e+=P(this,51)&2047,f=P(this,346),4<f.length&&(e-=(f.length|0)+3),0<e&&z(this,120,l(2,e).concat(B(e)),15),4<f.length&&z(this,120,l(2,f.length).concat(f),156)}finally{this.D=K}if(F=(O=B(2).concat(P(this,120)),O[1]=O[0]^6,O[3]=O[1]^D[0],O[4]=O[1]^D[1],this).X5(O))F="!"+F;else for(F="",e=0;e<O.length;e++)S=O[e][this.U](16),1==S.length&&(S="0"+S),F+=S;return P(this,(P((P(this,(Q(this,49,(h=F,g.shift())),443)).length=g.shift(),this),346).length=g.shift(),120)).length=g.shift(),h}if(t==lY)Ez(this,r[2],r[1]);else if(t==y)return Ez(this,8001,r[1])}}finally{m=k}}}(),N.prototype.uX=0,N.prototype).X5=function(p,m,r,h){if(h=window.btoa){for(m=(r=0,"");r<p.length;r+=8192)m+=String.fromCharCode.apply(null,p.slice(r,r+8192));p=h(m).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else p=void 0;return p},/./);N.prototype.Vw=0;var zz,jR=X.pop.bind((N.prototype[d0]=[0,0,1,1,0,1,1],N.prototype[C])),Tz=((zz=C8((PO[N.prototype.U]=jR,N.prototype.K),{get:jR}),N).prototype.x6=void 0,function(p,m){return(m=yb())&&1===p.eval(m.createScript("1"))?function(r){return m.createScript(r)}:function(r){return""+r}})(U);(Z=U.botguard||(U.botguard={}),40<Z.m||(Z.m=41,Z.bg=g0,Z.a=sz),Z).MDm_=function(p,m,r){return r=new N(p,m),[function(h){return RD(r,h)}]};}).call(this);'));
}).call(this);
#2 JavaScript::Eval (size: 27) - SHA256: 52b43864b9f1786d8c0d2d679562e90dc2a00c9d68ea80188a37d9b01d23dd47
lOptionDocumentNumber_10023
#3 JavaScript::Eval (size: 22) - SHA256: e62188d211f8522a0d02bbc2b5e8fea05d32dd1b03c4602c86673da2007d97dd
0,
function(g) {
    Xe(g, 1)
}
#4 JavaScript::Eval (size: 22) - SHA256: 0af0cb21968fe023d8ea63ee97d9b7172bb86ffeab2023aa51326d793e379a00
0,
function(g) {
    Xe(g, 2)
}
#5 JavaScript::Eval (size: 17278) - SHA256: 7f523fc1da35ff736def11a717a9b6ce2693a18a815ff3c04463c6d16fc99bd1
(function() {
    var b, l = function(p, m, r, h) {
            for (h = (p | (r = [], 0)) - 1; 0 <= h; h--) r[(p | 0) - 1 - (h | 0)] = m >> 8 * h & 255;
            return r
        },
        Q = function(p, m, r) {
            if (428 == m || 176 == m) p.B[m] ? p.B[m].concat(r) : p.B[m] = p8(r, p);
            else {
                if (p.Y && 191 != m) return;
                120 == m || 346 == m || 443 == m || 294 == m || 336 == m ? p.B[m] || (p.B[m] = mS(p, m, 30, r)) : p.B[m] = mS(p, m, 137, r)
            }
            191 == m && (p.l = d(false, 32, p), p.Z = void 0)
        },
        g0 = function(p, m, r, h) {
            function H() {}
            return r = sz(p, function(g) {
                H && (m && I(m), h = g, H(), H = void 0)
            }, (h = void 0, !!m))[0], {
                invoke: function(g, O, t, F) {
                    function k() {
                        h(function(K) {
                            I(function() {
                                g(K)
                            })
                        }, t)
                    }
                    if (!O) return O = r(t), g && g(O), O;
                    h ? k() : (F = H, H = function() {
                        I((F(), k))
                    })
                }
            }
        },
        r0 = function(p, m) {
            (m.push(p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3]), m.push(p[4] << 24 | p[5] << 16 | p[6] << 8 | p[7]), m).push(p[8] << 24 | p[9] << 16 | p[10] << 8 | p[11])
        },
        Oz = function(p, m) {
            return (m = J(p), m & 128) && (m = m & 127 | J(p) << 7), m
        },
        mS = function(p, m, r, h, H, g, O, t) {
            return ((O = (h = [(H = hk, -97), -76, 1, -9, -92, -60, h, -40, 38, (t = r & 7, -88)], a[p.K](p.Dc)), O)[p.K] = function(F) {
                t += 6 + (g = F, 7 * r), t &= 7
            }, O).concat = function(F) {
                return ((g = (F = +t + h[t + 19 & 7] * (F = m % 16 + 1, m) * F - 57 * m * m * g - F * g + 57 * g * g - 4503 * g - -4332 * m * g + (H() | 0) * F + 1 * m * m * F, void 0), F = h[F], h)[(t + 45 & 7) + (r & 2)] = F, h)[t + (r & 2)] = -76, F
            }, O
        },
        p8 = function(p, m, r) {
            return (r = a[m.K](m.eq), r[m.K] = function() {
                return p
            }, r).concat = function(h) {
                p = h
            }, r
        },
        tk = function(p, m, r, h, H) {
            for (H = (h = 0, p)[2] | 0, p = p[3] | 0; 14 > h; h++) m = m >>> 8 | m << 24, m += r | 0, r = r << 3 | r >>> 29, m ^= H + 1656, p = p >>> 8 | p << 24, r ^= m, p += H | 0, p ^= h + 1656, H = H << 3 | H >>> 29, H ^= p;
            return [r >>> 24 & 255, r >>> 16 & 255, r >>> 8 & 255, r >>> 0 & 255, m >>> 24 & 255, m >>> 16 & 255, m >>> 8 & 255, m >>> 0 & 255]
        },
        HO = function(p, m, r, h, H) {
            (H = P(p, (h = (H = (m &= (r = m & 3, 4), R(p)), R)(p), H)), m && (H = Fe("" + H)), r) && z(p, h, l(2, H.length)), z(p, h, H)
        },
        bY = function(p) {
            return p
        },
        eR = function(p, m, r, h, H) {
            if (H = p[0], H == C) m.A = 25, m.N(p);
            else if (H == G) {
                r = p[1];
                try {
                    h = m.W || m.N(p)
                } catch (g) {
                    w(g, m), h = m.W
                }
                r(h)
            } else if (H == lY) m.N(p);
            else if (H == X) m.N(p);
            else if (H == d0) {
                try {
                    for (h = 0; h < m.L.length; h++) try {
                        r = m.L[h], r[0][r[1]](r[2])
                    } catch (g) {}
                } catch (g) {}(0, p[1])(function(g, O) {
                    m.j(g, true, O)
                }, (m.L = [], function(g) {
                    (E(m, (g = !m.I.length, [K8])), g) && A(true, m, false)
                }))
            } else {
                if (H == y) return h = p[2], Q(m, 499, p[6]), Q(m, 33, h), m.N(p);
                H == K8 ? (m.P = [], m.s = [], m.B = null) : H == Qb && "loading" === U.document.readyState && (m.h = function(g, O) {
                    function t() {
                        O || (O = true, g())
                    }
                    U.document.addEventListener("DOMContentLoaded", (O = false, t), u), U.addEventListener("load", t, u)
                })
            }
        },
        J = function(p) {
            return p.X ? oD(p, p.R) : d(true, 8, p)
        },
        DG = function(p, m, r) {
            if (3 == p.length) {
                for (r = 0; 3 > r; r++) m[r] += p[r];
                for (p = 0, r = [13, 8, 13, 12, 16, 5, 3, 10, 15]; 9 > p; p++) m[3](m, p % 3, r[p])
            }
        },
        oD = function(p, m) {
            return (m = m.create().shift(), p.X.create()).length || p.R.create().length || (p.R = void 0, p.X = void 0), m
        },
        xE = function(p, m, r, h) {
            try {
                h = p[((m | 0) + 2) % 3], p[m] = (p[m] | 0) - (p[((m | 0) + 1) % 3] | 0) - (h | 0) ^ (1 == m ? h << r : h >>> r)
            } catch (H) {
                throw H;
            }
        },
        ID = function(p, m, r) {
            if ("object" == (m = typeof p, m))
                if (p) {
                    if (p instanceof Array) return "array";
                    if (p instanceof Object) return m;
                    if ((r = Object.prototype.toString.call(p), "[object Window]") == r) return "object";
                    if ("[object Array]" == r || "number" == typeof p.length && "undefined" != typeof p.splice && "undefined" != typeof p.propertyIsEnumerable && !p.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == r || "undefined" != typeof p.call && "undefined" != typeof p.propertyIsEnumerable && !p.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == m && "undefined" == typeof p.call) return "object";
            return m
        },
        Y = function(p, m, r) {
            (Q(p, r, m), m)[Qb] = 2796
        },
        f8 = function(p, m, r, h, H, g) {
            if (!p.W) {
                p.G++;
                try {
                    for (h = (H = (g = p.H, 0), void 0); --m;) try {
                        if (r = void 0, p.X) h = oD(p, p.X);
                        else {
                            if ((H = P(p, 428), H) >= g) break;
                            h = P((r = (Q(p, 176, H), R(p)), p), r)
                        }
                        W(false, p, (h && h[K8] & 2048 ? h(p, m) : M(0, p, [v, 21, r]), m), false)
                    } catch (O) {
                        P(p, 216) ? M(22, p, O) : Q(p, 216, O)
                    }
                    if (!m) {
                        if (p.H$) {
                            f8((p.G--, p), 473199118497);
                            return
                        }
                        M(0, p, [v, 33])
                    }
                } catch (O) {
                    try {
                        M(22, p, O)
                    } catch (t) {
                        w(t, p)
                    }
                }
                p.G--
            }
        },
        Jk = function(p, m) {
            return p[m] << 24 | p[(m | 0) + 1] << 16 | p[(m | 0) + 2] << 8 | p[(m | 0) + 3]
        },
        aD = function(p, m, r, h, H, g) {
            function O() {
                if (p.D == p) {
                    if (p.B) {
                        var t = [y, r, h, void 0, H, g, arguments];
                        if (2 == m) var F = A(false, p, (E(p, t), false));
                        else if (1 == m) {
                            var k = !p.I.length;
                            E(p, t), k && A(false, p, false)
                        } else F = eR(t, p);
                        return F
                    }
                    H && g && H.removeEventListener(g, O, u)
                }
            }
            return O
        },
        RD = function(p, m, r) {
            return p.j(function(h) {
                r = h
            }, false, m), r
        },
        U = this || self,
        sz = function(p, m, r, h) {
            return (h = Z[p.substring(0, 3) + "_"]) ? h(p.substring(3), m, r) : SR(m, p)
