tulac.offerlinker.xyz/oc/5cfc926385
302 Found 0 B URL HTTP/1.1 tulac.offerlinker.xyz/oc/5cfc926385
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /oc/5cfc926385 HTTP/1.1
Host: tulac.offerlinker.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Date: Thu, 05 Jan 2023 14:31:29 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: AWSALB=uomBE9WBFd4FpNjI4TG52DlDc+rl/j/15ZaCGHC2dwbHZvMipqS5WsScYiJLP75k9q97SjE12kQHa/NWAJJaAEEqWtb8AY9IsNWgwA9W3DWn0FdEOmjn3L0k76Cx; Expires=Thu, 12 Jan 2023 14:31:29 GMT; Path=/
AWSALBCORS=uomBE9WBFd4FpNjI4TG52DlDc+rl/j/15ZaCGHC2dwbHZvMipqS5WsScYiJLP75k9q97SjE12kQHa/NWAJJaAEEqWtb8AY9IsNWgwA9W3DWn0FdEOmjn3L0k76Cx; Expires=Thu, 12 Jan 2023 14:31:29 GMT; Path=/; SameSite=None
Location: https://www.ohrockaround.com/rc/d92944b1c7?af5=offer-campaign-not_valid
Vary: Accept-Language, Cookie
Content-Language: en
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ygWSPEc5UOdYjUY%2Fv5E5%2FT9FFr6EXagdD%2BaCM0NJaYnyXulOzj%2FkETCusmkotdUwat6OA%2FOko9z5XFE0Ebf1cTL0%2BYeb0rHaA2Tv%2BDBcclPbTp7UxRusyk6rSr9S8TSTOjYMeqcncV8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 784ceaf7fbb6b523-OSL
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 326898eb925368408f6f42ee173b9d89
b8b20ee34b7e7b139e7729b8e46a54ea25f54ac8
96c2c75f700ab55649882111713ca3cfb2eaf08e404c2bc245a641dc12ae168a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96C2C75F700AB55649882111713CA3CFB2EAF08E404C2BC245A641DC12AE168A"
Last-Modified: Wed, 04 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10388
Expires: Thu, 05 Jan 2023 17:24:37 GMT
Date: Thu, 05 Jan 2023 14:31:29 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ce8af3d72e7e9af609039abee59c8b87
8e1b16591fbc632df35f15e23da55ee86af31bc3
52edddbda4a3a3b778f61a491b21e6ea439e9d8024189e636b1f37b2dd7226fc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "52EDDDBDA4A3A3B778F61A491B21E6EA439E9D8024189E636B1F37B2DD7226FC"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10839
Expires: Thu, 05 Jan 2023 17:32:08 GMT
Date: Thu, 05 Jan 2023 14:31:29 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 05 Jan 2023 13:47:53 GMT
content-type: application/json
age: 2616
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash da484f5e9c6805745e063b236fb81473
ae454bf4a7ae0e96935afc81ee0f89c049097b15
068d0da23acbe7f6b600c4e7dbe9c81d3ad78c8afd122255bbf3550e8a290686
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "068D0DA23ACBE7F6B600C4E7DBE9C81D3AD78C8AFD122255BBF3550E8A290686"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6970
Expires: Thu, 05 Jan 2023 16:27:39 GMT
Date: Thu, 05 Jan 2023 14:31:29 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Yc0vfAwpstkarPpCV1n28dFysVnl74w/imtQY4PEOMbWnY0K83tJllfJolloUdC5kFX8GjUU968=
x-amz-request-id: 5YA1XZKCTFXP55XF
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 05 Jan 2023 13:59:34 GMT
age: 1915
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 05 Jan 2023 14:31:29 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 4c64622de1df3d7b7ce081c5effea808
2f0ca1112a570c2d26e2d9eacccf3f2ec26f3749
3dda6f02b038df2e7b5f20e4b43509d11ec68fda71c7b3cbd29388a3ec35cf9e
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "3DDA6F02B038DF2E7B5F20E4B43509D11EC68FDA71C7B3CBD29388A3EC35CF9E"
Last-Modified: Tue, 03 Jan 2023 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Thu, 05 Jan 2023 20:31:29 GMT
Date: Thu, 05 Jan 2023 14:31:29 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 4c64622de1df3d7b7ce081c5effea808
2f0ca1112a570c2d26e2d9eacccf3f2ec26f3749
3dda6f02b038df2e7b5f20e4b43509d11ec68fda71c7b3cbd29388a3ec35cf9e
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "3DDA6F02B038DF2E7B5F20E4B43509D11EC68FDA71C7B3CBD29388A3EC35CF9E"
Last-Modified: Tue, 03 Jan 2023 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21599
Expires: Thu, 05 Jan 2023 20:31:29 GMT
Date: Thu, 05 Jan 2023 14:31:30 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Pragma, Content-Length, Alert, Expires, ETag, Last-Modified, Backoff, Content-Type, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 05 Jan 2023 14:08:11 GMT
age: 1399
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash 573c39660d474d623da3006884276ce7
26b8a041e70273f90ac0481ca4a6f81bf581aae3
b890c1ef0ab5d8bd18a69a99bcd8b4c23907dc12e01ff76348ec00a1c3ca67fc
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=141814
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:30 GMT
Etag: "63b66638-118"
Expires: Sat, 07 Jan 2023 05:55:04 GMT
Last-Modified: Thu, 05 Jan 2023 05:55:04 GMT
Server: nginx
Content-Length: 280
ocsp.digicert.com/
200 OK 280 B IP
Hash 573c39660d474d623da3006884276ce7
26b8a041e70273f90ac0481ca4a6f81bf581aae3
b890c1ef0ab5d8bd18a69a99bcd8b4c23907dc12e01ff76348ec00a1c3ca67fc
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=141814
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:30 GMT
Etag: "63b66638-118"
Expires: Sat, 07 Jan 2023 05:55:04 GMT
Last-Modified: Thu, 05 Jan 2023 05:55:04 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 280
ocsp.digicert.com/
200 OK 471 B IP
Hash 73a99621729e1bc9e236a1085b98a0cf
5e1f71493085f6be7788f59987c1f0850b77d4d7
219d1a8d7d1a027553f72c8c024488863d8996457b31c78014002f81174f3ad1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5256
Cache-Control: max-age=158575
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:30 GMT
Etag: "63b69329-1d7"
Expires: Sat, 07 Jan 2023 10:34:25 GMT
Last-Modified: Thu, 05 Jan 2023 09:06:49 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 471
ocsp.sectigo.com/
200 OK 471 B IP
Hash f9937c79a103176b1439e0a6c830c2c6
5cfd1ca2d89af35236c2edb8fe98c722a7bd7514
8bec2112193414b73b7ed6a5d8fbf13dbce47113dcb3eba72774837aaf34fa14
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 05 Jan 2023 14:31:30 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 04 Jan 2023 03:34:02 GMT
Expires: Wed, 11 Jan 2023 03:34:01 GMT
Etag: "5cfd1ca2d89af35236c2edb8fe98c722a7bd7514"
Cache-Control: max-age=478350,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 784ceaff9cffb51d-OSL
track.gositego.live/sl?id=6372315a14cb732daa6b203e&pid=930&sub1=pubb83a66c929cf4f7998bc11188338f3b6&sub2=a67626a2
302 Found 0 B URL HTTP/2 track.gositego.live/sl?id=6372315a14cb732daa6b203e&pid=930&sub1=pubb83a66c929cf4f7998bc11188338f3b6&sub2=a67626a2
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=6372315a14cb732daa6b203e&pid=930&sub1=pubb83a66c929cf4f7998bc11188338f3b6&sub2=a67626a2 HTTP/1.1
Host: track.gositego.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.ohrockaround.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Thu, 05 Jan 2023 14:31:30 GMT
content-length: 0
location: https://t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=63b6df4290228f0001f688c0&s=930_a67626a2
x-adjust-use-original-forwarded-for: 1
set-cookie: afclick=63b6df4290228f0001f688c0; expires=Fri, 05 Jan 2024 14:31:30 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: hNKr0rEERJLbZLFzs+pH7w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: M7ffN5h8r+j024FoqPt6MB3Mnsc=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5fecc72cd5874efab1300e75ea5cd468
227b20dde87c1ffc0a641e4dfa29aaed6b1bd8d3
341bedd94ed21ad9b90327aefa556402cdff63be798f3ed626edb064baafcae4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "341BEDD94ED21AD9B90327AEFA556402CDFF63BE798F3ED626EDB064BAAFCAE4"
Last-Modified: Wed, 04 Jan 2023 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18018
Expires: Thu, 05 Jan 2023 19:31:48 GMT
Date: Thu, 05 Jan 2023 14:31:30 GMT
Connection: keep-alive
t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=63b6df4290228f0001f688c0&s=930_a67626a2
302 Found 0 B URL HTTP/1.1 t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=63b6df4290228f0001f688c0&s=930_a67626a2
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=63b6df4290228f0001f688c0&s=930_a67626a2 HTTP/1.1
Host: t3.blowingwnd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.ohrockaround.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 05 Jan 2023 14:31:31 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 1217p3t0dz
Raund: xi
Location: https://ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a30310077f91cd1155aafdfbccce499b
18856575d13f9466333c5ea6e1ed556738475294
d331f4c73d6068175353a9846f933423fdb608e03aedf5afc68e98498b720282
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D331F4C73D6068175353A9846F933423FDB608E03AEDF5AFC68E98498B720282"
Last-Modified: Tue, 03 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20147
Expires: Thu, 05 Jan 2023 20:07:18 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2
200 OK 499 B URL HTTP/1.1 ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2
IP
File type HTML document text\012- HTML document, ASCII text, with very long lines (546)
Hash 4230d5c7a5fa2598361a948e7a851009
ba732663581e3a921d80394823ea0d2eb92f404d
655ecc9af337b2fb44c16811ef52993d1dc104c8dfb57a9b9db7580929373f49
Analyzer Verdict Alert quad9 Sinkholed
GET /f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2 HTTP/1.1
Host: ron.trffclb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.ohrockaround.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 05 Jan 2023 14:31:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: bt-603611c5b7eaf46891533240=63b6df4378b4f46bf046da0b; expires=Sun, 08-Jan-2023 14:31:31 GMT; Max-Age=259200; path=/; domain=ron.trffclb.com; HttpOnly
Content-Encoding: gzip
ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2&bv=1
302 Found 0 B URL HTTP/1.1 ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2&bv=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2&bv=1 HTTP/1.1
Host: ron.trffclb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ron.trffclb.com/f.php?p=c:9qopki6xwqp7b0yj1&d=603611c5b7eaf46891533240&s=ys_930_a67626a2
Cookie: bt-603611c5b7eaf46891533240=63b6df4378b4f46bf046da0b
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 05 Jan 2023 14:31:31 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: bt-603611c5b7eaf46891533240=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=ron.trffclb.com; HttpOnly
