firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 1b3053fa528e28810f8a2cc9284cc921
cca9eb471d941881a6b9a1793aecb6c281908f6a
a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 25 Sep 2022 20:15:06 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: ZQMHc-CFPoT0amk1sDmgyvmBWc_KUtsuUgO-iNY8ed9YUVCrWNQnkQ==
Age: 1221
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 09a973de929ab7452edc342c780d3668
3f14f6e0a36f76863c0aea6fb561c266404a7ea3
e82ca5f310e37267fbf792427747e65c2bb35e684d3f629c0aa302f688bc4f80
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E82CA5F310E37267FBF792427747E65C2BB35E684D3F629C0AA302F688BC4F80"
Last-Modified: Fri, 23 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7535
Expires: Sun, 25 Sep 2022 22:41:02 GMT
Date: Sun, 25 Sep 2022 20:35:27 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
File type PEM certificate\012- , ASCII text
Hash 6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 25 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: pt2G0DN82sNrOiWoCkQAGeBgo0Xr75LGjjFnYBA_miYA0EmTZGRgPQ==
age: 57613
X-Firefox-Spdy: h2
156.77.112.34/locations/ny/w-haverstraw/brch32900445/
200 OK 3.5 kB URL HTTP/1.1 156.77.112.34/locations/ny/w-haverstraw/brch32900445/
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2852), with CRLF, LF line terminators
Hash 8e82b195755ae8313891f9f4ac536942
3d03eccfa9c3ea40af90e111dfb4d89a52e5fefb
aff851721654f873c192c7ea139673813940266ae3fd469cf8654ebd3233e307
Analyzer Verdict Alert openphish Key Bank
fortinet Phishing
GET /locations/ny/w-haverstraw/brch32900445/ HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
content-encoding: gzip
content-language: en-US
content-type: text/html; charset=utf-8
date: Sun, 25 Sep 2022 20:35:27 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
x-old-content-length: 10310
transfer-encoding: chunked
cache-control: no-cache="set-cookie, set-cookie2"
expires: Thu, 01 Dec 1994 16:00:00 GMT
strict-transport-security:
Set-Cookie: JSESSIONID=0001eJlPJSoakle38vEK6LYWgMB:1cors62fd; Path=/; Secure; HttpOnly
key.com.vtme=1664138127538/1/999; Path=/; Expires=Tue, 25-Oct-22 20:35:27 GMT; Secure
key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; Path=/; HttpOnly
key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; Path=/; HttpOnly
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 20:35:28 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
assets.adobedtm.com/562487d80dda746dda1eb80c381fbabac505d772/satelliteLib-a3fe21fc90211a1ec48589ac09b160082c4281d1.js
200 OK 152 kB URL HTTP/1.1 assets.adobedtm.com/562487d80dda746dda1eb80c381fbabac505d772/satelliteLib-a3fe21fc90211a1ec48589ac09b160082c4281d1.js
IP
File type ASCII text, with very long lines (32745)
Size 152 kB (151986 bytes)
Hash 14280b9471464ef7cf9f5b707a970ee1
af66d9971e1a996e9dcd148b5145825b56db54f9
e086f14ee5b6abdbcaeb5a34f12b890f383f816f9e208e680015be3702f038ff
GET /562487d80dda746dda1eb80c381fbabac505d772/satelliteLib-a3fe21fc90211a1ec48589ac09b160082c4281d1.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
ETag: "cab83e936416f52bcb94c951b6278057:1658932164.490899"
Last-Modified: Wed, 27 Jul 2022 14:29:24 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 151986
Cache-Control: max-age=3600
Expires: Sun, 25 Sep 2022 21:35:28 GMT
Date: Sun, 25 Sep 2022 20:35:28 GMT
Connection: keep-alive
Access-Control-Allow-Origin: http://156.77.112.34
Timing-Allow-Origin: *
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sun, 25 Sep 2022 20:04:17 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Sun, 25 Sep 2022 20:18:52 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: HwZmAt5KKlq5k4HdhqxC9nR8vt00AyEh2BOszECSCY_H7I3E1PH-cA==
Age: 1871
ocsp.digicert.com/
200 OK 471 B IP
Hash fd3b36dc2b620b48de491a8d9ba00fc0
be67ba7db5215dcb7c9225876e35a5e0a5005c9e
28205ee62c77b1caad6cc24c1ce98ddb92d26f67d41270f7d5278208a907c62f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2210
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:28 GMT
Last-Modified: Sun, 25 Sep 2022 19:58:38 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
156.77.112.34/kco/ui/modular/js/main.min.js?v=169
200 OK 57 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/js/main.min.js?v=169
IP
File type ASCII text, with very long lines (45980)
Hash 9b44c10b2174c8e3a8043f3901ef2788
04a3f9c5c5ecaea5da78be3dc02a3f8ec1c7abd7