        },
        u = {
            passive: true,
            capture: true
        },
        SR = function(p, m) {
            return p(function(r) {
                r(m)
            }), [function() {
                return m
            }]
        },
        d = function(p, m, r, h, H, g, O, t, F, k, K, D, e, x) {
            if ((x = P(r, 428), x) >= r.H) throw [v, 31];
            for (g = (h = (k = (H = x, 0), m), r.lX).length; 0 < h;) F = H >> 3, t = r.P[F], K = H % 8, e = 8 - (K | 0), e = e < h ? e : h, p && (D = r, D.Z != H >> 6 && (D.Z = H >> 6, O = P(D, 191), D.C = tk([0, 0, O[1], O[2]], D.Z, D.l)), t ^= r.C[F & g]), k |= (t >> 8 - (K | 0) - (e | 0) & (1 << e) - 1) << (h | 0) - (e | 0), h -= e, H += e;
            return Q(r, 428, (p = k, (x | 0) + (m | 0))), p
        },
        I = U.requestIdleCallback ? function(p) {
            requestIdleCallback(function() {
                p()
            }, {
                timeout: 4
            })
        } : U.setImmediate ? function(p) {
            setImmediate(p)
        } : function(p) {
            setTimeout(p, 0)
        },
        cO = function(p, m, r, h, H, g) {
            for (H = (r = R((m = (h = (g = p[q0] || {}, R(p)), g.W$ = R(p), g.V = [], p.D == p) ? (J(p) | 0) - 1 : 1, p)), 0); H < m; H++) g.V.push(R(p));
            for (g.B$ = P(p, r); m--;) g.V[m] = P(p, g.V[m]);
            return g.o = P(p, h), g
        },
        n8 = function(p, m, r, h, H) {
            for (H = (p.eq = (p.Dc = (p.P$ = (p.k6 = (p.lX = p[G], zz), PO), C8(p.K, {get: function() {
                        return this.concat()
                    }
                })), a[p.K](p.Dc, {
                    value: {
                        value: {}
                    }
                })), h = 0, []); 393 > h; h++) H[h] = String.fromCharCode(h);
            (E(p, (E(p, (E(p, (Y(p, function(g) {
                w0(g, 1)
            }, (Y(p, (Q(p, 51, (Y(p, (Q((Y((Y(p, (Q(p, 294, ((Y(p, (Y(p, function(g, O, t) {
                W(false, g, O, true) || (O = R(g), t = R(g), Q(g, t, function(F) {
                    return eval(F)
                }(Tz(P(g.D, O)))))
            }, (Y((Q(p, 460, (Y(p, (Y(p, function(g, O) {
                (g = (O = R(g), P(g.D, O)), g)[0].removeEventListener(g[1], g[2], u)
            }, ((p.Qw = (Y(p, (Y(p, (Q(p, 82, (Y(p, (Y(p, (Y(p, (Y(p, (((Q(p, 346, (Q(p, (Y(p, (Q(p, 120, [(Y(p, function(g, O, t) {
                Q(g, (t = R(g), O = R(g), O), "" + P(g, t))
            }, (Q((Q(p, 33, (Y(p, (Q(p, 49, (Y((Y(p, function(g, O, t, F) {
                Q(g, (F = P(g, (O = (t = (F = R((O = R(g), g)), R)(g), P)(g, O), F)), t), O in F | 0)
            }, (Y(p, function() {}, (Q(p, 443, (Q((Q(p, (p.Y = !((p.O = 1, p.g = 0, p.X = (p.G = 0, h = (p.J = 0, p.S = 0, p.P = [], p.mQ = [], (p.KS = function(g) {
                this.D = g
            }, p).C = void 0, p.F = 0, (p.u = false, p).D = p, p.l = void 0, ((p.pS = (p.v = ((p.s = [], p).R = (p.L = [], void 0), p.h = null, 8001), 0), p.Im = false, p).W = void 0, p.I = [], p).B = (p.H = 0, p.T = void 0, p.A = (p.Z = void 0, 25), []), window.performance || {}), void 0), p).Zc = h.timeOrigin || (h.timing || {}).navigationStart || 0, 1), 428), 0), p), 176, 0), [])), 306)), 44)), p), function(g, O, t, F, k, K, D) {
                for (F = (D = P(g, (t = (K = R(g), k = Oz(g), ""), 281)), D.length), O = 0; k--;) O = ((O | 0) + (Oz(g) | 0)) % F, t += H[D[O]];
                Q(g, K, t)
            }, 9), 2048)), function(g, O, t, F) {
                (t = (F = R(g), R(g)), O = R(g), g).D == g && (O = P(g, O), t = P(g, t), P(g, F)[t] = O, 191 == F && (g.Z = void 0, 2 == t && (g.l = d(false, 32, g), g.Z = void 0)))
            }), 328), {})), p), 0, p), 329)), 160), 0, 0]), function(g, O, t, F) {
                Q(g, (t = P(g, (F = P(g, (O = (t = R(g), R)(g), O)), t)), O), F + t)
            }), 104), Y(p, function(g, O, t, F, k, K) {
                W(false, g, O, true) || (F = cO(g.D), K = F.B$, O = F.W$, t = F.V, F = F.o, k = t.length, K = 0 == k ? new K[F] : 1 == k ? new K[F](t[0]) : 2 == k ? new K[F](t[0], t[1]) : 3 == k ? new K[F](t[0], t[1], t[2]) : 4 == k ? new K[F](t[0], t[1], t[2], t[3]) : 2(), Q(g, O, K))
            }, 299), Y(p, function(g) {
                HO(g, 3)
            }, 455), Y(p, function(g, O, t, F, k) {
                for (k = (t = Oz((F = R(g), g)), O = 0, []); O < t; O++) k.push(J(g));
                Q(g, F, k)
            }, 219), 216), 644), B(4))), p).w_ = 0, Y)(p, function(g, O, t, F) {
                Q(g, (F = (O = (t = R(g), R)(g), R(g)), F), P(g, t) || P(g, O))
            }, 393), function(g, O) {
                Gz((O = P(g, R(g)), g).D, O)
            }), 343), function(g) {
                w0(g, 4)
            }), 217), function(g, O, t, F) {
                Q(g, (O = P(g, (t = (t = R((O = R(g), g)), F = R(g), P(g, t)), O)) == t, F), +O)
            }), 462), function(g, O, t, F) {
                !W(false, g, O, true) && (O = cO(g), F = O.o, t = O.B$, g.D == g || F == g.KS && t == g) && (Q(g, O.W$, F.apply(t, O.V)), g.g = g.i())
            }), 363), 0)), function(g) {
                HO(g, 4)
            }), 486), function(g, O, t, F) {
                Q(g, (F = (t = P((t = (F = R(g), R(g)), O = R(g), g), t), P(g, F)), O), F[t])
            }), 340), 0), p).Sq = 0, 171)), function(g, O, t) {
                0 != P((t = P(g, (t = (O = R(g), R(g)), t)), g), O) && Q(g, 428, t)
            }), 88), U)), Y(p, function(g, O, t, F) {
                if (t = g.mQ.pop()) {
                    for (O = J(g); 0 < O; O--) F = R(g), t[F] = g.B[F];
                    g.B = (t[294] = g.B[294], t[49] = g.B[49], t)
                } else Q(g, 428, g.H)
            }, 424), p), function(g) {
                Xe(g, 4)
            }, 373), 94)), function(g, O, t, F) {
                Q(g, (O = (F = R(g), t = J(g), R)(g), O), P(g, F) >>> t)
            }), 206), Y)(p, function(g, O, t, F, k, K) {
                if (!W(true, g, O, true)) {
                    if (g = P((k = (K = (O = R((F = R(g), g)), R)(g), k = R(g), O = P(g, O), K = P(g, K), P(g, k)), g), F), "object" == ID(g)) {
                        for (t in F = [], g) F.push(t);
                        g = F
                    }
                    for (F = (K = (t = g.length, 0 < K ? K : 1), 0); F < t; F += K) O(g.slice(F, (F | 0) + (K | 0)), k)
                }
            }, 202), [])), function(g, O, t) {
                Q(g, (t = ID((t = P(g, (O = (t = R(g), R)(g), t)), t)), O), t)
            }), 249), p), function(g, O, t, F, k, K, D, e, x, f, q, S) {
                function n(c, T) {
                    for (; S < c;) D |= J(g) << S, S += 8;
                    return T = D & ((S -= c, 1) << c) - 1, D >>= c, T
                }
                for (x = (f = O = (q = (t = ((D = S = (K = R(g), 0), n)(3) | 0) + 1, n(5)), 0), []); O < q; O++) k = n(1), x.push(k), f += k ? 0 : 1;
                for (F = (O = ((f | 0) - 1).toString(2).length, []), f = 0; f < q; f++) x[f] || (F[f] = n(O));
                for (O = 0; O < q; O++) x[O] && (F[O] = R(g));
                for (e = []; t--;) e.push(P(g, R(g)));
                Y(g, function(c, T, L, V, kE) {
                    for (V = [], L = 0, kE = []; L < q; L++) {
                        if (!(T = F[L], x)[L]) {
                            for (; T >= V.length;) V.push(R(c));
                            T = V[T]
                        }
                        kE.push(T)
                    }(c.X = p8(e.slice(), c), c).R = p8(kE, c)
                }, K)
            }, 181), p), 336, [0, 0, 0]), function(g, O, t, F, k) {
                t = (O = P(g, (F = P(g, (k = (k = R((F = R((t = R(g), O = R(g), g)), g)), P(g, k)), F)), O)), P(g.D, t)), 0 !== t && (k = aD(g, 1, F, k, t, O), t.addEventListener(O, k, u), Q(g, 82, [t, O, k]))
            }), 354), 0)), function(g, O, t, F, k) {
                Q(g, (k = (O = (t = P(g, (k = (O = R((F = R(g), t = R(g), g)), R(g)), t)), P(g, O)), P(g, k)), F), aD(g, k, t, O))
            }), 501), 210)), [Qb])), [X, r])), [d0, m])), A)(true, p, true)
        },
        Ez = function(p, m, r, h) {
            return P(p, (Q(p, (f8((h = P(p, 428), p.P && h < p.H ? (Q(p, 428, p.H), Gz(p, r)) : Q(p, 428, r), p), m), 428), h), 33))
        },
        w0 = function(p, m, r, h) {
            z(p, (h = R(p), r = R(p), r), l(m, P(p, h)))
        },
        W = function(p, m, r, h, H, g, O, t, F) {
            if ((m.D = (m.O += (t = (g = (H = 4 == (F = (h || m.T++, 0 < m.F && m.u && m.Im && 1 >= m.G && !m.X && !m.h && (!h || 1 < m.v - r) && 0 == document.hidden), m.T)) || F ? m.i() : m.g, g - m.g), O = t >> 14, m.l && (m.l ^= O * (t << 2)), O), O || m.D), H) || F) m.g = g, m.T = 0;
            if (!F || g - m.S < m.F - (p ? 255 : h ? 5 : 2)) return false;
            return !(Q(m, 428, (m.v = r, p = P(m, h ? 176 : 428), m.H)), m.I.push([lY, p, h ? r + 1 : r]), m.h = I, 0)
        },
        Xe = function(p, m, r, h) {
            for (r = R(p), h = 0; 0 < m; m--) h = h << 8 | J(p);
            Q(p, r, h)
        },
        B = function(p, m) {
            for (m = []; p--;) m.push(255 * Math.random() | 0);
            return m
        },
        Fe = function(p, m, r, h, H) {
            for (H = (h = (p = p.replace(/\r\n/g, "\n"), r = 0), []); r < p.length; r++) m = p.charCodeAt(r), 128 > m ? H[h++] = m : (2048 > m ? H[h++] = m >> 6 | 192 : (55296 == (m & 64512) && r + 1 < p.length && 56320 == (p.charCodeAt(r + 1) & 64512) ? (m = 65536 + ((m & 1023) << 10) + (p.charCodeAt(++r) & 1023), H[h++] = m >> 18 | 240, H[h++] = m >> 12 & 63 | 128) : H[h++] = m >> 12 | 224, H[h++] = m >> 6 & 63 | 128), H[h++] = m & 63 | 128);
            return H
        },
        P = function(p, m) {
            if (void 0 === (p = p.B[m], p)) throw [v, 30, m];
            if (p.value) return p.create();
            return p.create(1 * m * m + -76 * m + 79), p.prototype
        },
        z = function(p, m, r, h, H, g) {
            if (p.D == p)