Round: 11kgq037yu
Raund: 12uf2w0vxv-2v5
Location: https://popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=
ocsp.digicert.com/
200 OK 278 B IP
Hash 08731af8b502dfbf61a6cd6f7dad8f0c
615597c1b7320bb9373d305662d45828e0ab60be
962cdfe76232e41e8fc3ce0661ba192afdd85ca64a4ae6b51d6431a08c32efb0
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4176
Cache-Control: max-age=149936
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:31 GMT
Etag: "63b675a3-116"
Expires: Sat, 07 Jan 2023 08:10:27 GMT
Last-Modified: Thu, 05 Jan 2023 07:00:51 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
200 OK 278 B IP
Hash 08731af8b502dfbf61a6cd6f7dad8f0c
615597c1b7320bb9373d305662d45828e0ab60be
962cdfe76232e41e8fc3ce0661ba192afdd85ca64a4ae6b51d6431a08c32efb0
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4176
Cache-Control: max-age=149936
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:31 GMT
Etag: "63b675a3-116"
Expires: Sat, 07 Jan 2023 08:10:27 GMT
Last-Modified: Thu, 05 Jan 2023 07:00:51 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 278
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1780bdca4138463723f65222d72004e2
c0acbd7a8cf08d7b675dd8a0cdb73d4ff4fbdb8b
92d022d0945f2e9ff1b27013792745c4ca2d65150693532049985efdf9022efa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "92D022D0945F2E9FF1B27013792745C4CA2D65150693532049985EFDF9022EFA"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11061
Expires: Thu, 05 Jan 2023 17:35:52 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1780bdca4138463723f65222d72004e2
c0acbd7a8cf08d7b675dd8a0cdb73d4ff4fbdb8b
92d022d0945f2e9ff1b27013792745c4ca2d65150693532049985efdf9022efa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "92D022D0945F2E9FF1B27013792745C4CA2D65150693532049985EFDF9022EFA"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11061
Expires: Thu, 05 Jan 2023 17:35:52 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1780bdca4138463723f65222d72004e2
c0acbd7a8cf08d7b675dd8a0cdb73d4ff4fbdb8b
92d022d0945f2e9ff1b27013792745c4ca2d65150693532049985efdf9022efa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "92D022D0945F2E9FF1B27013792745C4CA2D65150693532049985EFDF9022EFA"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11061
Expires: Thu, 05 Jan 2023 17:35:52 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1780bdca4138463723f65222d72004e2
c0acbd7a8cf08d7b675dd8a0cdb73d4ff4fbdb8b
92d022d0945f2e9ff1b27013792745c4ca2d65150693532049985efdf9022efa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "92D022D0945F2E9FF1B27013792745C4CA2D65150693532049985EFDF9022EFA"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11061
Expires: Thu, 05 Jan 2023 17:35:52 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1780bdca4138463723f65222d72004e2
c0acbd7a8cf08d7b675dd8a0cdb73d4ff4fbdb8b
92d022d0945f2e9ff1b27013792745c4ca2d65150693532049985efdf9022efa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "92D022D0945F2E9FF1B27013792745C4CA2D65150693532049985EFDF9022EFA"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11061
Expires: Thu, 05 Jan 2023 17:35:52 GMT
Date: Thu, 05 Jan 2023 14:31:31 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F038e46b4-c5e2-4f46-817c-434795e1e545.jpeg
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F038e46b4-c5e2-4f46-817c-434795e1e545.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5ce88a04d7f32ce0497bd84db44da8d4
761049019c342553004815ea394dcf282f2cc613
038aa4e5da1428524de833071814998d6c1d8b8b60d4e9c10e60d8a75f7b88fb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F038e46b4-c5e2-4f46-817c-434795e1e545.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5601
x-amzn-requestid: 54813ea9-9435-4355-910b-5b4d1eadf2ff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eGlhgHU1oAMFTYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b282d6-17e772ae5b70371367792063;Sampled=0
x-amzn-remapped-date: Mon, 02 Jan 2023 07:08:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: hB4FJa_z49ZYA_EY_5CH9CVlU2tYkrhayxyWMmR8lNxR10rjfff-MQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 05 Jan 2023 06:33:38 GMT
age: 28673
etag: "761049019c342553004815ea394dcf282f2cc613"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f37a3ca-5b31-4876-bbcd-442c1f718b3c.jpeg
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f37a3ca-5b31-4876-bbcd-442c1f718b3c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e832123ea0c92a446b5894e75efc86ae
bb438ca635b43819701067ef07a3d910ad29a0c7
e1b0c6cd873f304de15664f96af6b6914e13fbbfb3e2179ba43369e116446773
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f37a3ca-5b31-4876-bbcd-442c1f718b3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5578
x-amzn-requestid: 93353c3e-1b26-424c-b4c6-0d113703edd6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eFvpBFGvIAMFobw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b22c9f-1d07cff31ae39320693642f0;Sampled=0
x-amzn-remapped-date: Mon, 02 Jan 2023 01:00:15 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: DqWBkBqUffF-tNXmSr2AzrL7hMr0RufOsND4zDF26f8A4c1tetxnWg==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 05 Jan 2023 03:41:11 GMT
age: 39020
etag: "bb438ca635b43819701067ef07a3d910ad29a0c7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa32e61e5-fcf0-4825-a1bf-ea145dd3ae6c.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa32e61e5-fcf0-4825-a1bf-ea145dd3ae6c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4cecd6a1a228ac55f193a180229d3a33
9e5fd5a101828d5491305deb539dc5836c5b3065
7bbd9e261625c2d2a700a817c2f10b779c8463baacda02f9f34161c08487ca31
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa32e61e5-fcf0-4825-a1bf-ea145dd3ae6c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8721
x-amzn-requestid: 1c24289e-6169-4088-a2b8-311e3640e4bf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eAA7IGTdIAMFzCA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63afe1e0-561d5981260c41511219c673;Sampled=0
x-amzn-remapped-date: Sat, 31 Dec 2022 07:16:48 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: qoxCvnR2nVjlCdQJ6Wyq_Ot0p1SVdhl71LEKAm0-tkPMxWHGdIl42w==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 548adcda884eed02304ba5d6a1d7f514.cloudfront.net (CloudFront), 1.1 google
date: Thu, 05 Jan 2023 07:08:44 GMT
age: 26567
etag: "9e5fd5a101828d5491305deb539dc5836c5b3065"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb16f641-0924-4c5c-9f83-6779c59c746a.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb16f641-0924-4c5c-9f83-6779c59c746a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7711a1490729319952a150b84e91a5d6
11fda31d48a4df3fd6346d92f45a680f500bff64
e9663e981c6716c243b58ac99549dfbe6dd8371c42d50add46457b5911f63529
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb16f641-0924-4c5c-9f83-6779c59c746a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11381
x-amzn-requestid: 6964d7af-01cd-425b-aeb9-89a336f83a25
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ePKyuGyJoAMF91Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b5f1aa-62558f6852d5861033eecdef;Sampled=0
x-amzn-remapped-date: Wed, 04 Jan 2023 21:37:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: BQpaWc_3xnsf6SPx3UvVIfgBRURZkVYrXyKQi6Khv6_90Ao78BZDeg==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 21:55:08 GMT
age: 59783
etag: "11fda31d48a4df3fd6346d92f45a680f500bff64"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F343434d9-f716-41aa-8934-1a5f79402aa1.jpeg
200 OK 4.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F343434d9-f716-41aa-8934-1a5f79402aa1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 008614d302ad57bc6502ad5e07652378
968bc262d2939ec6f0dce9d852682c0aaf86d3d7
5eab9a2591f0f9761ba3b90a5a191b79b6326cccb1ee6b586b00dfc1517c8db6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F343434d9-f716-41aa-8934-1a5f79402aa1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4248
x-amzn-requestid: 17ccfd69-0d12-42ac-b111-059a68735e70
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eCutmF7mIAMFW2w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b0f7f0-5e1653641a0303815656a578;Sampled=0
x-amzn-remapped-date: Sun, 01 Jan 2023 03:03:12 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: zxPQmFj8Y1QxN5CKzoPL9l_tBPeokp60xLh7nhRHTWjcdKreTPy01A==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 05 Jan 2023 07:08:59 GMT
age: 26552
etag: "968bc262d2939ec6f0dce9d852682c0aaf86d3d7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5507a575-db90-4030-a625-ae482beacb61.jpeg
200 OK 9.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5507a575-db90-4030-a625-ae482beacb61.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 165bf3d40f0584e3b9839304ede47c76
27da520440229f2239721371d9338eb81a8b4b93
00075a96a87b16edb302ccc862e0dc9691c7195ac227ae805bc88ebe8dd3ee52
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5507a575-db90-4030-a625-ae482beacb61.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9690
x-amzn-requestid: eba6ad45-abca-4781-88d0-28514de35851
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ePMB5GxGIAMFZcA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b5f3a5-2f3844833b7ead4f7121ae11;Sampled=0
x-amzn-remapped-date: Wed, 04 Jan 2023 21:46:13 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AUNmGdRW5uyYG9Yiwi4ZR7Ss-aD5k5FuDgyHAgnuJgmtG-S2WQ4T6w==
via: 1.1 536063cb28bfc05fcb7a78183dd89b72.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 21:57:37 GMT
age: 59634
etag: "27da520440229f2239721371d9338eb81a8b4b93"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
popcash.net/world/go/142/26196/
301 Moved Permanently 162 B URL HTTP/1.1 popcash.net/world/go/142/26196/
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /world/go/142/26196/ HTTP/1.1
Host: popcash.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Thu, 05 Jan 2023 14:31:31 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: http://ps.popcash.net/go/142/26196/