387352e07712432c6fe0169506f6e7d8115085c9586991a265bec7e71703d762
Analyzer Verdict Alert fortinet Phishing
GET /kco/ui/modular/js/main.min.js?v=169 HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/locations/ny/w-haverstraw/brch32900445/
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb
HTTP/1.1 200 OK
accept-ranges: bytes
content-encoding: gzip
content-type: application/x-javascript
date: Sun, 25 Sep 2022 20:35:27 GMT
last-modified: Thu, 17 Jun 2021 02:00:39 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
transfer-encoding: chunked
strict-transport-security:
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: BXiUKxQhpl2tGZMC05TyPA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: EN7Jc0+tJBVpKayn6fYQVVJ8Q60=
156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
200 OK 197 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 197 kB (197370 bytes)
Hash 5f800c0f1b5639eab2a537635d6e3178
7feaa9a227958ba26c2aeee821bd97fbcbcf5660
ac5ac58b65135bd444e1fcca3952f79c3704d21e58acd4dfa0e973f84e04a6e6
GET /kco/ui/modular/css/styles.min.css?v=366 HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/locations/ny/w-haverstraw/brch32900445/
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb
HTTP/1.1 200 OK
accept-ranges: bytes
content-encoding: gzip
content-type: text/css
date: Sun, 25 Sep 2022 20:35:27 GMT
last-modified: Thu, 17 Jun 2021 02:00:39 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
transfer-encoding: chunked
strict-transport-security:
assets.adobedtm.com/5d295d1656df/755acb65d817/e5818b74ff74/EX846a3de2ded1456cac6be2c8266746bb-libraryCode_source.min.js
200 OK 22 kB URL HTTP/2 assets.adobedtm.com/5d295d1656df/755acb65d817/e5818b74ff74/EX846a3de2ded1456cac6be2c8266746bb-libraryCode_source.min.js
IP
File type ASCII text, with very long lines (32721)
Hash d72e6f8cab148d3f84b23ba6ab3fcd01
8446c47dad776d89e0beba5519abb11c2486d394
15a1bf1d2425d21eb6c820e88e5d62e161ce2eb6a37bfeb22cfc0e15a2849fe9
GET /5d295d1656df/755acb65d817/e5818b74ff74/EX846a3de2ded1456cac6be2c8266746bb-libraryCode_source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "e482b109d419adfa4c27e915c12a1490:1658932166.570166"
last-modified: Wed, 27 Jul 2022 14:29:26 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Sun, 25 Sep 2022 21:35:29 GMT
date: Sun, 25 Sep 2022 20:35:29 GMT
content-length: 21840
access-control-allow-origin: http://156.77.112.34
timing-allow-origin: *
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 9a4de8cb1941179b36d6585381292203
a5670d94142f1227702ce3e8fb83bff44f323f2e
4279a27aeb67dc02830e52817031f0bc89e42bd9e1d815aaaee6a542a27b2e36
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 580
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:29 GMT
Last-Modified: Sun, 25 Sep 2022 20:25:49 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
www.everestjs.net/static/le/last-event-tag-latest.min.js
200 OK 2.7 kB URL HTTP/1.1 www.everestjs.net/static/le/last-event-tag-latest.min.js
IP
File type ASCII text, with very long lines (7027)
Hash c3a66e6f50b032dadb8cad25dc32492d
e80710faee38cff62d92bbc5d1f06606e9024a88
1c3799c14636066f1c903442bf67a335695dc440273e614daab754edbbf0828c
GET /static/le/last-event-tag-latest.min.js HTTP/1.1
Host: www.everestjs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
x-amz-id-2: fZWe1ji7i4kPV3i+XAYRNU2Zv/UO+4UlQyJs1gwD5NXJEDTQwPNlr/q2ZhIQr2NHdaukuhNFNxg=
x-amz-request-id: AXPA3VKNGRX3YQP8
Last-Modified: Wed, 16 Jun 2021 15:18:41 GMT
ETag: "d5991c18a0042eb33f92c6b5b44ffe8d"
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: application/javascript
Server: AmazonS3
Content-Encoding: gzip
Content-Length: 2663
Date: Sun, 25 Sep 2022 20:35:29 GMT
Connection: keep-alive
Vary: Accept-Encoding
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 58b52380a6b5c598d1ad88e8da148137
a56206a0277aea6e8e2f7629793aba713d8edd0c
561a57c27dfa1f8651a89292428576b626e8700b9cd6b8173a0ce121aa8f9f4a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
vt.myvisualiq.net/2/ffhKfVZrkUxD5FyEKs72JQ%3D%3D/vt-320.js
200 OK 3.2 kB URL HTTP/1.1 vt.myvisualiq.net/2/ffhKfVZrkUxD5FyEKs72JQ%3D%3D/vt-320.js
IP
File type ASCII text, with very long lines (5215)
Hash 8b80837095f9eff5aa720167106c682b
1a3c1a0e4fbed43a190f2999e80dd788def93696
907651494b8b445fdce2a8cec450ac43b200e0a63b5a452de7828a48b3fd9940