                for (H = P(p, m), 346 == m ? (m = function(O, t, F, k) {
                        if ((k = (F = H.length, F | 0) - 4 >> 3, H.iX) != k) {
                            k = (t = [0, 0, g[1], (H.iX = k, g)[2]], k << 3) - 4;
                            try {
                                H.am = tk(t, Jk(H, (k | 0) + 4), Jk(H, k))
                            } catch (K) {
                                throw K;
                            }
                        }
                        H.push(H.am[F & 7] ^ O)
                    }, g = P(p, 336)) : m = function(O) {
                        H.push(O)
                    }, h && m(h & 255), p = r.length, h = 0; h < p; h++) m(r[h])
        },
        Gz = function(p, m) {
            (p.mQ.push(p.B.slice()), p).B[428] = void 0, Q(p, 428, m)
        },
        Ak = function(p, m, r, h) {
            for (; p.I.length;) {
                h = (p.h = null, p.I.pop());
                try {
                    r = eR(h, p)
                } catch (H) {
                    w(H, p)
                }
                if (m && p.h) {
                    m = p.h, m(function() {
                        A(true, p, true)
                    });
                    break
                }
            }
            return r
        },
        Z, E = function(p, m) {
            p.I.splice(0, 0, m)
        },
        w = function(p, m) {
            m.W = ((m.W ? m.W + "~" : "E:") + p.message + ":" + p.stack).slice(0, 2048)
        },
        A = function(p, m, r, h, H, g) {
            if (m.I.length) {
                m.Im = (m.u = (m.u && 0(), true), p);
                try {
                    g = m.i(), m.T = 0, m.S = g, m.g = g, h = Ak(m, p), H = m.i() - m.S, m.J += H, H < (r ? 0 : 10) || 0 >= m.A-- || (H = Math.floor(H), m.s.push(254 >= H ? H : 254))
                } finally {
                    m.u = false
                }
                return h
            }
        },
        R = function(p, m) {
            if (p.X) return oD(p, p.R);
            return m = d(true, 8, p), m & 128 && (m ^= 128, p = d(true, 2, p), m = (m << 2) + (p | 0)), m
        },
        yb = function(p, m) {
            if ((m = (p = null, U).trustedTypes, !m) || !m.createPolicy) return p;
            try {
                p = m.createPolicy("bg", {
                    createHTML: bY,
                    createScript: bY,
                    createScriptURL: bY
                })
            } catch (r) {
                U.console && U.console.error(r.message)
            }
            return p
        },
        N = function(p, m, r) {
            r = this;
            try {
                n8(this, m, p)
            } catch (h) {
                w(h, this), m(function(H) {
                    H(r.W)
                })
            }
        },
        M = function(p, m, r, h, H, g) {
            if (!m.Y) {
                if (3 < (r = P(m, ((p = (0 == (h = P(m, ((g = void 0, r) && r[0] === v && (p = r[1], g = r[2], r = void 0), 294)), h.length) && (H = P(m, 176) >> 3, h.push(p, H >> 8 & 255, H & 255), void 0 != g && h.push(g & 255)), ""), r) && (r.message && (p += r.message), r.stack && (p += ":" + r.stack)), 49)), r)) {
                    m.D = (g = (p = (r -= (p = p.slice(0, (r | 0) - 3), (p.length | 0) + 3), Fe(p)), m.D), m);
                    try {
                        z(m, 346, l(2, p.length).concat(p), 9)
                    } finally {
                        m.D = g
                    }
                }
                Q(m, 49, r)
            }
        },
        C8 = function(p, m) {
            return a[p](a.prototype, {
                call: m,
                floor: m,
                document: m,
                pop: m,
                length: m,
                parent: m,
                prototype: m,
                stack: m,
                splice: m,
                replace: m,
                console: m,
                propertyIsEnumerable: m
            })
        },
        q0 = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        Qb = [],
        y = (N.prototype.H$ = (N.prototype.U = "toString", (N.prototype.Gi = void 0, N.prototype).fS = void 0, false), []),
        K8 = [],
        C = [],
        G = [],
        X = [],
        v = {},
        lY = [],
        d0 = [],
        hk = ((((b = ((r0, B, xE, function() {})(DG), N.prototype), b).Rm = function() {
            return Math.floor(this.J + (this.i() - this.S))
        }, b.hU = function(p, m, r) {
            return (m ^= m << 13, m ^= m >> 17, (m = (m ^ m << 5) & r) || (m = 1), p) ^ m
        }, N).prototype.K = "create", b.yw = function(p, m, r, h, H) {
            for (H = h = 0; H < p.length; H++) h += p.charCodeAt(H), h += h << 10, h ^= h >> 6;
            return (h = (h += h << 3, h ^= h >> 11, p = h + (h << 15) >>> 0, new Number(p & (1 << m) - 1)), h)[0] = (p >>> m) % r, h
        }, b).j = function(p, m, r, h, H) {
            if (r = "array" === ID(r) ? r : [r], this.W) p(this.W);
            else try {
                H = [], h = !this.I.length, E(this, [C, H, r]), E(this, [G, p, H]), m && !h || A(m, this, true)
            } catch (g) {
                w(g, this), p(this.W)
            }
        }, void 0),
        a = (b.i = (window.performance || {}).now ? function() {
            return this.Zc + window.performance.now()
        } : function() {
            return +new Date
        }, b.N5 = (b.g_ = function(p, m, r, h, H, g) {
            for (g = H = 0, h = []; H < p.length; H++)
                for (r = r << m | p[H], g += m; 7 < g;) g -= 8, h.push(r >> g & 255);
            return h
        }, function() {
            return Math.floor(this.i())
        }), v).constructor,
        PO = ((N.prototype.N = function(p, m) {
            return m = (p = {}, hk = function() {
                    return m == p ? 79 : 140
                }, {}),
                function(r, h, H, g, O, t, F, k, K, D, e, x, f, q, S) {
                    m = (k = m, p);
                    try {
                        if (t = r[0], t == X) {
                            H = r[1];
                            try {
                                for (O = (h = (e = atob(H), g = 0, []), 0); O < e.length; O++) x = e.charCodeAt(O), 255 < x && (h[g++] = x & 255, x >>= 8), h[g++] = x;
                                Q(((this.P = h, this).H = this.P.length << 3, this), 191, [0, 0, 0])
                            } catch (n) {
                                M(17, this, n);
                                return
                            }
                            f8(this, 8001)
                        } else if (t == C) r[1].push(P(this, 49), P(this, 443).length, P(this, 346).length, P(this, 120).length), Q(this, 33, r[2]), this.B[225] && Ez(this, 8001, P(this, 225));
                        else {
                            if (t == G) {
                                D = l((g = r[2], 2), (P(this, 120).length | 0) + 2), K = this.D, this.D = this;
                                try {
                                    q = P(this, 294), 0 < q.length && z(this, 120, l(2, q.length).concat(q), 10), z(this, 120, l(1, this.O), 109), z(this, 120, l(1, this[G].length)), e = 0, e -= (P(this, 120).length | 0) + 5, e += P(this, 51) & 2047, f = P(this, 346), 4 < f.length && (e -= (f.length | 0) + 3), 0 < e && z(this, 120, l(2, e).concat(B(e)), 15), 4 < f.length && z(this, 120, l(2, f.length).concat(f), 156)
                                } finally {
                                    this.D = K
                                }
                                if (F = (O = B(2).concat(P(this, 120)), O[1] = O[0] ^ 6, O[3] = O[1] ^ D[0], O[4] = O[1] ^ D[1], this).X5(O)) F = "!" + F;
                                else
                                    for (F = "", e = 0; e < O.length; e++) S = O[e][this.U](16), 1 == S.length && (S = "0" + S), F += S;
                                return P(this, (P((P(this, (Q(this, 49, (h = F, g.shift())), 443)).length = g.shift(), this), 346).length = g.shift(), 120)).length = g.shift(), h
                            }
                            if (t == lY) Ez(this, r[2], r[1]);
                            else if (t == y) return Ez(this, 8001, r[1])
                        }
                    } finally {
                        m = k
                    }
                }
        }(), N.prototype.uX = 0, N.prototype).X5 = function(p, m, r, h) {
            if (h = window.btoa) {
                for (m = (r = 0, ""); r < p.length; r += 8192) m += String.fromCharCode.apply(null, p.slice(r, r + 8192));
                p = h(m).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
            } else p = void 0;
            return p
        }, /./);
    N.prototype.Vw = 0;
    var zz, jR = X.pop.bind((N.prototype[d0] = [0, 0, 1, 1, 0, 1, 1], N.prototype[C])),
        Tz = ((zz = C8((PO[N.prototype.U] = jR, N.prototype.K), {get: jR
        }), N).prototype.x6 = void 0, function(p, m) {
            return (m = yb()) && 1 === p.eval(m.createScript("1")) ? function(r) {
                return m.createScript(r)
            } : function(r) {
                return "" + r
            }
        })(U);
    (Z = U.botguard || (U.botguard = {}), 40 < Z.m || (Z.m = 41, Z.bg = g0, Z.a = sz), Z).MDm_ = function(p, m, r) {
        return r = new N(p, m), [function(h) {
            return RD(r, h)
        }]
    };
}).call(this);
#6 JavaScript::Eval (size: 39) - SHA256: 27598891e8d87679200c05d9b289319626324b3b0d7d5b066a2a7760d5dc8b9a
tmgShowingLiveViewOnly_1338743819 = true;
#7 JavaScript::Eval (size: 14) - SHA256: 0510de046e8325540849bad09f31eaaa3e9256fafd330c5d57327dc948812a33
/*@cc_on!@*/ !1
#8 JavaScript::Eval (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
#9 JavaScript::Eval (size: 64) - SHA256: 2c6fcc10d170735ea0103cebd297129fae592327ed69dbf1773991fe63c4d8d0
0,
function(g, O, t) {
    (O = (t = (O = R(g), R(g)), g.B[O]) && P(g, O), Q)(g, t, O)
}