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FSGHo9F8UgogtfeMEBcw7zsTbWjo0aaIaPwIf0J1BnJQ%2F7vPnHqW6kyBz%2FVnJl7pxUFn5hENGss45OUbpnR1h2A9%2FH4SX0MOkCe5tR5gmeqloKnDDjZsSqPShgsG"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 784ceb06f9040afe-OSL
alt-svc: h2=":443"; ma=60
ps.popcash.net/go/142/26196/
200 OK 269 B URL HTTP/1.1 ps.popcash.net/go/142/26196/
IP
File type HTML document, ASCII text
Hash 05bb0f00a5a20655eea6e64210fc37a8
74390950734f3b144d29ab80e3455df2a6a74139
01398f107f107c981535f589b3fc435f074ae4b300e8e9590bdc02f0921df30b
GET /go/142/26196/ HTTP/1.1
Host: ps.popcash.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 05 Jan 2023 14:31:32 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 269
Connection: keep-alive
ps.popcash.net/ad/ad?p=142&w=26196&t=351488a0ef4b86a3&r=&vw=1280&vh=0
303 See Other 0 B URL HTTP/1.1 ps.popcash.net/ad/ad?p=142&w=26196&t=351488a0ef4b86a3&r=&vw=1280&vh=0
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ad/ad?p=142&w=26196&t=351488a0ef4b86a3&r=&vw=1280&vh=0 HTTP/1.1
Host: ps.popcash.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ps.popcash.net/go/142/26196/
Upgrade-Insecure-Requests: 1
HTTP/1.1 303 See Other
Date: Thu, 05 Jan 2023 14:31:32 GMT
Location: https://adeumssp.com/smart?p=CsxnKsUCG9yw6Ygyhidzm6oiJ2jrV4PSrgPJitGQya&s=adeum.click
Server: nginx
Content-Length: 0
Connection: keep-alive
ocsp.sectigo.com/
200 OK 472 B IP
Hash 1e0c985749757446fcdd0389ab3385ca
38a2fe66bfafaa3728b3c07b67b191cc653abea1
d5ee1ba0210fc55edbc9e3276fa1013aaddf5121c6868bb3e4b7f075a1c21a95
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 05 Jan 2023 14:31:32 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 05 Jan 2023 02:30:51 GMT
Expires: Thu, 12 Jan 2023 02:30:50 GMT
Etag: "38a2fe66bfafaa3728b3c07b67b191cc653abea1"
Cache-Control: max-age=560957,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 784ceb0babbdb51d-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 9f0e5493af0d705aad1661a4e3acdc65
2a166b546f6bf1008288abd47226e4138446007e
66af3567fda2cc649144900fe215df1ac9f6ebadaeaad98cb56212bf9a5fb75e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 05 Jan 2023 14:31:32 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 02 Jan 2023 17:21:51 GMT
Expires: Mon, 09 Jan 2023 17:21:50 GMT
Etag: "2a166b546f6bf1008288abd47226e4138446007e"
Cache-Control: max-age=355217,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 784ceb0e9f8cb51d-OSL
fancycrab.net/sc?a=Csxn&c=fwm9v3sXTEqgBhJX6QHkDm&e=gAAAAABjtt9Eg5F2IXSJZkNMAuer15yEuJiEt4QMO-iqkMQSfrm-yozjjcIWLULy9tu4rH1wJ1VWFk5twmPnVJR1guBor_hqJO5Es3lAejuXAA_l0c65gUhdU1vleF5boobrKtqIknuVCywO9xverpkHPj4-9mJiQALtQIv9-HswtERtvHvUVN6dUzt-x23pyPre5fXnMXNw1s0_rAuoSAND0Jbgst8bxfr4bp3lfUoW52soaxidAgCPSFsPBttb8V49ruFh9mKRRZnLki2jVBpjq75_4rn68ZUA6mtjmMJSfHQwpm6PaB3ICVY4b7v2wkpqNYxlGzATw7jfq-onypuKSeH188YWyaldUglKeSZ8Xhq42fXr0VfEbhHBhDkHt4ChAIQt44mrxvo09si5a-w4lKy9_wq-AIQaC5NcRqI1S_cN0y0rsAqEsnUqvU_EeeoS_YSso1HaVcbrVOHJNiLeNTF6kplsnYNEHj3hZ7_b8_ll-n1NXfvy7UzRTYR3V9oEWQjfxeZLTFU5VTXyN95i0gSjDUwAJ-m880UVxMsisNTTiXGMGjbfZlnwAb9oBqVkSeo1cZszkVTFNraOj6FkrfDojDQhCcxJSmIq15j0QXWthxTUXJUVuo_dvSO2CxIxUsniBRSAk2CybVqLineSe3mBUaHDSp_4dNHaoY5vFO-6XbXtud4dgXtpXRRr5uX44_-KqUsExNmTeNlVEV8lYF6EW0lp_KLkimpJSt0eCwJQ7yjwrJs2xDL1jLwp7y2T1RBb2GchemfWYFYvIaK5uxSK1X56Jo-qWMynDZzYiow40jGu4FlHPkdo6JcZWGXfPWb5m4CmfuzG5BuRc16u03F2zapxublZBgGVx55ws5srhhmkMTkKQ8aALc-0pwomUig3dhVE-BSLg--vd053XPPm9W3HtpXpNHx0Qbqoe3sjCn2eG_QIxmd-KkAENbeGscP4aPaH0IREtN_D02jPRHTY6KTS9sYcCTXgZ7m4rzcWGXRtrESWpV5jNluGofpUdEzDVv-PZrgyM2aQ4-A_LKw0DAFhyBaL19YQrzX0A-t_B2k9T5n_KqINURk2aiX1i15Q--0gRJRHqzA6Gztbw9zPqrGK1ynM8VhE2BwDb7lMt7qhOLAhcD-RISR6L6iFDuZR0wlZ7gG1K0H3wseknC0cpqHqahKa2DNkA-OM7pf06PT8cqnSmSGwKjb8-FuJhW003CmPW9HPWss5PcWJkDEuWnFgt8vyHVF5pPBo7ppM_ZiO-RdDZPxfmc-vTS_zGkkbrJ-KIbizAGq046j7iCFVBsqZVANYb57PC_9v9k4-KlQNR74FQoZts8Q8xM6bvF2Mmc5UIQwax36L2ccknezh8j8yrQChbEAM8KDJ-6YSC-SIOuCTnzjjqkjIx3jZyuVW52LduTf1DtslCYzVZ0TTPF_YXNyQxuZAfSwBx0X93JjoRKkAxoku_o6jjdvG2PomZOJFWbgazQCYGgslihEChKn9KiXAISplbeiy0Wf9-WMSVmElLFzbFVtkmBfD4lXhL1Z-vzZp0fu8KqDpWEdaIuA4AJzh-5KJqgJ8uTSzxCu-TAc1SEwa4Ze9a3YsYe60ONrI40vx2dir6FjRe8kapW8utrpWqYXLPKHb2eMTfTxgPnWNv8U6svgoMWQ4nBkZAej6BaTv6IMJn7Ym_H5eml-9jEsGFr4DXlQ6tNX3ILBzVL7YivuEhEQSTTL1xyJwfVjpNg7uTb5GfJw901eHyFMpBhTV-y1Zd_q6yUea_Nui_kL6uaY0ZgAUwDlUilkj9Vnq_gJIKFQ_V0rcigC-dsz-pFCHsAUnHUpRvwK7OgWSS8RIiwMAbYV3aHR-9CCI7owCiia0O49yD0pgbzjLw9wwXyLAMpNUhoe3RrYh0eBUKh7X6HmdaiwetW3NVPPF8O2pR82AOwH7a49rfMLa01OXKjUxzaoMYtAOqh3AAzA2F16kf_F4MaaPuFbUk7bly06JbGvFjGSizwxIf4AWi6A5kk9dDa38lMFd-vpjVmaswG6epBA4U7T9nq1zdEE6S1k8GsOvXIEmYc9eAmi195ix4385Gvt0huhkuGFpODMpKe_FyZRFruWwvjlLai76NcnDo-ho4a16i3OWd7j59GOnxeBISfSgcmysoUsfL8YiQsfuiUl_41UJVNUph25m2uQQOxhtvp2k-A9yrhlPjZhFqGW0ELPeWXq_TM0Tz8eUeoSCls5MJxcHiiJ0C-efYbdL&f=0
302 Found 856 B URL HTTP/2 fancycrab.net/sc?a=Csxn&c=fwm9v3sXTEqgBhJX6QHkDm&e=gAAAAABjtt9Eg5F2IXSJZkNMAuer15yEuJiEt4QMO-iqkMQSfrm-yozjjcIWLULy9tu4rH1wJ1VWFk5twmPnVJR1guBor_hqJO5Es3lAejuXAA_l0c65gUhdU1vleF5boobrKtqIknuVCywO9xverpkHPj4-9mJiQALtQIv9-HswtERtvHvUVN6dUzt-x23pyPre5fXnMXNw1s0_rAuoSAND0Jbgst8bxfr4bp3lfUoW52soaxidAgCPSFsPBttb8V49ruFh9mKRRZnLki2jVBpjq75_4rn68ZUA6mtjmMJSfHQwpm6PaB3ICVY4b7v2wkpqNYxlGzATw7jfq-onypuKSeH188YWyaldUglKeSZ8Xhq42fXr0VfEbhHBhDkHt4ChAIQt44mrxvo09si5a-w4lKy9_wq-AIQaC5NcRqI1S_cN0y0rsAqEsnUqvU_EeeoS_YSso1HaVcbrVOHJNiLeNTF6kplsnYNEHj3hZ7_b8_ll-n1NXfvy7UzRTYR3V9oEWQjfxeZLTFU5VTXyN95i0gSjDUwAJ-m880UVxMsisNTTiXGMGjbfZlnwAb9oBqVkSeo1cZszkVTFNraOj6FkrfDojDQhCcxJSmIq15j0QXWthxTUXJUVuo_dvSO2CxIxUsniBRSAk2CybVqLineSe3mBUaHDSp_4dNHaoY5vFO-6XbXtud4dgXtpXRRr5uX44_-KqUsExNmTeNlVEV8lYF6EW0lp_KLkimpJSt0eCwJQ7yjwrJs2xDL1jLwp7y2T1RBb2GchemfWYFYvIaK5uxSK1X56Jo-qWMynDZzYiow40jGu4FlHPkdo6JcZWGXfPWb5m4CmfuzG5BuRc16u03F2zapxublZBgGVx55ws5srhhmkMTkKQ8aALc-0pwomUig3dhVE-BSLg--vd053XPPm9W3HtpXpNHx0Qbqoe3sjCn2eG_QIxmd-KkAENbeGscP4aPaH0IREtN_D02jPRHTY6KTS9sYcCTXgZ7m4rzcWGXRtrESWpV5jNluGofpUdEzDVv-PZrgyM2aQ4-A_LKw0DAFhyBaL19YQrzX0A-t_B2k9T5n_KqINURk2aiX1i15Q--0gRJRHqzA6Gztbw9zPqrGK1ynM8VhE2BwDb7lMt7qhOLAhcD-RISR6L6iFDuZR0wlZ7gG1K0H3wseknC0cpqHqahKa2DNkA-OM7pf06PT8cqnSmSGwKjb8-FuJhW003CmPW9HPWss5PcWJkDEuWnFgt8vyHVF5pPBo7ppM_ZiO-RdDZPxfmc-vTS_zGkkbrJ-KIbizAGq046j7iCFVBsqZVANYb57PC_9v9k4-KlQNR74FQoZts8Q8xM6bvF2Mmc5UIQwax36L2ccknezh8j8yrQChbEAM8KDJ-6YSC-SIOuCTnzjjqkjIx3jZyuVW52LduTf1DtslCYzVZ0TTPF_YXNyQxuZAfSwBx0X93JjoRKkAxoku_o6jjdvG2PomZOJFWbgazQCYGgslihEChKn9KiXAISplbeiy0Wf9-WMSVmElLFzbFVtkmBfD4lXhL1Z-vzZp0fu8KqDpWEdaIuA4AJzh-5KJqgJ8uTSzxCu-TAc1SEwa4Ze9a3YsYe60ONrI40vx2dir6FjRe8kapW8utrpWqYXLPKHb2eMTfTxgPnWNv8U6svgoMWQ4nBkZAej6BaTv6IMJn7Ym_H5eml-9jEsGFr4DXlQ6tNX3ILBzVL7YivuEhEQSTTL1xyJwfVjpNg7uTb5GfJw901eHyFMpBhTV-y1Zd_q6yUea_Nui_kL6uaY0ZgAUwDlUilkj9Vnq_gJIKFQ_V0rcigC-dsz-pFCHsAUnHUpRvwK7OgWSS8RIiwMAbYV3aHR-9CCI7owCiia0O49yD0pgbzjLw9wwXyLAMpNUhoe3RrYh0eBUKh7X6HmdaiwetW3NVPPF8O2pR82AOwH7a49rfMLa01OXKjUxzaoMYtAOqh3AAzA2F16kf_F4MaaPuFbUk7bly06JbGvFjGSizwxIf4AWi6A5kk9dDa38lMFd-vpjVmaswG6epBA4U7T9nq1zdEE6S1k8GsOvXIEmYc9eAmi195ix4385Gvt0huhkuGFpODMpKe_FyZRFruWwvjlLai76NcnDo-ho4a16i3OWd7j59GOnxeBISfSgcmysoUsfL8YiQsfuiUl_41UJVNUph25m2uQQOxhtvp2k-A9yrhlPjZhFqGW0ELPeWXq_TM0Tz8eUeoSCls5MJxcHiiJ0C-efYbdL&f=0
IP
ASN #24940 Hetzner Online GmbH
File type HTML document, ASCII text, with very long lines (854)
Hash 218518cca37f27ec86f63a722ff76ac7
6d0865f3c1c6ea3da3c10fb96f593e0c5f576f78
138281cb16809ef021b7cb4f503d722535911e226cd7a994d3a3a2cf580fc245
GET /sc?a=Csxn&c=fwm9v3sXTEqgBhJX6QHkDm&e=gAAAAABjtt9Eg5F2IXSJZkNMAuer15yEuJiEt4QMO-iqkMQSfrm-yozjjcIWLULy9tu4rH1wJ1VWFk5twmPnVJR1guBor_hqJO5Es3lAejuXAA_l0c65gUhdU1vleF5boobrKtqIknuVCywO9xverpkHPj4-9mJiQALtQIv9-HswtERtvHvUVN6dUzt-x23pyPre5fXnMXNw1s0_rAuoSAND0Jbgst8bxfr4bp3lfUoW52soaxidAgCPSFsPBttb8V49ruFh9mKRRZnLki2jVBpjq75_4rn68ZUA6mtjmMJSfHQwpm6PaB3ICVY4b7v2wkpqNYxlGzATw7jfq-onypuKSeH188YWyaldUglKeSZ8Xhq42fXr0VfEbhHBhDkHt4ChAIQt44mrxvo09si5a-w4lKy9_wq-AIQaC5NcRqI1S_cN0y0rsAqEsnUqvU_EeeoS_YSso1HaVcbrVOHJNiLeNTF6kplsnYNEHj3hZ7_b8_ll-n1NXfvy7UzRTYR3V9oEWQjfxeZLTFU5VTXyN95i0gSjDUwAJ-m880UVxMsisNTTiXGMGjbfZlnwAb9oBqVkSeo1cZszkVTFNraOj6FkrfDojDQhCcxJSmIq15j0QXWthxTUXJUVuo_dvSO2CxIxUsniBRSAk2CybVqLineSe3mBUaHDSp_4dNHaoY5vFO-6XbXtud4dgXtpXRRr5uX44_-KqUsExNmTeNlVEV8lYF6EW0lp_KLkimpJSt0eCwJQ7yjwrJs2xDL1jLwp7y2T1RBb2GchemfWYFYvIaK5uxSK1X56Jo-qWMynDZzYiow40jGu4FlHPkdo6JcZWGXfPWb5m4CmfuzG5BuRc16u03F2zapxublZBgGVx55ws5srhhmkMTkKQ8aALc-0pwomUig3dhVE-BSLg--vd053XPPm9W3HtpXpNHx0Qbqoe3sjCn2eG_QIxmd-KkAENbeGscP4aPaH0IREtN_D02jPRHTY6KTS9sYcCTXgZ7m4rzcWGXRtrESWpV5jNluGofpUdEzDVv-PZrgyM2aQ4-A_LKw0DAFhyBaL19YQrzX0A-t_B2k9T5n_KqINURk2aiX1i15Q--0gRJRHqzA6Gztbw9zPqrGK1ynM8VhE2BwDb7lMt7qhOLAhcD-RISR6L6iFDuZR0wlZ7gG1K0H3wseknC0cpqHqahKa2DNkA-OM7pf06PT8cqnSmSGwKjb8-FuJhW003CmPW9HPWss5PcWJkDEuWnFgt8vyHVF5pPBo7ppM_ZiO-RdDZPxfmc-vTS_zGkkbrJ-KIbizAGq046j7iCFVBsqZVANYb57PC_9v9k4-KlQNR74FQoZts8Q8xM6bvF2Mmc5UIQwax36L2ccknezh8j8yrQChbEAM8KDJ-6YSC-SIOuCTnzjjqkjIx3jZyuVW52LduTf1DtslCYzVZ0TTPF_YXNyQxuZAfSwBx0X93JjoRKkAxoku_o6jjdvG2PomZOJFWbgazQCYGgslihEChKn9KiXAISplbeiy0Wf9-WMSVmElLFzbFVtkmBfD4lXhL1Z-vzZp0fu8KqDpWEdaIuA4AJzh-5KJqgJ8uTSzxCu-TAc1SEwa4Ze9a3YsYe60ONrI40vx2dir6FjRe8kapW8utrpWqYXLPKHb2eMTfTxgPnWNv8U6svgoMWQ4nBkZAej6BaTv6IMJn7Ym_H5eml-9jEsGFr4DXlQ6tNX3ILBzVL7YivuEhEQSTTL1xyJwfVjpNg7uTb5GfJw901eHyFMpBhTV-y1Zd_q6yUea_Nui_kL6uaY0ZgAUwDlUilkj9Vnq_gJIKFQ_V0rcigC-dsz-pFCHsAUnHUpRvwK7OgWSS8RIiwMAbYV3aHR-9CCI7owCiia0O49yD0pgbzjLw9wwXyLAMpNUhoe3RrYh0eBUKh7X6HmdaiwetW3NVPPF8O2pR82AOwH7a49rfMLa01OXKjUxzaoMYtAOqh3AAzA2F16kf_F4MaaPuFbUk7bly06JbGvFjGSizwxIf4AWi6A5kk9dDa38lMFd-vpjVmaswG6epBA4U7T9nq1zdEE6S1k8GsOvXIEmYc9eAmi195ix4385Gvt0huhkuGFpODMpKe_FyZRFruWwvjlLai76NcnDo-ho4a16i3OWd7j59GOnxeBISfSgcmysoUsfL8YiQsfuiUl_41UJVNUph25m2uQQOxhtvp2k-A9yrhlPjZhFqGW0ELPeWXq_TM0Tz8eUeoSCls5MJxcHiiJ0C-efYbdL&f=0 HTTP/1.1