GET /2/ffhKfVZrkUxD5FyEKs72JQ%3D%3D/vt-320.js HTTP/1.1
Host: vt.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: XAF7ilKMJUNa3x78HNxcLR4iMq9ih6LA4lCmh39D4ZGzEDVbVPUgzPo9c9pOpU7kQL9g2CkAtjQ=
x-amz-request-id: BG7PYYD74NRSJFH0
Last-Modified: Thu, 09 Sep 2021 15:38:09 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: WsT9B4mfrZRogwR63H.syz_PHKCeSyiy
Server: AmazonS3
Content-Encoding: gzip
Date: Sun, 25 Sep 2022 06:45:54 GMT
ETag: W/"ecc81485e241de5e7a986efa5518abd4"
Vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
X-Cache: Hit from cloudfront
Via: 1.1 057fdebf738f5915bf38a78949190758.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: xLfQLaBQj74mXY6L2tSnSoW41j7fli4ZCH8-NUhQRJT4hC7VYSs4gQ==
Age: 49776
www.googletagmanager.com/gtag/js?id=AW-1052626284
200 OK 64 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=AW-1052626284
IP
File type ASCII text, with very long lines (5527)
Hash 02ca4b6cee5dfd27b49e8372b9664a6c
73d89dc9417584975381b92537466852fce0b2c9
f63a3585cecb242d460da1d3b0ea957fdb3a1537bf9781dd412e4852e5c55167
GET /gtag/js?id=AW-1052626284 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 25 Sep 2022 20:35:29 GMT
expires: Sun, 25 Sep 2022 20:35:29 GMT
cache-control: private, max-age=900
last-modified: Sun, 25 Sep 2022 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 63896
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
dpm.demdex.net/id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&d_nsid=0&ts=1664138128062
200 OK 896 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&d_nsid=0&ts=1664138128062
IP
File type JSON data\012- , ASCII text, with very long lines (2310), with no line terminators
Hash 240f91c84f262cbdde87d82a0f8309fa
f774815657eca85056185bb5c43ab3d8b0f45029
09af9ec0cc8e0725acf8a57b6e8de3ad3389ac5e0795d69590c4be28a2e801a5
GET /id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&d_nsid=0&ts=1664138128062 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://156.77.112.34
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://156.77.112.34
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v042-0ff8fc8b8.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=55079516868455472142456625958948552450; Max-Age=15552000; Expires=Fri, 24 Mar 2023 20:35:29 GMT; Path=/; Domain=.demdex.net
Vary: Origin
X-TID: HPENrpbbTHw=
Content-Length: 896
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 1db3e1d6bf7a5e2d0c87eab75a6e52fe
b923a169beb9248ea6a5070a04b57bc0aa44799b
f35aafc9c21937ac03d9b711aa18ef518aaaec6d0f9dbcecb42f757a0e70915c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 7570d1aedbad95abaedd19bad1ee32d1
f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1
b74ed623804476cda2d3d3ee0c049d7500b6e9a2530fe47ba9bb03f9c72e7069
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 25 Sep 2022 20:35:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 25 Sep 2022 18:52:51 GMT
Expires: Mon, 26 Sep 2022 18:52:51 GMT
ETag: "f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 7570d1aedbad95abaedd19bad1ee32d1
f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1
b74ed623804476cda2d3d3ee0c049d7500b6e9a2530fe47ba9bb03f9c72e7069
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 25 Sep 2022 20:35:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 25 Sep 2022 18:52:51 GMT
Expires: Mon, 26 Sep 2022 18:52:51 GMT
ETag: "f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 7570d1aedbad95abaedd19bad1ee32d1
f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1
b74ed623804476cda2d3d3ee0c049d7500b6e9a2530fe47ba9bb03f9c72e7069
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 25 Sep 2022 20:35:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 25 Sep 2022 18:52:51 GMT
Expires: Mon, 26 Sep 2022 18:52:51 GMT
ETag: "f2632cdd927d73aa7ccf8ba21e82144ae16cb0b1"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
302 Moved Temporarily 0 B URL HTTP/1.1 t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID} HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache, no-store, must-revalidate
Date: Sun, 25 Sep 2022 20:35:29 GMT
Location: https://t.myvisualiq.net/ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
Set-Cookie: tuuid=5a9164fb-0e50-494d-baa9-d3e917d9b54c; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
c=1664138129; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