Executed Writes (2)
#1 JavaScript::Write (size: 830) - SHA256: b53ccfb03c3da5191147522141bf060420c2b3e3f8394fdb413ed7021ed4181e
< script >
    var TrackTime = ['18:11:28.826', '18:11:28.826', '18:11:28.826'] < /script><style>.tmg-loading span{margin:0 auto;display:block;width:130px;font-size:large;font-variant:petite-caps;font-family:initial;text-align:center;}</style > < div id = 'tmgloading'
class = 'tmg-loading' > < span > Loading... < /span></div > < script > function TMG_CheckForClick() {
    try {
        var redirectTo = '#',
            tmpPlacement = '13488000';
        if ('#' != redirectTo) {
            var lurl = decodeURIComponent(redirectTo); - 1 != lurl.indexOf('http://') || -1 != lurl.indexOf('https://') ? window.location.href = lurl : eval(lurl)
        }
    } catch (r) {}
    return !0
} < /script><script src='https:/ / ldsapi.tmginteractive.com / GenericPlacementScriptDiv.aspx ? tmgrt = ancs & mainPlacement = 13488000 & hasLoadOptimation = 0 & hasMinAssets = 1 & placement = 13488000 & publisher = 139136 & affid = 1253169444874966 & subid = 1253169444874966 ' type='
text / javascript '></script>
#2 JavaScript::Write (size: 15083) - SHA256: 7cda1bb319c13f7f3378b86f7c7748f2e68ebbe48e4dc633cbdfc4b91ba8c31e
< style type = 'text/css' > .TMG - Creative - MoreInfo - Container {
        background - color: # fdecd7!important;
        border: 1 px solid # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar {
        background - color: # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar - Icon {
        color: # c4a176!important;
    }.TMG - Creative - MoreInfo - Container a {
        color: # dca926!important;
    }.TmgOffersArea {
        width: 370 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;padding:0px 0px 0px 0px;margin:0px 0px 0px 0px;}.TmgOfferTopSpace{width:370px!important;float:left!important;height:0px!important;}.TmgOfferHeaderImage{width:370px!important;float:left!important;display:none;border:0px solid # FFF!important;
    }.TmgOfferHeaderImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBlankTop {
        width: 370 px!important;float: left!important;margin: 5 px 0 px
    }.TmgOffers {
        width: 370 px!important;float: left!important;
    }.TmgOffer {
        width: 370 px!important;float: left!important;
    }.TmgFloat {
        float: left!important;
    }.TmgOfferVerbiage {
        width: 370 px!important;float: left!important;display: none;padding: 0 px 0 px 0 px 0 px!important;margin: 0 px 0 px 0 px 0 px!important;font - family: Arial,
        Helvetica,
        sans - serif!important;font - weight: normal!important;font - size: 12 px!important;color: #000!important;border-style:0px solid # FFF!important;text - align: left!important;
    }.TmgOfferFooterImage {
        width: 370 px!important;float: left!important;display: none;border: 0 px solid # FFF!important;height: 0 px!important;width: 0 px!important;
    }.TmgOfferFooterImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBottomSpace {
        width: 370 px!important;float: left!important;height: 0 px!important;
    }.tmgCampaignlogoArea {
        display: none;width: 130 px!important;vertical - align: top;float: left!important;background - repeat: no - repeat;
    }.tmgCampaignlogoArea img {
        border: 1 px solid #000000 !important;}.TmgCampaignControlArea{display:block;width:25px!important;vertical-align:top;}.TmgCheckBoxButton{margin:1px 3px!important;}.TmgRadioButton{margin:1px 3px!important;}.tmgControlText{font-family:Sans-Serif!important;font-size:14px!important;font-weight:normal!important;color:# 212529!important;font - variant: normal!important;vertical - align: top!important;vertical - align: middle;display: inline - block;padding: 0 px!important;padding: 0 px 0 px 5 px 1 px;margin - left: 0 px!important;margin - left: -1 px;
    }.TmgCampaignCreativeArea {
        float: left!important;width: 325 px!important;vertical - align: top;display: block;
    }.TmgCampaignCreativeText {
        width: 325 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;text-align:left!important;vertical-align:top!important;display:inline-block!important;overflow: hidden!important;}.TmgAdditionalFieldsArea{float:left!important;display:none;width:325px!important;font-family:Sans-Serif!important;font-variant:normal!important;color:# 212529!important;
    }.TmgBlankArea {
        float: left!important;width: 1 px!important;height: 1 px!important;padding: 0 px!important;margin: 0 px!important;
    }.TMG - Creative - MoreInfo - a - Collapse, .TMG - Creative - MoreInfo - a - Expand {
        cursor: pointer;color: #0000FF;text-decoration:underline;padding:0 5px;}.tmgFieldControlTheme{background-color:none;}.tmgFieldControlThemeRequired{background-color:# FF9999;
    }.TmgCampaignDisclaimer {
        font - size: 9 px!important;
        font - style: italic;
    }.tmgFieldOptionDirectionVertical {
        display: inline - table;
    }.TmgPoweredBy {
        float: left!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #9b9b9b!important;text-align:right!important;width:100%!important;}.TmgPoweredBy .initials-span{font-size:13px!important;}</style><script language= 'javascript'
        type = 'text/javascript' >
        var tmg_GlobalAssetsBaseURL = 'tmgassets.azureedge.net/amsus';
        var tmgPlacement = '13488000',
            tmgPublisher = '139136',
            tmgAffId = '1253169444874966',
            tmgSubId = '1253169444874966',
            tmgSSLKey = 's',
            tmgRedirectTo = '#',
            tmgMyURI = 'ldsapi.tmginteractive.com',
            tmgOfferPreCheck = false,
            tmgNumberOfOfferForPreCheck = 0,
            tmg_arrPreCheckCamps = [],
            tmgIsEmbeddedPlacement = true,
            tmgIsFieldDropOnButtonClick = false,
            tmgIsClientQueryStringPass = false,
            lUSER_PLATFORM = 0,
            lUSER_PLATFORM_SUB = 0,
            lUSER_IP_ADDRESS = '91.90.42.154',
            tmg_UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0',
            tmgHitUniqueKey = '1338743819',
            tmgTrustedFormFlag = false,
            tmgUniversalLeadidFlag = false,
            tmg_ptype = 'Embedded',
            tmg_psectype = 'EMBEDDED',
            tmg_hideCampOnClick = false,
            tmg_NumOfCampShowIntially = 0,
            tmg_ShowCampInBunchFunctionality = false,
            tmg_CampaignInABunch = 0,
            tmg_MainPlacement = '13488000',
            tmgAttachedInfo = 'Firefox;105.0;WinNT',
            tmgMoreInfoContext = '<i class=:SQ:fa fa-plus-circle:SQ: style=:SQ:color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgLessInfoContext = '<i class=:SQ:fa fa-minus-circle:SQ: style=:SQ:color:#A12227!important; font-size:16px!important;font-variant:normal !important;font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgSiteName = 'monthlysweeps.us',
            tmgShowingLiveViewOnly_1338743819 = false,
            UserActivityTrackingSequence = 0,
            tmg_PostLeadOnOpt = false,
            tmgTrustedFormEnabledCampaigns = [],
            gMonths = [],
            gDays = [],
            gYears = [],
            gCountry = [],
            usStates = [],
            caStates = [],
            auStates = []; < /script><script src='https:/ / tmgassets.azureedge.net / amsus / ldsapi / assets / script / standard.min.js ? version = 20220221 n ' type='
        text / javascript '></script><script src='
        https : //tmgassets.azureedge.net/amsus/ldsapi/assets/script/clientfp.min.js?version=20211103' type='text/javascript'></script><script src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common.min.js?version=20230119a' type='text/javascript'></script><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/browserdetect.min.js?version=120419' type='text/javascript'></script><link href='https://tmgassets.azureedge.net/amsus/ns/css/13488000.min.css?2831k31j20232831j01ckl31llk109jkk112800' rel='stylesheet' type='text/css' /><iframe security='restricted' id='tmgPost' height='1' width='1' style='display:none;'></iframe><img id='tmgCallPixelSrc' src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1' width='1' /><div id='TmgOffers' align='left' class='TmgOffersArea' style='display:none;'><div class='TmgOfferTopSpace'></div><div class='TmgOfferHeaderImage' title='&nbsp;'></div><div id='TmgOfferVerbiage13488000' class='TmgOfferVerbiage'></div><div class='TmgOfferBlankTop'></div><div id='tmgDisplayOfferContainer' class='TmgOffers'><div id='TMGOfferTD1' class='TmgOffer TmgOfferTheme' ></div><br class='tmg_ignore_br' style='clear:both;'/></div><div class='TmgOfferFooterImage' title=''></div><div class='TmgOfferBottomSpace'></div><div style='clear:both;'></div></div><div style='display:none;'><div id='TMGOfferTR$10023'><div class='TMGOfferDiv13488000'><div class='tmgOfferArea_CenterLeftLine'><div class='tmgOfferArea_CenterRightLine'><div class='tmgOfferArea_CenterTopLine'><div class='tmgOfferArea_TopLeftCorner'><div class='tmgOfferArea_TopRightCorner'><div class='tmgOfferArea_CenterBottomLine'><div class='tmgOfferArea_BottomLeftCorner'><div class='tmgOfferArea_BottomRightCorner'><div class='TmgBlankArea'></div><div id='TmgCampaignControl$10023' class='TmgFloat TmgCampaignControlTheme'><div align='left' valign='top' style='vertical-align:top!important;' class='TmgCampaignControlArea TmgCampaignControlAreaTheme'><input type='checkbox' id='tmgControl$10023$0' name='tmgControl$10023' class='TmgCheckBoxButton' onClick='javascript:TMG_CheckClick(this);' />&nbsp;</div></div><div id='TmgCampaignCreative$10023' class='TmgCampaignCreativeArea TmgCampaignCreativeAreaTheme'><span class='TmgCampaignCreativeText'><span id='TmgCampaignCreativeSection0' class='TmgCampaignCreativeSection0Theme'><label for='tmgControl$10023$0' style='cursor:pointer;display:inline;'>Get exclusive access to global deals and free apps for your smartphone! </label></span><span id='TmgCampaignCreativeSection1' class='TmgCampaignCreativeSection1Theme'>Sign up for Global and special offers! </span><br class='tmg_ignore_br' style='clear:left;'/><span class='TMG-Creative-MoreInfo-Span' id='CreativeMoreInfo$10023' style='display:none;'>Subscribe us to explore more.&nbsp;<a href='https://ldsapi.tmginteractive.com/pp/' target='_blank'>Privacy Policy</a></span><a class='TMG-Creative-MoreInfo-a-Expand' id='TMGMoreInfoAnchor$10023' onclick='javascript:TMG_ClickForCreativeMoreInfo(this)'><i class='fa fa-plus-circle' style='color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;'></i></a></span></div><br class='tmg_ignore_br' style='clear:both;'/><div id='TmgAdditionalFields$10023' class='TmgAdditionalFieldsArea TmgAdditionalFieldsAreaTheme' style='padding-left:25px'><div><span style='font-size:11px!important;font-weight:normal!important;' name='TmgFieldValidationMsg' id='TmgFieldValidationMsg$10023'>Please complete the following fields:</span></div><div style='height:2px!important;'></div><div id='F_10023_FIRST_NAME_TABLE'><div><span id='F_10023_FIRST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>First Name</span></div><div><input Id='F_10023_FIRST_NAME' name='F_10023_FIRST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_FIRST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_LAST_NAME_TABLE'><div><span id='F_10023_LAST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Last Name</span></div><div><input Id='F_10023_LAST_NAME' name='F_10023_LAST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_LAST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_EMAIL_TABLE'><div><span id='F_10023_EMAIL$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Email</span></div><div><input Id='F_10023_EMAIL' name='F_10023_EMAIL' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_EMAIL'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><input name='F_10023_IP_ADDRESS' Id='F_10023_IP_ADDRESS' type='hidden' value='91.90.42.154'/><div style='height:2px!important;'></div><input name='F_10023_COUNTRY' Id='F_10023_COUNTRY' type='hidden' value=''/><div style='height:2px!important;'></div><input name='F_10023_USER_PLATFORM' Id='F_10023_USER_PLATFORM' type='hidden' value='0'/><div style='height:2px!important;'></div><div><span id='TmgSuccessMsg$10023' name='TmgSuccessMsg' style='font-size:11px!important;'>Once you have completed the required field(s) you will see a success message here.</span></div></div><div id='TmgSpacerTop$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='TmgOffer TmgCampaignSepratorTheme' id='TmgCampaignSepratorId$10023' style='display:none;width:370px;border-bottom: 1px solid #000000!important;'></div><div id='TmgSpacerBottom$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='tmg_ignore_br' style='clear:left;'></div></div></div></div></div></div></div></div></div></div></div></div><input name='hFieldAffId' Id='hFieldAffId' name='hFieldAffId' type='hidden' value='1253169444874966'/><input Id='hTMG_FetchingDataFromQuery' type='hidden' value='0'/><input Id='hTMG_MappedDateFormat' type='hidden' value='0'/><input name='hFieldSubId' Id='hFieldSubId' name='hFieldSubId' type='hidden' value='1253169444874966'/><script language='javascript' type='text/javascript'>var IsPrePingExecuteFromClientScript=false,lCampaigns_out_from_preping=[0],lMappedClientFields='ADDRESS,1,address,NAME--AffId,0,hFieldAffId,ID--CITY,0,city,ID--DATE_OF_BIRTH,2,month^day^year,ID--EMAIL,1,email-address,ID--FIRST_NAME,1,first_name,ID--GENDER,3,title,NAME--LAST_NAME,1,last_name,ID--PHONE,1,phone_number,ID--STATE,0,state,ID--SubId,0,hFieldSubId,ID--ZIP,1,postal_code,ID',lCPL_10023='0.00',lCPLEntryFor_10023='ADMIN',lOptionDocumentNumber_10023='10023/226/0/225',lCampaignFields_10023='F_10023_FIRST_NAME,F_10023_LAST_NAME,F_10023_EMAIL,F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFinalOrderOfCampaignInDisplay='',lTrueTargetedCampaigns='',lFalseTargetedCampaigns='',lNumberOfCampaignsToDisplay='1',lAllCampaigns='10023',lAvoidValidateForIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFieldsContainChildField='',lHiddenFieldIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lAnswerMandatoryFlag=false,lRadioButtonFieldIds='',lCheckBoxFieldIds='',lClientQueryString='',lPrePingCampaigns='',lNumberOfPrepingCampaign='0',lExecuteLines='',lMappedFor_GENDER='Mr~M,Ms~F',lPlacementImpressionOn='LOAD',lCampaignsImpressionOn='LOAD';</script><script language='javascript' type='text/javascript'>try{TMG_DisplayOffers();fn_MoreInfo_Absolute();}catch(ex){}</script><script language='javascript' type='text/javascript'>var oldonload=window.onload;if (typeof window.onload != 'function'){window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();}} else {window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();oldonload();}}</script><script>UserActivityTrackingSequence=1;</script><link href='https://tmgassets.azureedge.net/amsus/ns/assets/awesome-font/font-awesome.css?version=120419' rel='stylesheet' type='text/css' /><script src='https://tmgassets.azureedge.net/amsus/ns/js/13488000.min.js?2831k31j20232831j01ckl31llk109jkk112800' type='text/javascript'></script><style>.tmg-loading{display:none;text-align:center;}</style><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common-extentions.min.js?20230119a' type='text/javascript'></script><input Id='hConditionalStructureData' type='hidden' value=''/><script>try{ TrackTime.push('18:11:28.998','18:11:28.998','18:11:28.998','18:11:29.076','18:11:29.076','18:11:29.076','18:11:29.076','18:11:29.076','18:11:29.076');TrackTime.push(GetDateStringInFormat(new Date(),'hh:mm:ss.fff')) } catch(ex) { }</script>