Host: fancycrab.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://fancycrab.net/click?a=Csxn&e=gAAAAABjtt9E5SWgURKvePbzD-c7MTaHpf6Hp9BUsK87JI4gn7RiNQbGJE9bvkl2EvWqmk40sVaU_ctIWFSdd6rJjU74GMe-eCsH_oSQnB7dB6TvN_14eIL-80Yqag8WawTQMND8xD_sfxFlMWmntQZZpx1TN2E2bi6AUfDajWseqeHj4u9Nb12tQyBdmd6sSbNGYE24I-Mz8EbjupUgogViXWMJxl1wnEHtCotqVvDc4oAdc1XXMcL5cz09ZHdfEaSLeZUloGLPTR1npstAeI2cKdoIaGD_5zAWmocNP4zhTV1OUQEEgAFcQzXYLvyJphDFY28-8t6sMnUfjzYZaL0QZ2xJ25KvLRTw5JBhBuKF6jcJuNWjOlkcdSQDAQMehtMf5Yw0R2ZCMizk-2Wnh00InYU4EoIfGcY9e5oR5J3WUBSqBCP29O4oYyYvhMkxBYTSybHdgJw6ctRi7tcZFYwsMd9dUcMau213kyN5iVj3M8-fnYCazaipVS10O2hGnztHslNfcghleLHQeJ--n1kdUJ_83_2zRK_F3fYzl3MG3Q3BX7biqf5jA0xEuZJq6gP3b9ZIRsWQoz1PsAIIq7-M58sEFBWHh8_0tBEYfUpslD8_ltJMNLR4s0oe3FkriB978OKgq7azWW1Cz3oJQuKUH28onrTCdmds8lMWbjBsk62acixgyHRgDFVWqzXWTIDccp47GY76q2N3Yg5J2jdhm5oQJ4aivwnBOucOGOGhr1qVF0Uj8OxswP_i9dVVPWt-Nzsbq880NFEQQwr71Tu_3lL-xOGr7arCxm5m5r9wXYeYz8u4zFin4lMTlt8kCutNaGT1Dwh2BwTRUSlLXRSCVvVFIobULFjLzw7xYHbx6hUEbdu7aGFS8GmaA7Y7OAjfypQ9RMpq_kcGLX_xDZ8fNEbsN2-5mc6_glhrf2i2R7U70HiDJm8RzoiRMeXISMnWsVtW0htIxZLxA8vuI-qhPiolhtmS3q-Q4C3hrDahTQljn4KGaFMSqfNnsKlsvRiJfU2M4QU83OpR7uWS6vgrT6tCABbSzpNumGKoa3wRRRI8ve0JGcTPexlIbVj_p8b1-3FYY33X1rzrdbjOQI507Dl26Ulp5DB224bce90Xk4sV3eQ0wWSIp9j-U6ep5ymr3BRtz1m-Qwe0VK7AuPp7AUol6ru6kr-CdkMuWhrnjJWj5IKrZQqEZLUfhUTsdVn5F_FUXjHUdoKGydODcOO7-i6SXeMQ_UNx9mg6GWjCAwL-tmnBy9x2zi2kO2WU7ZljlbVX6ne6gMTynaNnD4eHQngbI2WvOO5k6a3z1wq3m9AsfCvL9rsLWX8Q-LM0v8hKWJ0Qw80EsBT5l0bIRfRQg2cKueab3n2Rf84xVXAqhZP0g5CEEaNSCxy-V4Xht5-hmVPvzNRyLDhXlOfD9hokurCuDdiExvxJdKzsAGntrZdwTAGWOkN_6FRI3HITbKjDjRUlScjx9KEoIFC0XThF_LYsbDeFGNsrynPOc0ImSGufjtLW3fmlE-WAjqFZ6DUXR_7AjErvFcAgrx39cK2_hIK0m880oUq7JmumQr6O0Zny6YKj18pgljUUYvxehPFipPFLwqT2myt0Of7lQlXsz0seV9iBklCSpVSQ8ZhziMrDcy5KW6hvcvrdGApr-UogvKdH2VX894sIjiJA6E1DPHbTBxwZznyW7emMJyUJkNkguzCdLs2yH8SldfA8HI7Kip8EllzTjCRM402j7HkoAfkDobpub7wospyNcV3CjtzJCncOlOMV7sSEhZl5rHWKF0Ts-t29kF8ZOgsfkUIx1GP63d90Ui_t171IKmGZKF1WvanNm5U7C0ruDH03BFyrzjrJ9cLG8IrhTbPyaJE88iIPFjCGaaKglVNGZtiP8pTCoPNDku-IonokX3oh6FHdFTAduUS-t9O8XaO1yUQkNF1GOPuIv0bGUvo1_QE3QtUAfjQx6p1BWXen76fUltPRlGaLQBt1aOdMJLJUoSbqPZTnVB76RIqf_oFkhsnUbzQR1CDXaJwSwaV8rgiJz3q5rXStzMzcrlahGmraDkc9UB8Fmyzk1bci7V00ilOhCAeWT59Bdh5OabPoJBe6ZlLM5BhiGCsQrhrL2-iqFEjdnxap_B7EBr2vAXkQmA_-Qz5uE0vKzkaQ-BlVYqGl8Cv4CjjPuZFHvOy56JP_Wntlx17w3orpNKFxkt-teyLHOOgoy-wNt8dvNxBzcLoc9Hx9kofyw4-S
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 302 Found
server: nginx/1.19.1
date: Thu, 05 Jan 2023 14:31:33 GMT
content-type: text/html; charset=utf-8
content-length: 856
location: http://s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm
200 OK 1.1 kB URL HTTP/1.1 s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm
IP
ASN #60781 LeaseWeb Netherlands B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (1483)
Hash e3a75013e20735ee33646f1de1241264
872ab1b3b2ae5bf3b3e28d6dd51dca6dfb1eee66
da6afed6713a843240e64b02089591b0ba09812f7f62375561444d5f19988eb2
GET /cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm HTTP/1.1
Host: s.optnx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2263b6df45285fe9.058767913857748639%22%3B%7D; expires=Sat, 04 Jan 2025 14:31:33 GMT; path=; domain=.optnx.com;
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm&p=http%3A%2F%2Fadeum.click&tested=1&check=0c1c5c30286e1db21a741e4b62c8b6e4&screen_resolution=1280x1024&container_resolution=1280x939&iframe=0
302 Found 0 B URL HTTP/1.1 s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm&p=http%3A%2F%2Fadeum.click&tested=1&check=0c1c5c30286e1db21a741e4b62c8b6e4&screen_resolution=1280x1024&container_resolution=1280x939&iframe=0
IP
ASN #60781 LeaseWeb Netherlands B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm&p=http%3A%2F%2Fadeum.click&tested=1&check=0c1c5c30286e1db21a741e4b62c8b6e4&screen_resolution=1280x1024&container_resolution=1280x939&iframe=0 HTTP/1.1
Host: s.optnx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.optnx.com/cimp.php?data=TVRZM01qa3lPVEE1TW53ME1ERXlZakZpWldNeVpqazVPV1poWkRBNE16UTJNRFZtTW1ObFl6UTROQS0tfGh0dHA6Ly9ldS5kc3BtZWdhLmNvbS9hcGkvc3VibWl0X2Zvcm1fcmVxdWVzdD9wPTNjNTFhNDgzLTE1YTYtNDc1OC1iZTZiLTNkYTNlNWZmMjc1OCZ0cz0xNjcyOTI5MDkyJno9NDIzNzM2OCZleG9fY2lkPTM0MDk2Mjd8aHR0cHw5MS45MC40Mi4xNTR8Tk9SfDQxfGFkZXVtLmNsaWNrfDQ5NDIyNHw3MTIxOTJ8OTE0ODYyfDQyODAyODZ8NTExfDM0MDk2Mjd8MzUxNDgxMzV8NDB8M3wwfDB8MjUzNDR8NTE2MTIwfDM1LjI4fDcwfFVTRHxVU0R8MXwxfDIyfHwxfE5PUnx8ODR8MnwwfHxLQ1FZYm5EeGRabmFValhXNXlFckVofDE5ZTBhM2QzZTk1NGY4OTEwZGRkN2QyMGIxMWM5NWVlfDF8MHxwcy5wb3BjYXNoLm5ldHwwfDB8MHwwLjAzfDF8MHxleGNoYW5nZV9saW5rfDB8MHwwfC0xfDJ8MHx8fDJ8MTQ0MHx8MHwwfDB8MHwwfDB8MXwwfHw4fDF8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NDsgcnY6MTA1LjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvMTA1LjB8fE9LfDkwNWNiZjNlZjE2OGM1OTZkOTAzZmI5MTUxNzU5Yjhm
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2263b6df45285fe9.058767913857748639%22%3B%7D
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2263b6df45285fe9.058767913857748639%22%3B%7D; expires=Sat, 04 Jan 2025 14:31:33 GMT; path=; domain=.optnx.com;
Location: http://eu.dspmega.com/api/submit_form_request?p=3c51a483-15a6-4758-be6b-3da3e5ff2758&ts=1672929092&z=4237368&exo_cid=3409627&exffir=eyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-
X-Robots-Tag: noindex, follow
eu.dspmega.com/api/submit_form_request?p=3c51a483-15a6-4758-be6b-3da3e5ff2758&ts=1672929092&z=4237368&exo_cid=3409627&exffir=eyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-
200 OK 4.5 kB URL HTTP/1.1 eu.dspmega.com/api/submit_form_request?p=3c51a483-15a6-4758-be6b-3da3e5ff2758&ts=1672929092&z=4237368&exo_cid=3409627&exffir=eyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3500)
Hash 60dea2e1e6f9613a6003759ddcb7b8bd
2c2d5f2e5bbef722f9d267ca0d44cfc419798852
eda292d5b364de2e5ab80f874170232e50549810f4dbbe118adb9fbf90c83491
Analyzer Verdict Alert quad9 Sinkholed
GET /api/submit_form_request?p=3c51a483-15a6-4758-be6b-3da3e5ff2758&ts=1672929092&z=4237368&exo_cid=3409627&exffir=eyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0- HTTP/1.1
Host: eu.dspmega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://s.optnx.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Timing-Allow-Origin: *
eu.dspmega.com/api/win_request?ad_scheme=1&p=3c51a483-15a6-4758-be6b-3da3e5ff2758&hil=1&ng=1&ix=0&pt=0&np=0&nw=1&nb=1&sw=1280&sh=1024&pl=http%3A%2F%2Feu.dspmega.com%2Fapi%2Fsubmit_form_request%3Fp%3D3c51a483-15a6-4758-be6b-3da3e5ff2758%26ts%3D1672929092%26z%3D4237368%26exo_cid%3D3409627%26exffir%3DeyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&navlng=en-US&rf=http%3A%2F%2Fs.optnx.com%2F&wgl=
301 Moved Permanently 175 B URL HTTP/1.1 eu.dspmega.com/api/win_request?ad_scheme=1&p=3c51a483-15a6-4758-be6b-3da3e5ff2758&hil=1&ng=1&ix=0&pt=0&np=0&nw=1&nb=1&sw=1280&sh=1024&pl=http%3A%2F%2Feu.dspmega.com%2Fapi%2Fsubmit_form_request%3Fp%3D3c51a483-15a6-4758-be6b-3da3e5ff2758%26ts%3D1672929092%26z%3D4237368%26exo_cid%3D3409627%26exffir%3DeyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&navlng=en-US&rf=http%3A%2F%2Fs.optnx.com%2F&wgl=
IP
File type HTML document, ASCII text
Hash 301ddd194e8c44d57741eb83d78c2897
6bf77c0264e7973a42173768448925af4fda4ab6
447da4359206d484a3c86bd2c15e927533144d5130706f2f52972406662b4aec
Analyzer Verdict Alert quad9 Sinkholed
GET /api/win_request?ad_scheme=1&p=3c51a483-15a6-4758-be6b-3da3e5ff2758&hil=1&ng=1&ix=0&pt=0&np=0&nw=1&nb=1&sw=1280&sh=1024&pl=http%3A%2F%2Feu.dspmega.com%2Fapi%2Fsubmit_form_request%3Fp%3D3c51a483-15a6-4758-be6b-3da3e5ff2758%26ts%3D1672929092%26z%3D4237368%26exo_cid%3D3409627%26exffir%3DeyJjIjoiMGMxYzVjMzAyODZlMWRiMjFhNzQxZTRiNjJjOGI2ZTQiLCJ0IjoiMSIsInNyIjoiMTI4MHgxMDI0IiwiY3IiOiIxMjgweDkzOSIsImkiOiIwIn0-&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&navlng=en-US&rf=http%3A%2F%2Fs.optnx.com%2F&wgl= HTTP/1.1
Host: eu.dspmega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://eu.dspmega.com/api/reverse?var=4237368&feedId=747
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 175
Connection: keep-alive
Location: https://eu.can-get-so.me/pr?ids=wbwsdgevdua&hash=9d2e850da28b60f5&ext_req_id=634873238379835392&subid1=4237368&cost=0.001260
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Timing-Allow-Origin: *
eu.dspmega.com/favicon.ico
404 Not Found 19 B URL HTTP/1.1 eu.dspmega.com/favicon.ico
IP
Hash 595e88012a6521aae3e12cbebe76eb9e
da3968197e7bf67aa45a77515b52ba2710c5fc34
b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: eu.dspmega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://eu.dspmega.com/api/reverse?var=4237368&feedId=747
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 19
Connection: keep-alive
X-Content-Type-Options: nosniff
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8ba913b21738b46d129b38ec3a05a631
7309985e0b44277a37cccde55e9bb2f4a7137e03
3c7bf008751445d011b09ba10d3dab488581e7b05e4a4b92525ec0c4bbd6b00c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C7BF008751445D011B09BA10D3DAB488581E7B05E4A4B92525EC0C4BBD6B00C"
Last-Modified: Wed, 04 Jan 2023 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5843
Expires: Thu, 05 Jan 2023 16:08:56 GMT
Date: Thu, 05 Jan 2023 14:31:33 GMT
Connection: keep-alive
eu.can-get-so.me/pr?ids=wbwsdgevdua&hash=9d2e850da28b60f5&ext_req_id=634873238379835392&subid1=4237368&cost=0.001260
302 Found 0 B URL HTTP/2 eu.can-get-so.me/pr?ids=wbwsdgevdua&hash=9d2e850da28b60f5&ext_req_id=634873238379835392&subid1=4237368&cost=0.001260
IP
ASN #24940 Hetzner Online GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pr?ids=wbwsdgevdua&hash=9d2e850da28b60f5&ext_req_id=634873238379835392&subid1=4237368&cost=0.001260 HTTP/1.1
Host: eu.can-get-so.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://eu.dspmega.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Thu, 05 Jan 2023 14:31:33 GMT
content-length: 0
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
referrer-policy: no-referrer
location: http://35.227.234.222/2/PU_NO_CS_DT_KINDRED_?source=684134&geo=NO&device=desktop
set-cookie: rauid=twP8Ofy_SdmAGkYWOPYc_w; expires=Fri, 05 Jan 2024 14:31:33 GMT; path=/; secure; SameSite=None
X-Firefox-Spdy: h2
35.227.234.222/2/PU_NO_CS_DT_KINDRED_?source=684134&geo=NO&device=desktop
302 Found 0 B URL HTTP/1.1 35.227.234.222/2/PU_NO_CS_DT_KINDRED_?source=684134&geo=NO&device=desktop