tuuid_lu=1664138129; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
Content-Length: 0
Connection: keep-alive
t.myvisualiq.net/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i
302 Moved Temporarily 0 B URL HTTP/1.1 t.myvisualiq.net/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache, no-store, must-revalidate
Date: Sun, 25 Sep 2022 20:35:29 GMT
Location: https://t.myvisualiq.net/ul_cb/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i
Set-Cookie: tuuid=e885c451-da5e-4e04-a704-6d9a6466ba57; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
c=1664138129; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
tuuid_lu=1664138129; path=/; expires=Tue, 24-Sep-2024 20:35:29 GMT; domain=.myvisualiq.net
Content-Length: 0
Connection: keep-alive
t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D256406802103527%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D%26dpo%3D
302 Moved Temporarily 0 B URL HTTP/1.1 t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D256406802103527%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D%26dpo%3D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D256406802103527%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D%26dpo%3D HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Moved Temporarily
access-control-allow-origin: *
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Date: Sun, 25 Sep 2022 20:35:29 GMT
Location: https://www.facebook.com/tr?id=256406802103527&ev=PageView&cd[order_id]=0-a6a721d4-b025-4bb2-ad66-eea58dd98f6f&dpo=
Content-Length: 0
Connection: keep-alive
fast.keybank.demdex.net/dest5.html?d_nsid=0
200 OK 2.8 kB URL HTTP/1.1 fast.keybank.demdex.net/dest5.html?d_nsid=0
IP
ASN #20940 Akamai International B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Hash b8a1b21bd0651935d53a7bff0c2479d6
31527c952669b6d1d06c537eb50c9043f576e607
80888fb8b92d01d8dd990af664d273f6364b2917741b09911096099ce4eef1bd
GET /dest5.html?d_nsid=0 HTTP/1.1
Host: fast.keybank.demdex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
ETag: "2c9c2ee145ee280b85a217ad7045fae5:1580750826.437238"
Last-Modified: Mon, 03 Feb 2020 17:27:06 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=21600
Date: Sun, 25 Sep 2022 20:35:29 GMT
Content-Length: 2785
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
t.myvisualiq.net/ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
302 Moved Temporarily 0 B URL HTTP/1.1 t.myvisualiq.net/ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID} HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Moved Temporarily
access-control-allow-origin: *
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Date: Sun, 25 Sep 2022 20:35:29 GMT
Location: https://idsync.rlcdn.com/420356.gif?partner_uid=0-eebf34ef-eb4e-4ebe-9f02-0943ae120b61
Content-Length: 0
Connection: keep-alive
t.myvisualiq.net/ul_cb/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i
200 OK 43 B URL HTTP/1.1 t.myvisualiq.net/ul_cb/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /ul_cb/impression_pixel?r=6257350&et=i&ago=212&ao=1005&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=101&sz=7999&u=||http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&pt=i HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
access-control-allow-origin: *
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
cross-origin-resource-policy: cross-origin
Date: Sun, 25 Sep 2022 20:35:29 GMT
Content-Length: 43
Connection: keep-alive
keybank.sc.omtrdc.net/id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=55107167458136927762458511322524249252&ts=1664138128370
200 OK 2 B URL HTTP/1.1 keybank.sc.omtrdc.net/id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=55107167458136927762458511322524249252&ts=1664138128370
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&mid=55107167458136927762458511322524249252&ts=1664138128370 HTTP/1.1
Host: keybank.sc.omtrdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://156.77.112.34
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 200 OK
access-control-allow-origin: http://156.77.112.34
access-control-allow-credentials: true
date: Sun, 25 Sep 2022 20:35:29 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
156.77.112.34/kco/ui/modular/fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
200 OK 48 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
IP