HTTP Transactions (103)


Request Response
                                        
                                            GET /go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         107.23.100.94
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Tue, 31 Jan 2023 18:11:27 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966/


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F6F1C295C68DFEBADACB1FC812B44E01C7EDE0E203615EF3E2CCED2CE2251E7E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8387
Expires: Tue, 31 Jan 2023 20:31:14 GMT
Date: Tue, 31 Jan 2023 18:11:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4C946A026114FF05316D92277750FACF3D5F5D162839149DA0B7FB1A4CFF6B5E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10871
Expires: Tue, 31 Jan 2023 21:12:38 GMT
Date: Tue, 31 Jan 2023 18:11:27 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 31 Jan 2023 17:43:18 GMT
age: 1689
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    30db107dcf4380cef05efea409c2e6a3
Sha1:   96e6a306fbc07299aba64e5c14e2bfca35872fa9
Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "50D7D516F446458145A304B288A0A39D391CD37EA50DABEA36AE48D291C65BA7"
Last-Modified: Tue, 31 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4989
Expires: Tue, 31 Jan 2023 19:34:36 GMT
Date: Tue, 31 Jan 2023 18:11:27 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: cHvrSRyW/X7C5WBGJj+3m8tyK0ndppNeMNLkGkiX6K9zAPqezBc6YXN90wbd/ugSn9vPW+i3IVA=
x-amz-request-id: PSMJ36SNVCE57CT4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 31 Jan 2023 17:22:18 GMT
age: 2949
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 31 Jan 2023 18:11:27 GMT
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.110
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:27 GMT
Etag: "63d88ced-1d7"
Last-Modified: Tue, 31 Jan 2023 17:07:20 GMT
Server: ECS (dcb/7F3A)
X-Cache: Miss from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 968MAwWwmHnyYkJsXhjYExp3zGja6ksub0k9KDLCDQErMb6QgTHAwg==
Age: 3847

                                        
                                            GET /go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         107.23.100.94
HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
                                        
date: Tue, 31 Jan 2023 18:11:27 GMT
content-length: 302
location: http://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
server: Apache/2.4.41 (Ubuntu)
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   302
Md5:    691aee393bf77ad686ca90bb1ceb0e41
Sha1:   2b9206d20f6207f253c358014ce78f00d52e5dd5
Sha256: e54267d492f3c7e4d10ad2b52292617d52e9a61d0caef67bdd9ecc1219e13795

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 31 Jan 2023 17:41:42 GMT
age: 1785
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         107.23.100.94
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Tue, 31 Jan 2023 18:11:27 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:27 GMT
content-length: 9944
server: Apache/2.4.41 (Ubuntu)
set-cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (939)
Size:   9944
Md5:    1f51084eada26d81d90f26a586696315
Sha1:   0190a617bdbff41187ff416f1d09d37828d7eeef
Sha256: 8661d22125a57551eaeeef536c74092b370e7b406f5ca7f411f7e5885fe50dd0

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A29EE843C8A39551A1507CC6AD949AD509E33AAAE8B72C58AC4884BAD8B0B38E"
Last-Modified: Sun, 29 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3916
Expires: Tue, 31 Jan 2023 19:16:44 GMT
Date: Tue, 31 Jan 2023 18:11:28 GMT
Connection: keep-alive

                                        
                                            GET /ajax/libs/bootstrap-formhelpers/2.3.0/js/bootstrap-formhelpers.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.24.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 58913
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03d8e-46f6d"
last-modified: Mon, 04 May 2020 16:06:38 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 18231862
expires: Sun, 21 Jan 2024 18:11:28 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=90P%2BKkBlYHRJRrbj6tpQEGH9QYOtxzZksgr7E4Baowg7mQ2ekulR2lBdZmN%2B2FVwUJ0iA9O8Ui8Ybp5SSnlM%2Bw9u%2F24Iq6gXALCZun4J31uBr%2FjHHDe2kQEvPSwFKSQ23%2BNQzkFb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 792468f4bb4cb505-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65274)
Size:   58913
Md5:    a63b2977b01b6e2d2e2086c3f63a3c9a
Sha1:   560409f64e40f5078e1ba8d496657badd7a3a6ee
Sha256: 4a477bb786727bd8c49a1dbc25dd37dcce7f2ceece74576dffd8a3da739b034f
                                        
                                            GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.24.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 3413889
expires: Sun, 21 Jan 2024 18:11:28 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tK0gug1lFZPzIUjNV9qamIaOCcbVhLe5Sba3nIBxIruUQbK9e8QA7%2Bx%2Be8tlNhbUkS2CxV9jcFjmXGOYmBA2g0GncNXWpBhrnLLZ7VXT17172q9%2F3659bByLzs%2FOzsP54gvyzL0w"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 792468f4bb5eb505-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (20322)
Size:   6458
Md5:    df9fe6d48e380554eb0ec9687bed3246
Sha1:   207263d754220200c1916edfbda262f62223ecf5
Sha256: 91d57502b7260e6752c2b5f1636d77707929fa9f09da28589691e61816a448f9
                                        
                                            GET /assets/css/datepicker.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 818
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:06 GMT
etag: "d07-5c80ac2c970f8-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3335), with no line terminators
Size:   818
Md5:    3240fc33175e0e388f26fbac8bf8cff3
Sha1:   cf1a645948c9ce996e1560b9569f56822c4f9ba8
Sha256: 9077f43ae19f62f65d930304d4f77d3ce23ec0d4ba41e1284dac8702fbc05f96
                                        
                                            GET /jquery.validation/1.15.0/jquery.validate.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.129.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"58a0-xaL/AT+jV8HSplcbXY5ljmcAgOo"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 31 Jan 2023 18:11:28 GMT
age: 6689278
x-served-by: cache-fra-eddf8230115-FRA, cache-bma1634-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7320
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (22550)
Size:   7320
Md5:    17f3f2c0dd873827d21aec4b7c7da443
Sha1:   e10d2e3deff107d85726cb4f14eee82f96f2594e
Sha256: 5f0adea83e4171c32048eafe7032ef01093d96794c62b988fb9935041e35a998
                                        
                                            GET /assets/css/loading_icon_1.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 580
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:07 GMT
etag: "db0-5c80ac2ce37a0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   580
Md5:    b6b8913a6a3ad6881037667493551ec5
Sha1:   3daae516738f878875bb15766ca06a2ed9ee442b
Sha256: cc46b8ab8bf6a609d0c9336a46ef8b217c15fb2ecdef548c5c4d6ce6ebdb52cf
                                        
                                            GET /assets/css/sweeps.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 1639
server: Apache/2.4.41 (Ubuntu)
last-modified: Fri, 02 Sep 2022 17:56:19 GMT
etag: "172c-5e7b572772120-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   1639
Md5:    a5c77602d9ceb6c6450244ffb0baf0d1
Sha1:   0a8756bf9ec23f2957f9165941196551cc046cf7
Sha256: d1bdae39d462d3c7ccb9f86a413c69df0026d2c06558af9b691a0e98bf0cdd4e
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5743
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:28 GMT
Last-Modified: Tue, 31 Jan 2023 16:35:45 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1429
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:28 GMT
Last-Modified: Tue, 31 Jan 2023 17:47:39 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /jquery-3.3.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         69.16.175.42
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-encoding: gzip
content-length: 30288
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
accept-ranges: bytes
server: nginx
etag: W/"620cd6ff-1538f"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1675188688.dop216.sk1.t,1675188688.cds210.sk1.hn,1675188688.cds240.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   30288
Md5:    d549b312f7a7d228b4ec229a6547dfdc
Sha1:   0766794582ad530ec0f8c2595f741086afffa312
Sha256: f6488b2915e0ceee723f4320492511d46c6ba1860d5975d085e6da8913f55f44
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5743
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:28 GMT
Last-Modified: Tue, 31 Jan 2023 16:35:45 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /jquery.validation/1.15.0/additional-methods.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.129.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"4547-g4rGbD7KxrYTawSb3Q4U8vAilSw"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 31 Jan 2023 18:11:28 GMT
age: 7900769
x-served-by: cache-fra-eddf8230100-FRA, cache-bma1634-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5199
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17590)
Size:   5199
Md5:    4c0e8d136f8e41d83cb99f52be04f280
Sha1:   eecf9c91f361ac05dfaa6b7167aea6f0d4ddf7cd
Sha256: 81659fd2d8cc8d38327f4450954654b19dbb8a95a2b1e402e47869f0ca9dddc6
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1429
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:28 GMT
Last-Modified: Tue, 31 Jan 2023 17:47:39 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /ca/gsatlasr3dvtlsca2022q4 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.20.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "8EC97B4207DA0941A4F6BE2837762A9A54DA7ABC"
Expires: Wed, 01 Feb 2023 05:00:00 GMT
Last-Modified: Tue, 31 Jan 2023 17:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 1102
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792468f5dfe20b49-OSL