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /2/PU_NO_CS_DT_KINDRED_?source=684134&geo=NO&device=desktop HTTP/1.1
Host: 35.227.234.222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 05 Jan 2023 14:31:33 GMT
Content-Length: 0
Location: https://adserving.unibet.com/redirect.aspx?bid=37672&pid=79982261&sref=GIG&GIG=NO_MOBILE_CASINO
Via: 1.1 google
adserving.unibet.com/redirect.aspx?bid=37672&pid=79982261&sref=GIG&GIG=NO_MOBILE_CASINO
307 Temporary Redirect 0 B URL HTTP/2 adserving.unibet.com/redirect.aspx?bid=37672&pid=79982261&sref=GIG&GIG=NO_MOBILE_CASINO
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect.aspx?bid=37672&pid=79982261&sref=GIG&GIG=NO_MOBILE_CASINO HTTP/1.1
Host: adserving.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 307 Temporary Redirect
content-type: text/html
content-length: 0
location: https://www.unibet.nu/stan/campaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672
p3p: CP="This is not a P3P policy! It is used to bypass IEs problematic handling of cookies"
x-aspnet-version: 4.0.30319
request-context: appId=cid-v1:83ffbda4-9458-475e-90ec-4427cfb5c3b0
access-control-expose-headers: Request-Context
expires: Thu, 05 Jan 2023 14:31:33 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Thu, 05 Jan 2023 14:31:33 GMT
set-cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a91003245%2c%22BID%22%3a37672%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1672929093824)%5c%2f%22%2c%22CookieTag%22%3a%223767291003245451240919C2023151431%22%7d%5d; SameSite=None;; domain=.unibet.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure
NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%228649688245%7c1%22%7d%5d; domain=.unibet.com; expires=Sat, 05-Jan-3022 14:31:33 GMT; path=/; secure; SameSite=Strict
server-timing: edge; dur=1, origin; dur=66, cdn-cache; desc=MISS
X-Firefox-Spdy: h2
www.unibet.nu/stan/campaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672
301 Moved Permanently 0 B URL HTTP/2 www.unibet.nu/stan/campaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/campaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672 HTTP/1.1
Host: www.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Thu, 05 Jan 2023 14:31:33 GMT
content-length: 0
location: https://www.unibet.nu:443/stan/redirecttocampaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672&landingPageUrl=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672
set-cookie: JSESSIONID=node01m3gs95u5dv7k1u4danx451xhv6126673.node0; Path=/stan; Secure; HttpOnly; SameSite=Strict
__ucbt=node01m3gs95u5dv7k1u4danx451xh; Path=/; Domain=.unibet.nu; Expires=Sat, 04-Jan-2025 14:31:33 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr=ST.0.T; Path=/; Domain=.unibet.nu; Expires=Sat, 04-Jan-2025 14:31:33 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr_ref=; Path=/; Domain=.unibet.nu; Expires=Sat, 04-Jan-2025 14:31:33 GMT; Max-Age=63072000; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
affid=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
netwid=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
CLAIM_CODE=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
campaignId=2750544; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.unibet.nu; Expires=Thu, 05-Jan-2023 14:31:48 GMT; Max-Age=15; Secure; SameSite=None
affiliateId=1; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BID=37672; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
PID=91003245; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
CHID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REFERER=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_ACCEPTED=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_DECLINED=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BOCAID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
PRODUCT_ID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFID=; Path=/; Domain=.unibet.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=2750544; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.unibet.nu; Expires=Thu, 05-Jan-2023 14:31:48 GMT; Max-Age=15; Secure; SameSite=None
campaignId=2750544; Path=/; Domain=.unibet.nu; Expires=Sun, 31-Dec-2023 22:58:59 GMT; Max-Age=31134446; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.unibet.nu; Expires=Thu, 05-Jan-2023 14:31:48 GMT; Max-Age=15; Secure; SameSite=None
clientId=polopoly_desktop; Domain=www.unibet.nu; Path=/; SameSite=None; Secure
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT, Thu, 05 Jan 2023 14:31:33 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
x-ooops-debug: /500-pages/www.unibet.nu/index.html
X-Firefox-Spdy: h2
www.unibet.nu/stan/redirecttocampaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672&landingPageUrl=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672
301 Moved Permanently 0 B URL HTTP/2 www.unibet.nu/stan/redirecttocampaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672&landingPageUrl=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/redirecttocampaign.do?cmpId=2750544&affiliateId=1&unibetTarget=/nu/pop/casino/bookofdead/2023/index.html&targetDomain=https://welcome.unibet.nu&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&sref=GIG&GIG=NO_MOBILE_CASINO&affiliateId=1&pid=91003245&bid=37672&landingPageUrl=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672 HTTP/1.1
Host: www.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544; clientId=polopoly_desktop
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 301 Moved Permanently
date: Thu, 05 Jan 2023 14:31:34 GMT
content-length: 0
location: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Thu, 05 Jan 2023 14:31:34 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
x-ooops-debug: /500-pages/www.unibet.nu/index.html
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/sofort-logo.png
200 OK 6.3 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/sofort-logo.png
IP
File type PNG image data, 200 x 63, 8-bit/color RGBA, non-interlaced\012- data
Hash 31ac3078aee688d28525b413b162067e
f39632d17ec3189f63d32cc9a050caf03c2c9904
2671d5e75f7d9928a374a5d8b4d1e9d0b4178ca90c67e553aa2bb2d4a75c8513
GET /nu/pop/casino/bookofdead/2023/sofort-logo.png HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/png
content-length: 6286
cache-control: public, max-age=900, immutable
content-md5: MawweK7miNKFJbQTsWIGfg==
last-modified: Wed, 21 Dec 2022 12:49:15 GMT
etag: "0x8DAE351C458438A"
x-ms-request-id: f178592c-201e-0016-51e9-17e4d5000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb184ecab4f4-OSL
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-trust.svg
200 OK 1.1 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-trust.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (1066), with no line terminators
Hash 6eda21395a7392987aba2e1a700f2484
436ec94373f1693c2ff3bf6b85909660d6cdcda5
4cf3c83c7fc9bcad493ec137adb6adb1aa5056e56e341442ee335c4bcfd3672f
GET /nu/pop/casino/bookofdead/2023/icon-trust.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: 9k4H3E55HXB5I94VinrUOQ==
last-modified: Wed, 21 Dec 2022 12:49:13 GMT
etag: W/"0x8DAE351C33B3D6B"
x-ms-request-id: 92037f3b-801e-0030-2fe9-17accd000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb185ecfb4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 561e959ce9eff04b09da6f3def82f549
7866f989cdfb160709f4c93b767fd01e5553d75b
9076b4ae1a34ab02b362ffa44ecbf6d579f82042cfd7e7138977477ea5bd3e61
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
IP
File type ASCII text, with very long lines (65451)
Hash 0f83cadc148d2ad7e53c91f6c4ee05bb
90035c5fffedf4b0f099465f6b929a030b46c92b
3f59aa77bbbed7760a9968af27d3c19ffddda021c948edf0bf0c0f828dd308ae
GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 02 Jan 2023 23:25:23 GMT
expires: Tue, 02 Jan 2024 23:25:23 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 227171
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
200 OK 956 B URL HTTP/2 a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
IP
ASN #47171 Unibet Services Limited
Hash fd48e87ecd4d06d9c5df490b91dc813e
a65a437db44444634e4f41732c590c1d14433b3f
2f786ae3f4577ed970f60aa7a9edf726300a740fdb360a8364db7ff4b7ca8e47
GET /unibet/bannerflow/scripts/master_tag.js HTTP/1.1
Host: a1s-cdn.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/javascript
content-length: 956
last-modified: Mon, 25 Apr 2022 12:19:34 GMT
etag: "3bc-5dd7996cc0ce1"
cache-control: max-age=1800, public, must-revalidate
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s-cdn.unibet.com; Path=/; SameSite=None; Secure
accept-ranges: bytes
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/com-payments.svg
200 OK 10 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/com-payments.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 760c21f01f7f358631a643a67046348f
611aae12fe838178c6c26efbf7da57d5d681f69b
a348933b3aa72b16951ccfab878642e0851498269c0b9a37e70aaa9a307c0ba6
GET /nu/pop/casino/bookofdead/2023/com-payments.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: vwb7ospRft2xzGDtJvR3WA==
last-modified: Wed, 21 Dec 2022 12:49:10 GMT
etag: W/"0x8DAE351C1959348"
x-ms-request-id: 204f0846-701e-000b-48e9-17e969000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb186ef6b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 561e959ce9eff04b09da6f3def82f549
7866f989cdfb160709f4c93b767fd01e5553d75b
9076b4ae1a34ab02b362ffa44ecbf6d579f82042cfd7e7138977477ea5bd3e61
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gambling-commission.png
404 Not Found 286 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gambling-commission.png
IP
File type XML 1.0 document text\012- XML document, Unicode text, UTF-8 (with BOM) text
Size 286 kB (285691 bytes)
Hash 872a0884a22d403754c679defb37cdf9
950f7cfea14530057b630a43a2a3271ca457e118
c992295337da53c2b80c086e7c0ed690f59df7eca42cfbc196ceae9e96e7a4cc
GET /nu/pop/casino/bookofdead/2023/gambling-commission.png HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/xml
x-ms-request-id: 5eb634bb-201e-0006-0111-2121bd000000