--- Additional Info ---
Magic:  data
Size:   1462
Md5:    604ee8cf36e43eddd2388692d8fb2271
Sha1:   1a6230bd1cec3c073e587d2a3742195406119ed2
Sha256: db283d4eaa3be01efff707feb6c9dfdc609daa1afaf9d726ddffb50cb6856504
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4498
Cache-Control: max-age=121952
Date: Tue, 31 Jan 2023 18:11:28 GMT
Etag: "63d8819e-118"
Expires: Thu, 02 Feb 2023 04:04:00 GMT
Last-Modified: Tue, 31 Jan 2023 02:49:02 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /recaptcha/api.js?render=6LdnFqEUAAAAAFM5s_aRoZZO_zDhqoVv6uCdscQi HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.164
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
expires: Tue, 31 Jan 2023 18:11:28 GMT
date: Tue, 31 Jan 2023 18:11:28 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 586
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   586
Md5:    345995eb7414be8743234bd2a40f5ff7
Sha1:   89a948b221aedea093199112ea2d15c44862de94
Sha256: a68ea7e49b9adb7cef571374fd546075e22ff294409bfe3ad21886443eedeb57
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3801
Cache-Control: max-age=154722
Date: Tue, 31 Jan 2023 18:11:28 GMT
Etag: "63d90459-118"
Expires: Thu, 02 Feb 2023 13:10:10 GMT
Last-Modified: Tue, 31 Jan 2023 12:06:49 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: rCfX0C0VrUaHcEVl88Rk0g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         54.186.169.128
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: KYieOh6e5BrPEuMn75bvkduomk4=

                                        
                                            GET /assets/js/datepicker.js HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 5285
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:09 GMT
etag: "42ac-5c80ac2fab258-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (16878)
Size:   5285
Md5:    6c28af1b6fa9301701dfefc5dbfe5159
Sha1:   134cfa1c0a5a837f002034b8ea1a8c6243b96bac
Sha256: 4a47c7c7ccb099528d7387eadcc4989bbbc17d75981507635d015da4711bb932

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /releases/v5.15.4/webfonts/fa-solid-900.woff2 HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.64.133.15
HTTP/2 200 OK
content-type: font/woff2
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 78268
x-amz-id-2: zWA8hxZT28t13oBtYZEO4Asee7h+M8AA9AoAVHAnXO4Ps+qH/NwM0JF77c7cdE1xA1+GivvajLg=
x-amz-request-id: JKBYBVEYK5ACW17C
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:47 GMT
etag: "d824df7eb2e268626a2dd9a6a741ac4e"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 705065
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uYvsn%2FhieEpbVkDRNxo9TDyyaNnwRAae7IBv9GNEdmJ%2FPtbIxF%2FBqa4UTDA6czEIlzjKedztzRWfIyeG72g2SZLSOotbfysjERWXi7p%2B7HLUbu%2FXvdL0xgQr7euihKiEvC0PmZNR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792468f65ea5240e-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 78268, version 331.-31196\012- data
Size:   78268
Md5:    d824df7eb2e268626a2dd9a6a741ac4e
Sha1:   0ccb2c814a7e4ca12c4778821633809cb0361eaa
Sha256: 9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
                                        
                                            GET /assets/img/sweepstakes250/one.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: image/png
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 801
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:31 GMT
etag: "321-5429f55d7e9c0"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   801
Md5:    03744c9d39310c5d2af2cf2a23616580
Sha1:   603f0d70ddc7d77f6341dc0caf9e0740b33ae061
Sha256: afbc2f9fe529022b98f966b254c8d3173a40998fdd01ee3739df99a8a3169a0b
                                        
                                            GET /assets/img/sweepstakes250/two.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: image/png
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 915
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:30 GMT
etag: "393-5429f55c8a780"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   915
Md5:    a1914f8236d7704856f5c5762e86c109
Sha1:   ea40712fad474fab16b7e2f1505bcb42302cd6ec
Sha256: 6c21621aeb7ad165ee758074b65bbf2fa35498a74320a940c52a3208375ef26d
                                        
                                            GET /s/oswald/v49/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17908
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 27 Jan 2023 12:51:14 GMT
expires: Sat, 27 Jan 2024 12:51:14 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 18 Jul 2022 19:23:34 GMT
age: 364814
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 17908, version 1.0\012- data
Size:   17908
Md5:    e46b4e2e3b47cc232937ebf72b4c537e
Sha1:   2675bc06ee643b8c935370325a327efb74746e6a
Sha256: d8543b5dcaea1fc4a0301dc12b5b2adc9079e0794dd6a45879588fb844f3438e
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23040
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 29 Jan 2023 10:25:03 GMT
expires: Mon, 29 Jan 2024 10:25:03 GMT
cache-control: public, max-age=31536000
age: 200785
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23040, version 1.0\012- data
Size:   23040
Md5:    de69cf9e514df447d1b0bb16f49d2457
Sha1:   2ac78601179c3a63ba3f3f3081556b12ddcaf655
Sha256: c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
                                        
                                            GET /assets/img/campaign/1253_welcome.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: image/png
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 258018
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 18:45:24 GMT
etag: "3efe2-5d7ae5a63e210"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 550 x 350, 8-bit/color RGBA, non-interlaced\012- data
Size:   258018
Md5:    4ab082dfa4d24ddc5faa6ae9be0b7e7a
Sha1:   0a66d5fa8c56b01c42656bad7fd0358e35f0b5a7
Sha256: c916d279aa3477141699255e5f01031b8d891bbea0cadf185ddad136866da02b
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 31 Jan 2023 04:29:08 GMT
expires: Wed, 31 Jan 2024 04:29:08 GMT
cache-control: public, max-age=31536000
age: 49340
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23580, version 1.0\012- data
Size:   23580
Md5:    e1b3b5908c9cf23dfb2b9c52b9a023ab
Sha1:   fcd4136085f2a03481d9958cc6793a5ed98e714c
Sha256: 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
                                        
                                            GET /assets/img/campaign/1253_bg.jpg HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
content-length: 474838
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 18:54:27 GMT
etag: "73ed6-5d7ae7abcb0c8"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], progressive, precision 8, 1920x1080, components 3\012- data
Size:   474838
Md5:    9f9ec0bd4b699f784446c17a1273a4ac
Sha1:   e79666717b7b004f554e6bfec1d073b4627ed3a7
Sha256: 9b092cd2a17b5e84e2e12622d1cad8c40f2df0aa44a8b0d7a320a1e1209aca41
                                        
                                            GET /css?family=Lato:400,700|Oswald:400,600,700 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.106
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 31 Jan 2023 18:11:28 GMT
date: Tue, 31 Jan 2023 18:11:28 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   1128
Md5:    765fea11a197b3a8835868a68ac97875
Sha1:   e2db3ef5f94f67a472ae78224a48e5ce7d7d1133
Sha256: c57291e4bd3c788fda911fd8ddc49a9228530e2b0eb5170aa890e259a1ebff4c
                                        
                                            GET /generateplacementscript.aspx?placement=13488000&publisher=139136&affid=1253169444874966&subid=1253169444874966 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:27 GMT
Content-Length: 700


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (852), with CRLF line terminators
Size:   700
Md5:    a0cc6322465c027e490e25cbec52a7ca
Sha1:   0b16cfbad791bd12c91a98b232fe5221a7ef5b1c
Sha256: c7ff4ead94c726731e06ba36238e563e005bb2d6364d4c302bace57b61cf8d38
                                        
                                            GET /GenericPlacementScriptDiv.aspx?tmgrt=ancs&mainPlacement=13488000&hasLoadOptimation=0&hasMinAssets=1&placement=13488000&publisher=139136&affid=1253169444874966&subid=1253169444874966 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:29 GMT
Content-Length: 4846


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (15114), with CRLF line terminators
Size:   4846
Md5:    909e6ba5857589a7c3ba5cfec46471c7
Sha1:   5c947e4e9e601ffac7c825ede7754dbdb9fe5678
Sha256: 232d2c72df78133c733eddfeadb76e61675b20493c0d64d435a0df06d7b13ed8
                                        
                                            GET /amsus/ldsapi/assets/images/spacer.gif HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: image/gif
                                        
content-length: 43
content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 7571bcc7-e01e-0020-46a8-34383f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VkDZYwAAAAAOgDgGafILS6k+UxHut+GrRlJBMjMxMDUwNDE4MDI3ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAABb0TMZkPbNQIv7SEHWkgU+Q1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
                                        
                                            GET /amsus/ns/assets/awesome-font/font-awesome.css?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: text/css
                                        
content-length: 520
content-md5: AExI7hLtZOIj2uUf/9qAyg==
last-modified: Fri, 21 May 2021 11:01:09 GMT
etag: 0x8D91C47BDA9A147
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 2921287b-301e-004f-2f90-3590eb000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VUDZYwAAAAAKo0fRk4bKRo1hkOmsCfdzRlJBMjMxMDUwNDE3MDExADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAAAVFqbveSo7QaKCqiKakEwjQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (520), with no line terminators
Size:   520
Md5:    004c48ee12ed64e223dae51fffda80ca
Sha1:   a3a70b71586d8573a400bd4a2a0eb9bf8ec39c17
Sha256: 735903b0b0ffc434c5dd315d19c20594526dd23bcc44480e69edfbe20f4fb117
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2511
Expires: Tue, 31 Jan 2023 18:53:20 GMT
Date: Tue, 31 Jan 2023 18:11:29 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2511
Expires: Tue, 31 Jan 2023 18:53:20 GMT
Date: Tue, 31 Jan 2023 18:11:29 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2511
Expires: Tue, 31 Jan 2023 18:53:20 GMT
Date: Tue, 31 Jan 2023 18:11:29 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F43ae4cd9-2533-48ae-8086-f8fea8a4e269.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6844
x-amzn-requestid: 0542cf46-5045-459f-a35f-f6c0d3f5f7b7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: flZsxH0YIAMF9ew=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d86feb-692d50f710a131df2ee49aa8;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 01:33:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 6bbFjAsd03GN8zzBnAFBm7xA8igZ_xHJsOHzw7nwNgRxiWUDLPGjpQ==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Tue, 31 Jan 2023 01:53:29 GMT
age: 58680
etag: "dad9e9c3462907a2475046aee36d57f8309cd44e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6844
Md5:    976dda397f9292a498ca9db5599c0378
Sha1:   dad9e9c3462907a2475046aee36d57f8309cd44e
Sha256: 7ed9ccf2ff75ca53f5ba56a1d2127e0f09b0ae941cad8b042e8df01ad01e614b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1295ec36-f5b2-4db1-83c7-667fa373f592.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13853
x-amzn-requestid: ca6ea6e7-3e13-4194-87f5-20a07b813e21
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fk3zzF4hIAMFwWg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d839b1-772487cb1b7495c52c552d36;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 21:42:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: T5CaUojMEG8x8vki59UdIhI8IbbBRY_7w3xgiW3RCZlHTyeHPLIy2Q==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 30 Jan 2023 21:47:13 GMT
age: 73456
etag: "1959fdd94846fa3791c4890578dd15336b909dcc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13853
Md5:    d957012d3e2b8c3bc0eefe11d66e8554
Sha1:   1959fdd94846fa3791c4890578dd15336b909dcc
Sha256: a97e81ec5eb2eda6a603bf4bfd4fa4ef4fab762747479489e99e6c713258a736
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F67cbd807-4e92-4ddb-a8c5-864884d25e99.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11129
x-amzn-requestid: 74f2a4dd-7d5d-4839-90a8-d2e74f6d785d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ffDBZGRPoAMFedg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d5e53b-3de444596550bb41188ada5b;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 03:17:15 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 9Fga247EZZqiGmdMJ72resdBZR2KLgflGDBPESmuw9cFVs4hSzMzTw==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 31 Jan 2023 03:40:17 GMT
age: 52272
etag: "8e315ac5856967286eaa8769e081d827fb4ca39e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11129
Md5:    2797bfd35b7ec24888de84be14f7f2ec
Sha1:   8e315ac5856967286eaa8769e081d827fb4ca39e
Sha256: b99f3bd73eb4395194bc7bb6a1b801750182239e5b70f3207f99e494b60b72ab
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37e3fb86-3315-41fd-97cb-ac82604d8869.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8558
x-amzn-requestid: 2841cd36-22e6-4ecb-b56a-bfadce3197c7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ffB_BFA8IAMFyvA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d5e393-3fd03bd14de762b0738a3b0a;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 03:10:11 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ZP2Mar8l3QoPH733_vv3hUuQjWvaN4_TgfYwme2-6WIxGi55BoSchg==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Tue, 31 Jan 2023 04:26:31 GMT
age: 49498
etag: "04577ad69ee9749b14382254eb5bbf0e1edcd7fa"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8558
Md5:    e6f9ffb8f9e99229b45ca5fdb84ce7d5
Sha1:   04577ad69ee9749b14382254eb5bbf0e1edcd7fa
Sha256: 6111acf3f363123b39d13cd3d23ab39b8c8d00379874f19231d1cd3da17c52c2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F55e9b24d-3c7c-46d8-89b7-084483cc3d1d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12507
x-amzn-requestid: 85c9adcd-b997-48ca-bbfb-ccdeaf3e8cfb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhklyFaJoAMFqKA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e7be-2bcdd8c353d8429d2b1e95f6;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:40:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UDJKl99GiUxTW_EgWFDjLaJZbKFhfaJR-XRLsbQphwHuCXczDlxrDA==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Mon, 30 Jan 2023 21:55:07 GMT
age: 72982
etag: "d60f280f8a742480527dbc32d08f321f972d4fcf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12507
Md5:    5190c0bdc6abe0ee258e9f8c20ddaf51
Sha1:   d60f280f8a742480527dbc32d08f321f972d4fcf
Sha256: 874b38a04aa3736e65aaef72da2cc2efceb208618267107a495bdfe51ec58e58
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F003f28f8-6845-4b0d-8d8d-11c9deea4eaf.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9987
x-amzn-requestid: 67109f87-6073-4991-b540-cdeedc2d7b3c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: flYlPF9uIAMFXMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d86e21-60ac2c7b37c72e6e54a5c69d;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 01:25:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hDjKAMYoVwHdCqS8t08PrWyfQQLiWaosXbi3FOJY8BeV0yAFCGziGw==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Tue, 31 Jan 2023 01:58:16 GMT
age: 58393
etag: "6cf734e2d29938688913daacfb75506d8e004a94"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9987
Md5:    2c4934be94898028e2ab696561b51462
Sha1:   6cf734e2d29938688913daacfb75506d8e004a94
Sha256: 239adcbb538b7a6d1483c65c7694d4a9f9fa9cadf456ab5681c4b764185e3596
                                        
                                            GET /amsus/ns/js/13488000.min.js?2831k31j20232831j01ckl31llk109jkk112800 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: 9wgtvP0cVsloq3UaPunwsA==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4E2F58
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 20681a06-801e-0056-63c7-34bc83000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADXc9yabcUoT7I07S/2+EfFRlJBMjMxMDUwNDE3MDQ5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAADPhLOkj1NYSIxJ3/AZOw1tQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   1348
Md5:    94e5b7655c6f66b91350c1f3830e4496
Sha1:   766dc70e2f236a1d85d4cca5252814979a5be664
Sha256: fe11f600c94b3130a1473a2cc7e937a631dae909417337e3ca845251413b735c
                                        
                                            POST /ManageImpressions/ReportViaJsCampaign.aspx?hKey=1338743819&affid=1253169444874966&subid=1253169444874966&Placement=13488000&Publisher=139136&CurrentCamps=10023.10023/226/0/225&PreviousCamps=&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:30 GMT
Content-Length: 709


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (351), with CRLF line terminators
Size:   709
Md5:    c65dfac2df8dbeda1f1dac6f46dcf590
Sha1:   6dd5bc7f3e951e5d95370bebe9d324c7acf4056f
Sha256: efa642d18265f4858df0aeb82fdd62d6a9fdf6484b9d248dfaa0776aba4023c0
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:30 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 28 Jan 2023 22:10:16 GMT
Expires: Sat, 04 Feb 2023 22:10:15 GMT
Etag: "83ef8a9a1d0d6076e4909a427995c0a1b7d76289"
Cache-Control: max-age=603794,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 725
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792469022fa80b55-OSL

                                        
                                            GET /amsus/ns/js/offers_extended_functions.min.js HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: JsdJsTroZxL3ol3Owm84Vg==
last-modified: Mon, 07 Mar 2022 22:37:07 GMT
etag: 0x8DA008B03257DBD
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 0c441b5d-401e-002d-2942-33d733000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0V0DZYwAAAADvG3BrwOytS6h/tQEsDlOURlJBMjMxMDUwNDE4MDUxADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00lnZYwAAAACpfSfmfoxFQIp56mZvmOhFQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:29 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (349), with CRLF line terminators
Size:   89664
Md5:    01703fe744e4626c3b4234bfcb58defa
Sha1:   79154f339479203a88789c1db098772eb49d75c5
Sha256: bda6b6496a1d598eecafbfe38e44c8ad94aa10be96a4ed36453ce3b36b526f01
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3879
Cache-Control: max-age=97212
Date: Tue, 31 Jan 2023 18:11:30 GMT
Etag: "63d82367-116"
Expires: Wed, 01 Feb 2023 21:11:42 GMT
Last-Modified: Mon, 30 Jan 2023 20:07:03 GMT
Server: ECS (amb/6BBD)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /go/api/zip/undefined?get_param=value HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:30 GMT
content-length: 111
server: Apache/2.4.41 (Ubuntu)
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
set-cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs; path=/; HttpOnly; SameSite=Lax
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   111
Md5:    4072747d6757278fe77c6970474ad27d
Sha1:   7404af04b7ef1db62f26e0a08fe82ab5a184e901
Sha256: 7d911cc2e66702b54cfca359fb39a67a65259e9ed6706c4a78516d20a4670e6f

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.110
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:30 GMT
Etag: "63d83cc6-1d7"
Last-Modified: Tue, 31 Jan 2023 17:07:16 GMT
Server: ECS (dcb/7ECB)
X-Cache: Miss from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 1urU4dRfRiLOrQBm0TG7NsF67C2j4xGSANyY_8O-CeGUvYeTr8R_iQ==
Age: 3854

                                        
                                            GET /recaptcha/releases/RGRQD9tdxHtnt-Bxkx9pM75S/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 163774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 17:09:34 GMT
expires: Tue, 30 Jan 2024 17:09:34 GMT
cache-control: public, max-age=31536000
age: 90116
last-modified: Mon, 23 Jan 2023 01:02:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (771)
Size:   163774
Md5:    57c909ab73fc27ec24f737bbf1cb1de8
Sha1:   89b2c02e9e7a9a764518fca545d3eec2044fd6d9
Sha256: 7e407e2b00bb7c238c71d96472f7ab030de4e610b1048f0f77b25cb85c2d166b
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /trustedform.js?provide_referrer=false&field=trusted_form&l=16751887080570.11189076364028061&invert_field_sensitivity=false HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         67.202.17.219
HTTP/2 301 Moved Permanently
content-type: text/html
                                        
server: awselb/2.0
date: Tue, 31 Jan 2023 18:11:30 GMT
content-length: 134
location: https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=trusted_form&l=16751887080570.11189076364028061&invert_field_sensitivity=false
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.110
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20085
date: Tue, 31 Jan 2023 17:46:59 GMT
expires: Tue, 31 Jan 2023 19:46:59 GMT
cache-control: public, max-age=7200
age: 1471
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1490)
Size:   20085
Md5:    ca7fbbfd120e3e329633044190bbf134
Sha1:   d17f81e03dd827554ddd207ea081fb46b3415445
Sha256: 847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc476411a1fef9074e1b59d6/aid/16944/s1/4874966
Cookie: ci_session=5sl006a2gv8qvmfapf9qodn845vvk1qs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         107.23.100.94
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
                                        
date: Tue, 31 Jan 2023 18:11:30 GMT
content-length: 5430
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:08 GMT
etag: "1536-5c80ac2e78fe8"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   5430
Md5:    b0a102991e7332643ae57365023c00c8
Sha1:   4ea4c55c982e08bda104d2e8e981594c067cef24
Sha256: 1dfc58ffbcb07c761f79eb6b46f50b3789bd21e41a0b4cb1aca82b1dd8020fcc
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /campaign/3cced9a6-4a67-d637-acdc-ccf79b4a5210.js?snippet_version=2 HTTP/1.1 
Host: create.lidstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.22.39.182
HTTP/2 200 OK
content-type: text/javascript
                                        
date: Tue, 31 Jan 2023 18:11:30 GMT
x-amz-id-2: pOrxwmFB6rN/koXnZyiK/CM45FAu5pItvyJ7NchJPd57DJM0JaacUKh6sD8rxFbj8nObu8bhkWY=
x-amz-request-id: 8Q7YA4N3PTY6AC0M
x-amz-replication-status: COMPLETED
last-modified: Fri, 12 Nov 2021 00:55:16 GMT
etag: W/"97495a102c98049f30e62264b1eb50f5"
cache-control: max-age=1800
x-amz-version-id: StKcIVmHluaEF1AzrOc3qrEmwMpZOgwG
cf-cache-status: REVALIDATED
vary: Accept-Encoding
server: cloudflare
cf-ray: 792469028f06f14e-ARN
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   40215
Md5:    b060c6dd2c8d4567a87c4e8490f97dbc
Sha1:   b03ef98b953e17fd340cd05f69c4a28761ec08cb
Sha256: 36522315ce30b2f5893055d7aa6829b0aee2c2f3f3f0bab88f308706c47ad106
                                        
                                            POST /api/hitsnap.ashx HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 10688
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Cache-Control: private
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:31 GMT
Content-Length: 21


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   21
Md5:    8736cdfe08480bca66cffeee06268705
Sha1:   81af0417f969f93848b1cf30fce1db93884facc1
Sha256: 838a7c62adda8d131d694ae13ba2c5b73579aeb0f327d9f23e23880943a8a289
                                        
                                            GET /modules.4b160a4831adaf5337e6.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.79
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 68316
date: Mon, 30 Jan 2023 16:06:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "3315b6999637291711ab85ba678211fa"
last-modified: Mon, 30 Jan 2023 16:05:37 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: UwWIcezqZ_vXaHGJx3253Sv7g2isYGjy46rNTNs6bq2A53HoxWxxOg==
age: 93925
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (48602)
Size:   68316
Md5:    3315b6999637291711ab85ba678211fa
Sha1:   d1bba723aa49e6276dfdb0f1313a9bf0b64be153
Sha256: b3bd4f702044ae91c9227ce2d5c8411d3fec3abb82c9c1b7a9b69d2011c520e5
                                        
                                            GET /bootstrap.js?provide_referrer=false&field=trusted_form&l=16751887080570.11189076364028061&invert_field_sensitivity=false HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://monthlysweeps.us/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.103
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
last-modified: Fri, 06 Jan 2023 16:07:22 GMT
x-amz-version-id: mGsiKszEOvLychB1h9uHpdFpT70J3aoc
etag: W/"90474758772e8fd27bc16a6e21bb75e8"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: lE5vY31WbawyWXfI3_yZaMgRG7Nv1R9m4UEdDpDkJtfunmx3wP9ntw==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   3260
Md5:    e73fc89cd247f6b0b9572488432f64f9
Sha1:   a9d5ee8b46900a2d22eae7a617ad78ac4d1c030d
Sha256: 64ac62a57ffc0e91d04a5b76019669ef8eade3aabd1a82bf64795d3589fc231f
                                        