x-ms-version: 2014-02-14
access-control-allow-origin: *
cf-cache-status: HIT
age: 291
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb186ee7b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/Unibet_Pro_2020.woff2
200 OK 11 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/Unibet_Pro_2020.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 10924, version 1.0\012- data
Hash 0ea5bcff84ae44840b6e9c9d12c8b963
6c827e1adb18775d2fdfbbbfef63cc9b66243ed2
b4e210ac58fe8fb176e24c58ffdbd0e7b40dded1314769dbcebdc413998b882b
GET /nu/pop/casino/bookofdead/2023/Unibet_Pro_2020.woff2 HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/1-styles.css
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/font-woff2
content-length: 10924
cache-control: public, max-age=900, immutable
content-md5: DqW8/4SuRIQLbpydEsi5Yw==
last-modified: Wed, 21 Dec 2022 12:49:14 GMT
etag: "0x8DAE351C4330DBA"
x-ms-request-id: 99cea916-301e-0068-6308-1b7492000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 58953
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb19b8c3b4f4-OSL
X-Firefox-Spdy: h2
use.fontawesome.com/releases/v5.7.1/webfonts/fa-solid-900.woff2
200 OK 74 kB URL HTTP/2 use.fontawesome.com/releases/v5.7.1/webfonts/fa-solid-900.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 74320, version 329.30998\012- data
Hash 3638e62ea50e6f5859b6a15276c25c87
f5aa1a463e223a294a42b314e1c63a614d594ec0
9e6bd5b2d75bba485d2337d020750744983a3521ec697adfe21b29ee4f14f6a9
GET /releases/v5.7.1/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: font/woff2
content-length: 74320
x-amz-id-2: ppGVKPw/BRC2L9MKavpKwgcUU9yz7XdTp5v1IrqUmoPRr5hKbXwoGlHls96saNXW6IOyOoIc1RQ=
x-amz-request-id: 9MMAS2YF7VJQCDKE
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 30 Jun 2021 15:45:57 GMT
etag: "3638e62ea50e6f5859b6a15276c25c87"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 469625
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tzTzxOUrblkBo6xwvGQIp%2Faaff9yOQauNv3z7Sz%2BPrauewQpVAlZNWAo6JFqIW6MYEymgpEEIQWi2HMZFcgFoDggt2u%2BweTJxvz6U1qfJ%2F8XY8QmwJCg04Te9W6%2F3ZmSlMcR7h9V"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 784ceb19cf6471bc-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/1-styles.css
200 OK 5.4 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/1-styles.css
IP
Hash 439e89c70a61806cf6fc8703cce76e8f
f1919283cd74361d9dda9d6bee58717f34de7697
e145bb8f49768a47fd1ef414c178f707f932ac18585adf89511a908b528bd4d5
GET /nu/pop/casino/bookofdead/2023/1-styles.css HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: text/css; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: MET9VhdZCoF3PKK/Q9YAzg==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
etag: W/"0x8DAE351C0B036D8"
x-ms-request-id: 4bdcda55-f01e-003a-49e9-17087a000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340786
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb183eb5b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash a430d46fb27196c8b03f382c1bafbb23
0b31940d1067eb87c24c6d356689d7f9f90231a6
3e9cd331b1c2c1eca94ff12ec1b685e1c1c1909e30e8b3cf4493dc6eac786df8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5dcd3e3f6440384500af24c809a3f175
3a5df7e2369c9d65865d73410b0cac87e1b5a54c
b7c5a41dbd443dcb04231372b9ac63a3853d57e43941af5b22073693291099df
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-sports.svg
200 OK 9.4 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-sports.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (1481), with no line terminators
Hash ef87665f519151eea203ccc559ac841e
caae993638d5aaf1bc60d989a8a7cc6002425130
0675d299e34893d4498b14ff11ef15a161c01b0c4e6a37bdd7c8dd4482330d31
GET /nu/pop/casino/bookofdead/2023/icon-sports.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: Kch+tYuo05USS5JaESq1rA==
last-modified: Wed, 21 Dec 2022 12:49:13 GMT
etag: W/"0x8DAE351C388DCE4"
x-ms-request-id: b12efe15-c01e-001e-03e9-17feda000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb185edcb4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Jan 2023 19:33:56 GMT
expires: Thu, 04 Jan 2024 19:33:56 GMT
cache-control: public, max-age=31536000
age: 68258
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Jan 2023 19:33:54 GMT
expires: Thu, 04 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 68260
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Jan 2023 19:34:15 GMT
expires: Thu, 04 Jan 2024 19:34:15 GMT
cache-control: public, max-age=31536000
age: 68239
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
a1s.unibet.com/orval/tracking/lastclick.min.js
200 OK 83 kB URL HTTP/2 a1s.unibet.com/orval/tracking/lastclick.min.js
IP
ASN #47171 Unibet Services Limited
Hash 2f761c7571c1e7c8e5830c4d64fe1b96
37f77a4af07a69accc1028cc953dc4fab6433dff
9b8fdbcd7695f13cd65c15eadb2c58afa69c6a951bfe318b8daddec243082b05
GET /orval/tracking/lastclick.min.js HTTP/1.1
Host: a1s.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 05 Aug 2022 12:55:42 GMT
etag: W/"705-5e57dfbd5830d"
cache-control: max-age=1800, public, must-revalidate
content-encoding: gzip
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s.unibet.com; Path=/; SameSite=None; Secure
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5dcd3e3f6440384500af24c809a3f175
3a5df7e2369c9d65865d73410b0cac87e1b5a54c
b7c5a41dbd443dcb04231372b9ac63a3853d57e43941af5b22073693291099df
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/darts-european.svg
200 OK 2.9 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/darts-european.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (6190), with no line terminators
Hash 48fa08fa4ae957fe67041a26d6ce5538
ec2e8f6f5dc5f2548c1820dd842057cdadc9bc35
8311da3381fe1672a3cb3cf2009fdfe87c8e4bc3f6c4fe35af23f7248adc4bff
GET /nu/pop/casino/bookofdead/2023/darts-european.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: zoYCq/GGL4hzx6fLGfy4TA==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
etag: W/"0x8DAE351C0DB5F35"
x-ms-request-id: 2d2dcec5-101e-0022-33dd-16d71d000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb1a093bb4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-expert.svg
200 OK 889 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/icon-expert.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (966), with no line terminators
Hash 76b6d6a375bb8c0a089bc8e116b20f3a
3a8f126f5c8e9065a348d45e61ed6066fee52cef
a236ddb7177af590c86829609fa637448ab44124c449702eecb1588518d68578
GET /nu/pop/casino/bookofdead/2023/icon-expert.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: Z4302O+bSqlX5UM92U+35A==
last-modified: Wed, 21 Dec 2022 12:49:13 GMT
etag: W/"0x8DAE351C3426860"
x-ms-request-id: d58c5460-101e-0022-5fe9-17d71d000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb185ed8b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
secure.adnxs.com/seg?add=9755599
307 Redirection 0 B URL HTTP/1.1 secure.adnxs.com/seg?add=9755599
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /seg?add=9755599 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Thu, 05 Jan 2023 14:31:34 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D9755599
AN-X-Request-Uuid: 110781c8-a7ad-4f2e-a1d3-c70a8bcfbd69
Set-Cookie: uuid2=4647342465738559862; SameSite=None; Path=/; Max-Age=7776000; Expires=Wed, 05-Apr-2023 14:31:34 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
ocsp.digicert.com/
200 OK 471 B IP
Hash d845c87c11854453c0e2d933c4c342e9
bae86d31c52f9b274e7e9cfd41890dd51d552f1d
57afc76578e0b65fed6d8a002454a04a387d20d6d08ecf727f3afa7d46ec882e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2209
Cache-Control: max-age=144728
Content-Type: application/ocsp-response
Date: Thu, 05 Jan 2023 14:31:35 GMT
Etag: "63b668ff-1d7"
Expires: Sat, 07 Jan 2023 06:43:43 GMT
Last-Modified: Thu, 05 Jan 2023 06:06:55 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 471
secure.adnxs.com/bounce?%2Fseg%3Fadd%3D9755599
200 OK 43 B URL HTTP/1.1 secure.adnxs.com/bounce?%2Fseg%3Fadd%3D9755599
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 592ebefc7104d681d57852665e9ad514
15cdf8df32aa251dd6dd590a60bf9cf74474e7c5
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
GET /bounce?%2Fseg%3Fadd%3D9755599 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.unibet.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Thu, 05 Jan 2023 14:31:35 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
AN-X-Request-Uuid: 5ad6e03f-c03f-4c5c-bb48-932960b7187f
Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2Hc'KQD!Z!@wnf-Te9(>wL5L!!'TG$k%IC; SameSite=None; Path=/; Max-Age=7776000; Expires=Wed, 05-Apr-2023 14:31:35 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1672929084666
200 OK 499 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1672929084666
IP
File type JSON data\012- , ASCII text, with very long lines (791), with no line terminators
Hash 08431cbaf7ecca9e624161856264714b
9d4a87e35bed213d9f2a38ae113eaf590750a9c8
a97b3d1e6ffafc8cee04ed4ef7058f96fddc201530f501320a73b82ea5f823ec
GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1672929084666 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.unibet.nu
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v045-03c381005.edge-irl1.demdex.com 5 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=31622686092494963710691223775253919785; Max-Age=15552000; Expires=Tue, 04 Jul 2023 14:31:35 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: Y2wM4VtRSa0=
Content-Length: 499
Connection: keep-alive
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/1-main.js
200 OK 18 kB URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/1-main.js
IP
File type Unicode text, UTF-8 text, with very long lines (1847)
Hash 486ece5ec0185c65b63432ed2693a928
80e870dcf9e2b90474ed591674b9a6c7b303fb75
a6a5687241bba20b8b7d41c8d4e3e52e728c180c29d6d070e315f2ecd1e46849
GET /nu/pop/casino/bookofdead/2023/1-main.js HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: sG6NdEOwHxesoMipEBfQ1Q==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
etag: W/"0x8DAE351C0EDD315"
x-ms-request-id: f65428b6-601e-0065-02e9-17bc46000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340786
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb184eb8b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=31650272245058234000691713394807604658&ts=1672929084902
200 OK 2 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=31650272245058234000691713394807604658&ts=1672929084902
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=31650272245058234000691713394807604658&ts=1672929084902 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://welcome.unibet.nu
access-control-allow-credentials: true
date: Thu, 05 Jan 2023 14:31:35 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
unibet.demdex.net/dest5.html?d_nsid=0
200 OK 2.8 kB URL HTTP/1.1 unibet.demdex.net/dest5.html?d_nsid=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Hash ccbdcb1e84c241950763ec4cd516cdfc
55dfa8d4b09c5c3a80fcd101152f6ebed3d27a2c
de9ccb9b168945a24f20edc28c39be4135b328129ba8ee378401a7aedc925d12
GET /dest5.html?d_nsid=0 HTTP/1.1
Host: unibet.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Thu, 5 Jan 2023 14:31:35 GMT
DCS: dcs-prod-irl1-2-v045-08dd6474c.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 28 Oct 2022 11:22:24 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: 2YepdXgZRr0=
Content-Length: 2791
Connection: keep-alive
unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonunibetwebprod/1/JS-2.22.4/s07173300495183?AQB=1&ndh=1&pf=1&t=5%2F0%2F2023%2014%3A31%3A25%204%200&mid=31650272245058234000691713394807604658&aamlh=6&ce=UTF-8&pageName=LP%3A2019%20-%20Casino%20-%20Book%20of%20Dead&g=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&v1=welcome.unibet.nu%3A%3A%3Adesktop%3Anu%3Apop%3Acasino%3Abookofdead%3A2023%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.unibet.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=2%3A31%20PM%7CThursday&v6=2%3A31%20PM%7CThursday&v11=GBP&c14=New&v14=New&c16=1672929085&v21=Not%20Logged-In&c73=unibet&v120=affiliate&v121=1%3A320669908%3A91003245-37672&v122=NONE&v124=2750544&v125=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&v126=91003245&v127=37672&v134=1672929084&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
200 OK 43 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonunibetwebprod/1/JS-2.22.4/s07173300495183?AQB=1&ndh=1&pf=1&t=5%2F0%2F2023%2014%3A31%3A25%204%200&mid=31650272245058234000691713394807604658&aamlh=6&ce=UTF-8&pageName=LP%3A2019%20-%20Casino%20-%20Book%20of%20Dead&g=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&v1=welcome.unibet.nu%3A%3A%3Adesktop%3Anu%3Apop%3Acasino%3Abookofdead%3A2023%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.unibet.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=2%3A31%20PM%7CThursday&v6=2%3A31%20PM%7CThursday&v11=GBP&c14=New&v14=New&c16=1672929085&v21=Not%20Logged-In&c73=unibet&v120=affiliate&v121=1%3A320669908%3A91003245-37672&v122=NONE&v124=2750544&v125=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&v126=91003245&v127=37672&v134=1672929084&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
IP
File type GIF image data, version 89a, 2 x 2\012- data
Hash ad480fd0732d0f6f1a8b06359e3a42bb
a544538683a2dfe574eeb2e358ac8fcc78289d50
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
GET /b/ss/unibetlondonunibetwebprod/1/JS-2.22.4/s07173300495183?AQB=1&ndh=1&pf=1&t=5%2F0%2F2023%2014%3A31%3A25%204%200&mid=31650272245058234000691713394807604658&aamlh=6&ce=UTF-8&pageName=LP%3A2019%20-%20Casino%20-%20Book%20of%20Dead&g=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.unibet.nu%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%3Fmktid%3D1%3A320669908%3A91003245-37672%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26bid%3D37672%26campaignId%3D2750544%26pid%3D91003245&v1=welcome.unibet.nu%3A%3A%3Adesktop%3Anu%3Apop%3Acasino%3Abookofdead%3A2023%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.unibet.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=2%3A31%20PM%7CThursday&v6=2%3A31%20PM%7CThursday&v11=GBP&c14=New&v14=New&c16=1672929085&v21=Not%20Logged-In&c73=unibet&v120=affiliate&v121=1%3A320669908%3A91003245-37672&v122=NONE&v124=2750544&v125=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&v126=91003245&v127=37672&v134=1672929084&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
date: Thu, 05 Jan 2023 14:31:35 GMT
expires: Wed, 04 Jan 2023 14:31:35 GMT
last-modified: Fri, 06 Jan 2023 14:31:35 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3592587876397023232-4619365509109756115
vary: *
content-type: image/gif;charset=utf-8
content-length: 43
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 9e7a873bab219c26e7c1996b7b6a2bd4
d6bbaf9f2885c491d4dd37bba2de42fcf423ff50
d6eaf63c5e1abbc355bd243a9409d3939b4b97b7ee59237fb1431d2fe6ba9053
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=86674
Date: Thu, 05 Jan 2023 14:31:35 GMT
Etag: "63b5869e-1d7"
Expires: Fri, 06 Jan 2023 14:36:09 GMT
Last-Modified: Wed, 04 Jan 2023 14:01:02 GMT
Server: ECS (nyb/1D06)
X-Cache: Miss from cloudfront
Via: 1.1 5de23153ac267c206221751e1cccb6e8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: qxbmqaRnCuoxWr7t2tPR9pgNPEwSPfh2e6F7xIJRNeFo__nNP4xijg==
Age: 2107
cm.everesttech.net/cm/dd?d_uuid=31622686092494963710691223775253919785
302 0 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=31622686092494963710691223775253919785
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cm/dd?d_uuid=31622686092494963710691223775253919785 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302
Date: Thu, 05 Jan 2023 14:31:35 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~Y7bfRwAAAF4XyANn; Domain=.everesttech.net; Expires=Fri, 05-Jan-2024 14:31:35 GMT; Path=/
everest_session_v2=Y7bfRwAAAF4XyQNn; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
Server: AMO-cookiemap/1.1
dpm.demdex.net/ibs:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/ibs:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ibs:dpid=411&dpuuid=Y7bfRwAAAF4XyANn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.unibet.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-2-v045-071cdea73.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=85454988345300265303252979301399085943; Max-Age=15552000; Expires=Tue, 04 Jul 2023 14:31:35 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ybY156BDQEo=
Content-Length: 0
Connection: keep-alive
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
200 OK 59 B URL HTTP/1.1 dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y7bfRwAAAF4XyANn
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y7bfRwAAAF4XyANn HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.unibet.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-1-v045-07e4ed132.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: oC3RrLeuSSw=
Content-Length: 59
Connection: keep-alive
www.ohrockaround.com/rc/d92944b1c7?af5=offer-campaign-not_valid
200 OK 0 B URL HTTP/2 www.ohrockaround.com/rc/d92944b1c7?af5=offer-campaign-not_valid
IP
Analyzer Verdict Alert fortinet Malware
GET /rc/d92944b1c7?af5=offer-campaign-not_valid HTTP/1.1
Host: www.ohrockaround.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:29 GMT
content-type: text/html; charset=utf-8
set-cookie: AWSALB=50rvEjPosPJesVS4x2xoRe3mVPB0U2GErPUQy1gpk6phf1o+nE00j4BKuibEnoTF92vznv8rf2SoRuQANZUCLNEMg5H7gonmD7xjh/pqhI7MgSqBSlMDDXN8UoLK; Expires=Thu, 12 Jan 2023 14:31:29 GMT; Path=/
AWSALBCORS=50rvEjPosPJesVS4x2xoRe3mVPB0U2GErPUQy1gpk6phf1o+nE00j4BKuibEnoTF92vznv8rf2SoRuQANZUCLNEMg5H7gonmD7xjh/pqhI7MgSqBSlMDDXN8UoLK; Expires=Thu, 12 Jan 2023 14:31:29 GMT; Path=/; SameSite=None
vary: Accept-Encoding, Accept-Language, Cookie
content-language: en
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pTfWuxn3Hqg7p0MlD7Ehu9MjzXTAyEpjQ6epmxOPRXqOtm6yvX3DMtuccJSnfUkzVHfR8OWiPCJXRsVny5Kxi%2FEVF%2BgPGJYCqZjHD33WyuvF%2BMQmsf5uHv0%2Fg4rIlvVlt0o5tMzKbA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 784ceafb793b0b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=
200 OK 0 B URL HTTP/2 popmyads.com/serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20=
IP
GET /serve/52264/64661/szqpmqqoapdpgpq/aHR0cDovL3RyYWZmaXgxMy5jb20= HTTP/1.1
Host: popmyads.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ron.trffclb.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:31 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.1.33
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zNDugK7Qx4ze7YcNOK8GetLKxfk0ypvep93ztJh5s59olHq9I3n7fjzzJVAVvec75yagNf1th3PXTJU4wCJ9b5gPyqx5O7TEehwrMHwlwJ8Gta%2BWi6q9Et5MTcgw%2FYw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 784ceb05b98cb51b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/utv-logo.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/utv-logo.svg
IP
GET /nu/pop/casino/bookofdead/2023/utv-logo.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: QazcDvviTF55mXL/M8kCWQ==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
etag: W/"0x8DAE351C132C13F"
x-ms-request-id: fb37afd4-201e-005b-1ce9-172b39000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb184ec5b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/darts-premier-league.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/darts-premier-league.svg
IP
GET /nu/pop/casino/bookofdead/2023/darts-premier-league.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: tUWryfanLH11PuSSk/UuDw==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
etag: W/"0x8DAE351C1024279"
x-ms-request-id: 7f0ce38c-d01e-0012-7edd-1669d2000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 517336
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb1a093ab4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,500
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,500
IP
GET /css?family=Roboto:300,400,500 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 05 Jan 2023 14:31:34 GMT
date: Thu, 05 Jan 2023 14:31:34 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