                                            GET /amsus/ldsapi/assets/script/standard.min.js?version=20220221n HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: YTnb0ehLGLRubF63e3IyDA==
last-modified: Mon, 21 Feb 2022 16:55:53 GMT
etag: 0x8D9F55B05E46BD0
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 813d1e6d-701e-0007-2df5-33a276000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0CwfYYwAAAADr6B/6LcbqQrRvQ6HJOowLRlJBMjMxMDUwNDE4MDM5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAABnpVGpYk41RbLpnSRwjI/BQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (5818), with no line terminators
Size:   2624
Md5:    8fb559b6f888d78a961049de1b734fda
Sha1:   ae74049f409909cb15ae1f29545811431d10e68a
Sha256: 8c4d6dfbf716e0b17d762a273ab7d56719b4995c5e0dfe772db1c689e9bc4998
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.110
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:31 GMT
Last-Modified: Tue, 31 Jan 2023 17:26:11 GMT
Server: ECS (nyb/1D34)
X-Cache: Miss from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: tUiKabgOKBREkLxZ5FGHo6ebDithUb-dfU6oNmvhjLKSRVQ5EzSEVw==
Age: 2720

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-39232759-1&cid=1280317320.1675188710&jid=803003406&gjid=787122954&_gid=1938050173.1675188710&_u=IEBAAEAAAAAAACAAI~&z=115103515 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         64.233.162.154
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://monthlysweeps.us
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 31 Jan 2023 18:11:32 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  very short file (no magic)
Size:   1
Md5:    c4ca4238a0b923820dcc509a6f75849b
Sha1:   356a192b7913b04c54574d18c28d46e6395428ab
Sha256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.110
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=167928
Date: Tue, 31 Jan 2023 18:11:32 GMT
Etag: "63d932d4-1d7"
Expires: Thu, 02 Feb 2023 16:50:20 GMT
Last-Modified: Tue, 31 Jan 2023 15:25:08 GMT
Server: ECS (nyb/1D14)
X-Cache: Miss from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: qOxRKIOl8PLGklBjrby_xsCd966B9CDd-5M-ehdjgJyOO2Yk0qfG4w==
Age: 5112

                                        
                                            POST /2.11.9/GenerateToken?msn=1&pid=a833ebfd-bcf9-438e-8504-2edb751c6c2d&_=882324166 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 250
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.203.172.198
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguserid=24d81e23-eedc-4977-9d6e-53949fc7f0b6; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   1503
Md5:    ca84104a729ae44c3a728ea8dd9b2714
Sha1:   df4f200982f5fb1106aee642286eee16bf941620
Sha256: d6a961287bb330b6e84fa1ab05b9a8c7ba46c57550db1d0cd6f79508dec7c1f3
                                        
                                            POST /certs HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 647
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         67.202.17.219
HTTP/2 201 Created
content-type: application/json; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
content-length: 475
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (475), with no line terminators
Size:   475
Md5:    39e88f75c34aedaafbf806215acbe709
Sha1:   379cd1e93ec8bd3531fb67ea7278ee1644976d1e
Sha256: 600cdf50edaa72529db71e23b5c3977495837b6553dd8e9f9134ec175ee70c70
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.110
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:32 GMT
Last-Modified: Tue, 31 Jan 2023 17:40:43 GMT
Server: ECS (nyb/1D05)
X-Cache: Miss from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: UjJVF0CVavuFnUrutQV7kaydU3in3hvoDnj1Sd1CZVyzSsJNymwRvg==
Age: 1849

                                        
                                            POST /api/v2/client/sites/2865935/visit-data?sv=6 HTTP/1.1 
Host: in.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 115
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         99.80.223.252
HTTP/2 200 OK
content-type: application/json
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   115
Md5:    f5c8f28d5c7f4464281fffd92359a3a8
Sha1:   1ad963dc49289a5a638c3d874d618ec628eb608d
Sha256: 052a741434e75d320ccaa9cb9927aae170fb743aef19c07a29df2fea7080dd64
                                        
                                            POST /2.11.9/InitFormData?msn=3&pid=a833ebfd-bcf9-438e-8504-2edb751c6c2d&token=F93FAF05-A9CC-A398-138E-B65A38EBE56C&_=882324168 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 12844
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.203.172.198
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguserid=f004f1dd-04ce-4172-b258-43040a809e97; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

                                        
                                            GET /releases/v5.15.4/css/solid.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.133.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
x-amz-id-2: /FJXAbedp1VIlYrqoB2JB6BZx9v++c7ZMrDdCivdGOE8KnTHff01jUCIlxGHUAxsWTFnLfBk+1Q=
x-amz-request-id: QNYCK3A2CBK8A5VN
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"685a6b10be9f3db25acf78c5e7ba7379"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 86667
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RigjdFxvqjX0xrOh8k28OUtt03ZV6eIi6OV7LjfSzQQrZJJh81XT2PspsodU%2BlZLrt3ZlxIbFeMdq21LLFVyDXE%2BpwoZq744ulwPNdtbAA5Hk%2FZT1vV0pzWzlVEYMJig6yEfxLkP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792468f5dd06240e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /iframe.html?token=F93FAF05-A9CC-A398-138E-B65A38EBE56C&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=3CCED9A6-4A67-D637-ACDC-CCF79B4A5210&lac=FCB958C1-1AC9-561E-1E7C-7EB79158EEC4 HTTP/1.1 
Host: deviceid.trueleadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         52.0.161.213
HTTP/2 200 OK
content-type: text/html
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
server: nginx
last-modified: Wed, 07 Dec 2022 21:18:32 GMT
etag: W/"63910328-1049"
expires: Wed, 01 Feb 2023 18:11:32 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: max-age=86400, public
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.10.207
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
cdn-edgestorageid: 565, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:05 GMT
cdn-cachedat: 2021-06-08 18:02:12
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: a9c552a6ef500abddb12a9852509d4ed
cdn-status: 200
cdn-cache: HIT
cf-cache-status: HIT
age: 20634841
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 792468f5ca02b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /releases/v5.15.4/css/fontawesome.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.133.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
x-amz-id-2: DmO/rUyFGqR1Xh8ZUpFVohVdWnsG4SUQ9W1HZtBIlpCR48bGIoVZ7SYrsfP0m+mtewoznTqX0ZQ=
x-amz-request-id: QNYDQFQX87AB4JC4
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"a227f005fa7ae066c1068ac4b963514c"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 86667
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vLaRYkS8iRHWGbeIhP6OXAeJPB61HiXPlvcBfWx%2F8saMa6bmE6xwO4CqgirIJJPn%2FPao8vQhphAH1xkDnS9ctHpouNv0ERxAEFSykcOtHdYxFqM6NAK1Udc8LGo9iD8TkvZvDNz7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792468f53bf8240e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ns/css/13488000.min.css?2831k31j20232831j01ckl31llk109jkk112800 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: text/css
                                        
content-encoding: br
content-md5: WEcI6Omll5/fQKo/f35d8g==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4EA477
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 6959a0fd-801e-0074-50d5-34d2b5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADVIE/YevAISpMkn2+AysZnRlJBMjMxMDUwNDE4MDIxADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAAAiZcNmiTi5T5pB0bPCloUNQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /engine?site=141028;size=1x1;e=0;dt=0;category=i1kh9%3A%20%20vgmtitpkdexx1%20ts%20of%20ao%20cveiuz%20b6f%20t8n3acal64l7pcat91gm61h7nma349ee%202zd%209f134%200s%20l8qciy5-%202ec4ofv%205nmbqe;kw=nwelylh056dpt%20lk%20%7C%201jjfeu%207awt%20kjjc%20%7C%20lf5fyqla9l%200n6vpb1jcds;rnd=(1675188708037) HTTP/1.1 
Host: pbid.pro-market.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         107.178.240.89
HTTP/2 200 OK
content-type: text/html
                                        
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
anserver: gapp-eu-4.c.datonics-gcp-01.internal
set-cookie: anProfile="0+1+4=21x+1f=1+1g=2+1j=57:1+rs=s+rt=5B5A2A9A+s0=(u)+s2=(rpd3v6)"; Domain=.pro-market.net; Max-Age=15552000; Path=/; Secure; SameSite=None;
pragma: no-cache
cache-control: no-cache, no-store, must-revalidate
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
date: Tue, 31 Jan 2023 18:11:29 GMT
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /c/hotjar-2865935.js?sv=6 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.113
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:23 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/35bf57c3427ec86a170a24c25f51190f
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dAblcAjvcs5umL_ZO5JeoJoDlJLLNHEQAc0rbJWAgEWG4ThI_x8L4A==
age: 7
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=4&pid=a833ebfd-bcf9-438e-8504-2edb751c6c2d&token=F93FAF05-A9CC-A398-138E-B65A38EBE56C&_=882324169 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 1064
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.203.172.198
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:32 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguserid=4825f788-5a4f-418b-9fe0-a8aa861f7fef; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:32 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/css/bootstrap.min.css HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.10.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:28 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: US
cdn-edgestorageid: 718, 718
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-04-13 02:48:26
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: b584a7f7756eea1e54b5f28d657ba679
cdn-cache: HIT
cf-cache-status: HIT
age: 1083494
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 792468f55934b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/clientfp.min.js?version=20211103 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: E4ptMzZLxbawD4B7RV5YCQ==
last-modified: Wed, 03 Nov 2021 09:07:36 GMT
etag: 0x8D99EA961032FA1
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 40b3a374-f01e-003f-4c90-35e32f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADrYH3d2qvqQ4OpItCAdeMZRlJBMjMxMDUwNDE3MDM5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAACJApCIcl+dRLm+ouZeUHWqQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common-extentions.min.js?20230119a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: G3v7pHqbSC0Gvp9zsfwXIA==
last-modified: Wed, 09 Jun 2021 12:26:50 GMT
etag: 0x8D92B41DB6898DE
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 2cad6eb8-401e-0040-7b15-337d1d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VUDZYwAAAADJx4JLL0oVTpeOHGENWbePRlJBMjMxMDUwNDE4MDMzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAAApUcU6JTReTqB8Wb6VyWg/Q1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /trustedform-1.8.35.js HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         54.230.111.103
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Fri, 06 Jan 2023 16:07:23 GMT
x-amz-version-id: PsGscq0o6WWOGkSqGH9BYInejEgnNeUZ
server: AmazonS3
content-encoding: gzip
date: Tue, 31 Jan 2023 18:11:27 GMT
etag: W/"cef26bd569e1a24279f16aecc87c254b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: uUrhU_vnfLteWg4iuk3VnfO_cE3tPxZKW5jU3F9ylTH_g3dOiwf4Ng==
age: 13
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common.min.js?version=20230119a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: C6fwdGWIexTnY7MOkhccRw==
last-modified: Wed, 18 Jan 2023 19:27:21 GMT
etag: 0x8DAF98A05414A99
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: e3041d87-d01e-0023-191f-343b38000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAAAkpOfCWtgDRan5+fRrYdkpRlJBMjMxMDUwNDE3MDMzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAADj7v+OS2M6RbGzX0mrr1KHQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/browserdetect.min.js?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: Shzc0tuaykHxXX+tfi+uUQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 82d58108-301e-004f-0d08-3490eb000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAABmIs+7gjuMQ5uBympaOdZ7RlJBMjMxMDUwNDE3MDExADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 00VnZYwAAAACJXfIUq9YgTJ4ngrEC1dKpQ1BIMzBFREdFMDQxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---