adeumssp.com/smart?p=CsxnKsUCG9yw6Ygyhidzm6oiJ2jrV4PSrgPJitGQya&s=adeum.click
302 Found 0 B URL HTTP/2 adeumssp.com/smart?p=CsxnKsUCG9yw6Ygyhidzm6oiJ2jrV4PSrgPJitGQya&s=adeum.click
IP
ASN #24940 Hetzner Online GmbH
GET /smart?p=CsxnKsUCG9yw6Ygyhidzm6oiJ2jrV4PSrgPJitGQya&s=adeum.click HTTP/1.1
Host: adeumssp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ps.popcash.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Thu, 05 Jan 2023 14:31:32 GMT
content-type: text/html; charset=utf-8
location: https://fancycrab.net/click?a=Csxn&e=gAAAAABjtt9E5SWgURKvePbzD-c7MTaHpf6Hp9BUsK87JI4gn7RiNQbGJE9bvkl2EvWqmk40sVaU_ctIWFSdd6rJjU74GMe-eCsH_oSQnB7dB6TvN_14eIL-80Yqag8WawTQMND8xD_sfxFlMWmntQZZpx1TN2E2bi6AUfDajWseqeHj4u9Nb12tQyBdmd6sSbNGYE24I-Mz8EbjupUgogViXWMJxl1wnEHtCotqVvDc4oAdc1XXMcL5cz09ZHdfEaSLeZUloGLPTR1npstAeI2cKdoIaGD_5zAWmocNP4zhTV1OUQEEgAFcQzXYLvyJphDFY28-8t6sMnUfjzYZaL0QZ2xJ25KvLRTw5JBhBuKF6jcJuNWjOlkcdSQDAQMehtMf5Yw0R2ZCMizk-2Wnh00InYU4EoIfGcY9e5oR5J3WUBSqBCP29O4oYyYvhMkxBYTSybHdgJw6ctRi7tcZFYwsMd9dUcMau213kyN5iVj3M8-fnYCazaipVS10O2hGnztHslNfcghleLHQeJ--n1kdUJ_83_2zRK_F3fYzl3MG3Q3BX7biqf5jA0xEuZJq6gP3b9ZIRsWQoz1PsAIIq7-M58sEFBWHh8_0tBEYfUpslD8_ltJMNLR4s0oe3FkriB978OKgq7azWW1Cz3oJQuKUH28onrTCdmds8lMWbjBsk62acixgyHRgDFVWqzXWTIDccp47GY76q2N3Yg5J2jdhm5oQJ4aivwnBOucOGOGhr1qVF0Uj8OxswP_i9dVVPWt-Nzsbq880NFEQQwr71Tu_3lL-xOGr7arCxm5m5r9wXYeYz8u4zFin4lMTlt8kCutNaGT1Dwh2BwTRUSlLXRSCVvVFIobULFjLzw7xYHbx6hUEbdu7aGFS8GmaA7Y7OAjfypQ9RMpq_kcGLX_xDZ8fNEbsN2-5mc6_glhrf2i2R7U70HiDJm8RzoiRMeXISMnWsVtW0htIxZLxA8vuI-qhPiolhtmS3q-Q4C3hrDahTQljn4KGaFMSqfNnsKlsvRiJfU2M4QU83OpR7uWS6vgrT6tCABbSzpNumGKoa3wRRRI8ve0JGcTPexlIbVj_p8b1-3FYY33X1rzrdbjOQI507Dl26Ulp5DB224bce90Xk4sV3eQ0wWSIp9j-U6ep5ymr3BRtz1m-Qwe0VK7AuPp7AUol6ru6kr-CdkMuWhrnjJWj5IKrZQqEZLUfhUTsdVn5F_FUXjHUdoKGydODcOO7-i6SXeMQ_UNx9mg6GWjCAwL-tmnBy9x2zi2kO2WU7ZljlbVX6ne6gMTynaNnD4eHQngbI2WvOO5k6a3z1wq3m9AsfCvL9rsLWX8Q-LM0v8hKWJ0Qw80EsBT5l0bIRfRQg2cKueab3n2Rf84xVXAqhZP0g5CEEaNSCxy-V4Xht5-hmVPvzNRyLDhXlOfD9hokurCuDdiExvxJdKzsAGntrZdwTAGWOkN_6FRI3HITbKjDjRUlScjx9KEoIFC0XThF_LYsbDeFGNsrynPOc0ImSGufjtLW3fmlE-WAjqFZ6DUXR_7AjErvFcAgrx39cK2_hIK0m880oUq7JmumQr6O0Zny6YKj18pgljUUYvxehPFipPFLwqT2myt0Of7lQlXsz0seV9iBklCSpVSQ8ZhziMrDcy5KW6hvcvrdGApr-UogvKdH2VX894sIjiJA6E1DPHbTBxwZznyW7emMJyUJkNkguzCdLs2yH8SldfA8HI7Kip8EllzTjCRM402j7HkoAfkDobpub7wospyNcV3CjtzJCncOlOMV7sSEhZl5rHWKF0Ts-t29kF8ZOgsfkUIx1GP63d90Ui_t171IKmGZKF1WvanNm5U7C0ruDH03BFyrzjrJ9cLG8IrhTbPyaJE88iIPFjCGaaKglVNGZtiP8pTCoPNDku-IonokX3oh6FHdFTAduUS-t9O8XaO1yUQkNF1GOPuIv0bGUvo1_QE3QtUAfjQx6p1BWXen76fUltPRlGaLQBt1aOdMJLJUoSbqPZTnVB76RIqf_oFkhsnUbzQR1CDXaJwSwaV8rgiJz3q5rXStzMzcrlahGmraDkc9UB8Fmyzk1bci7V00ilOhCAeWT59Bdh5OabPoJBe6ZlLM5BhiGCsQrhrL2-iqFEjdnxap_B7EBr2vAXkQmA_-Qz5uE0vKzkaQ-BlVYqGl8Cv4CjjPuZFHvOy56JP_Wntlx17w3orpNKFxkt-teyLHOOgoy-wNt8dvNxBzcLoc9Hx9kofyw4-S
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
IP
GET /nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245 HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: text/html; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: GNyxnhDIawKMkSTrWvHPHw==
last-modified: Wed, 21 Dec 2022 12:49:09 GMT
x-ms-request-id: b1841657-e01e-006b-5a12-2195f6000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: MISS
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb163bd1b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/widget/betslip/betslip.js
200 OK 0 B URL HTTP/2 welcome.unibet.nu/widget/betslip/betslip.js
IP
GET /widget/betslip/betslip.js HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: V3DcYDl/+4NNEoCqe8670A==
last-modified: Tue, 15 Jan 2019 09:54:22 GMT
etag: W/"0x8D67ACF6D112CB5"
x-ms-request-id: 9491108d-c01e-000e-6d20-ff3bb2000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 101784
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb195854b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
cdn.addlnk.com/redirect.css
200 OK 0 B URL HTTP/2 cdn.addlnk.com/redirect.css
IP
GET /redirect.css HTTP/1.1
Host: cdn.addlnk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.ohrockaround.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:30 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=1680
etag: W/"3ae56d32551602b41f9046c14d1cfde2"
last-modified: Wed, 13 Mar 2019 00:03:12 GMT
x-amz-id-2: hoKGF2DENF0Fxpfk9aX2Txj0orTMbszygnDmGFSC4SoL/4C3WQsM9k4Y5ZmrshXNgXN64qzAUMY=
x-amz-request-id: 9NDC432NBG524RW1
cf-cache-status: HIT
age: 2804
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XutMndnk5lSXIgE1WmT0cjbNIyML%2B2%2FTTyKRqbHn43r8fz9B1IpXFArC%2Ft3IwhNNNYmYsxIJmzuw7dz88tHkz63iTxW%2FwvDUE9%2Fn3GH6PGIRAa9hKqDxNV%2FznLVZMuLv8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceafddab5b515-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
welcome.unibet.nu/custom.js
200 OK 0 B URL HTTP/2 welcome.unibet.nu/custom.js
IP
GET /custom.js HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: application/javascript
content-md5: e/Aekt1V1fopj1X7y5r9MA==
last-modified: Tue, 29 Mar 2022 08:25:09 GMT
etag: W/"0x8DA115DA300B0C1"
x-ms-request-id: 126f410e-701e-000b-2310-f9e969000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 161219
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb184ec0b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/unibet-logo.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/unibet-logo.svg
IP
GET /nu/pop/casino/bookofdead/2023/unibet-logo.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: cw5jdwcrd9gLyjDZb7Y7Jw==
last-modified: Wed, 21 Dec 2022 12:49:10 GMT
etag: W/"0x8DAE351C161B997"
x-ms-request-id: 2ab1bfc1-001e-0001-56e9-174dde000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb184ec2b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
script.crazyegg.com/pages/scripts/0012/9242.js?464702
200 OK 0 B URL HTTP/2 script.crazyegg.com/pages/scripts/0012/9242.js?464702
IP
GET /pages/scripts/0012/9242.js?464702 HTTP/1.1
Host: script.crazyegg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
ce-version: 11.5.16
cache-control: public, max-age=300, s-maxage=1209600
cf-bgj: minify
cf-polished: origSize=6088
last-modified: Sat, 24 Dec 2022 15:01:00 GMT
timing-allow-origin: *
cf-cache-status: HIT
age: 1035033
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb1acedcb500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gb-when-the-fun-stops.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gb-when-the-fun-stops.svg
IP
GET /nu/pop/casino/bookofdead/2023/gb-when-the-fun-stops.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: aKFt6UnI1NUrF+upCSAbIA==
last-modified: Wed, 21 Dec 2022 12:49:11 GMT
etag: W/"0x8DAE351C2138A7D"
x-ms-request-id: 453931fb-001e-002e-4ae9-174015000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 340779
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb186efab4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
use.fontawesome.com/releases/v5.7.1/css/all.css
200 OK 0 B URL HTTP/2 use.fontawesome.com/releases/v5.7.1/css/all.css
IP
GET /releases/v5.7.1/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://welcome.unibet.nu
Connection: keep-alive
Referer: https://welcome.unibet.nu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: text/css
x-amz-id-2: 8M6Q1H5gCir/8K3opYPWSWi6ak6v7pRjppSiUzXwJ+ziOTOLOq8XLoFlCBhwCt1Mmw571Hua/tI=
x-amz-request-id: G4EZSS2W45KJE18Z
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 30 Jun 2021 15:45:37 GMT
etag: W/"7b1d7f457d056ace7b230b587b9f3753"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 502040
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BfmOKS%2B0hZywYDqQefCTHLoyt2g4zJ%2BnFXsZWcTTNFERTxxC4UMbhAjxwxCxK9Bo0DyfqlhLxCpmBM%2FdSxDOEazO9bDOWQptC2KFZgyGA1EfNFhxLhr6K2Cdm9HT%2B6rztIH1gztL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 784ceb18fe7971bc-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gb-derby.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/gb-derby.svg
IP
GET /nu/pop/casino/bookofdead/2023/gb-derby.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: Rg5ggSvQeRWtE4Tg0KHTXw==
last-modified: Wed, 21 Dec 2022 12:49:13 GMT
etag: W/"0x8DAE351C3098656"
x-ms-request-id: 2bf6461a-701e-0056-416b-15e3ed000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 58958
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb19e91bb4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.unibet.nu/nu/pop/casino/bookofdead/2023/mga-logo.svg
200 OK 0 B URL HTTP/2 welcome.unibet.nu/nu/pop/casino/bookofdead/2023/mga-logo.svg
IP
GET /nu/pop/casino/bookofdead/2023/mga-logo.svg HTTP/1.1
Host: welcome.unibet.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.unibet.nu/nu/pop/casino/bookofdead/2023/index.html?mktid=1:320669908:91003245-37672&btag=320669908_A8547AAA481C4C2EBE9CB9F1B7739642&bid=37672&campaignId=2750544&pid=91003245
Cookie: __ucbt=node01m3gs95u5dv7k1u4danx451xh; uniattr=ST.0.T; uniattr_ref=; campaignId=2750544; framework.forceBigLandingArea=; affiliateId=1; B-TAG=320669908_A8547AAA481C4C2EBE9CB9F1B7739642; BID=37672; PID=91003245; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.unibet.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2750544%26affiliateId%3D1%26unibetTarget%3D%2Fnu%2Fpop%2Fcasino%2Fbookofdead%2F2023%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.unibet.nu%26btag%3D320669908_A8547AAA481C4C2EBE9CB9F1B7739642%26sref%3DGIG%26GIG%3DNO_MOBILE_CASINO%26affiliateId%3D1%26pid%3D91003245%26bid%3D37672; AFFILIATE_CAMPAIGN_ID=2750544
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 05 Jan 2023 14:31:34 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: FAAw5O0EvruykoHDQoRDMA==
last-modified: Wed, 21 Dec 2022 12:49:11 GMT
etag: W/"0x8DAE351C229F567"
x-ms-request-id: eb7d8f61-601e-0007-646b-157e61000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 58958
vary: Accept-Encoding
server: cloudflare
cf-ray: 784ceb1a093fb4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2
172.67.221.109
104.19.148.8
168.119.90.97
54.72.53.159
34.91.234.242
139.45.195.207
85.184.96.0
15.236.176.210
95.101.11.115
188.114.97.1
51.161.115.163