File type Web Open Font Format, TrueType, length 47748, version 1.0\012- data
Hash 4a573fac9111d6adcb3994983539bd75
69bebefe9edeac85cc27516dbe0ea176c1c2c25c
dac5803d6cbe40244dfd39661406239f83e94e86c976e7229a4e35305a9b5efe
Analyzer Verdict Alert fortinet Phishing
GET /kco/ui/modular/fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=-432600572%7CMCIDTS%7C19261%7CvVersion%7C4.5.2; mbox=session#7d8a6976e52e4520a45567e0e990b2e0#1664139989
HTTP/1.1 200 OK
accept-ranges: bytes
content-length: 47748
date: Sun, 25 Sep 2022 20:35:29 GMT
last-modified: Thu, 11 Jan 2018 21:57:59 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
strict-transport-security:
156.77.112.34/kco/ui/modular/fonts/14ff6081-326d-4dae-b778-d7afa66166fc.woff
200 OK 38 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/fonts/14ff6081-326d-4dae-b778-d7afa66166fc.woff
IP
File type Web Open Font Format, TrueType, length 37560, version 1.0\012- data
Hash b9d0556a2c620a939d54c63be3df6c6c
97968884d4c5a93c46ab1334ce9e9156c694ea4d
90973db3f26fe86b648ec735f3183b44902e5cedf2b1a042402bac39da70404f
Analyzer Verdict Alert fortinet Phishing
GET /kco/ui/modular/fonts/14ff6081-326d-4dae-b778-d7afa66166fc.woff HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=-432600572%7CMCIDTS%7C19261%7CvVersion%7C4.5.2; mbox=session#7d8a6976e52e4520a45567e0e990b2e0#1664139989
HTTP/1.1 200 OK
accept-ranges: bytes
content-length: 37560
date: Sun, 25 Sep 2022 20:35:29 GMT
last-modified: Thu, 11 Jan 2018 21:57:59 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
strict-transport-security:
keybankassociation.tt.omtrdc.net/rest/v1/delivery?client=keybankassociation&sessionId=7d8a6976e52e4520a45567e0e990b2e0&version=2.1.0
200 OK 307 B URL HTTP/1.1 keybankassociation.tt.omtrdc.net/rest/v1/delivery?client=keybankassociation&sessionId=7d8a6976e52e4520a45567e0e990b2e0&version=2.1.0
IP
File type JSON data\012- , ASCII text, with very long lines (361), with no line terminators
Hash 7885f8438b3d643c286c096d3fb88cc4
d2c904b8aa34c54cc734b9ddb7bf742e5ea09723
5bf1d9faedae1e291cafed85ad00c81f8c4b58440f22ea5456f6953533a440fa
POST /rest/v1/delivery?client=keybankassociation&sessionId=7d8a6976e52e4520a45567e0e990b2e0&version=2.1.0 HTTP/1.1
Host: keybankassociation.tt.omtrdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain
Content-Length: 851
Origin: http://156.77.112.34
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 200 OK
date: Sun, 25 Sep 2022 20:35:30 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
access-control-allow-origin: http://156.77.112.34
access-control-allow-credentials: true
x-request-id: 827c3d46-9965-420c-9220-1aa3db0a6160
timing-allow-origin: *
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
content-encoding: gzip
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
server: jag
transfer-encoding: chunked
assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement_Module_AudienceManagement.min.js
200 OK 8.8 kB URL HTTP/2 assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement_Module_AudienceManagement.min.js
IP
File type exported SGML document, ASCII text, with very long lines (25020)
Hash 550ed44275a349b590de80d21dc3e67b
8b26a8bccdca7d2a73186e82a2815e79d0ffbb60
87c97b57e164d64f3e79843ab95b5ffbfe52b45d1116e943fc4c96873e4127d4
GET /extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement_Module_AudienceManagement.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "46e2aa1bef425becb0cb4651c23fff38:1573670083.753497"
last-modified: Wed, 13 Nov 2019 18:34:43 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
expires: Sun, 25 Sep 2022 21:35:30 GMT
date: Sun, 25 Sep 2022 20:35:30 GMT
content-length: 8769
cache-control: no-cache
access-control-allow-origin: http://156.77.112.34
timing-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18999
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 20:35:30 GMT
Connection: keep-alive
156.77.112.34/kco/ui/modular/fonts/7802e576-2ffa-4f22-a409-534355fbea79.woff
200 OK 16 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/fonts/7802e576-2ffa-4f22-a409-534355fbea79.woff
IP
File type Web Open Font Format, TrueType, length 16372, version 0.0\012- data
Hash 4c8a5d54537af24153ab4bfbda856b84
e3ac604ebf3161d22816bb910929d6facc085e5e
e9175c083dd30b9aafd6339f49b57c47f11ff513fedf5574aeea52f34cb230a1
Analyzer Verdict Alert fortinet Phishing
GET /kco/ui/modular/fonts/7802e576-2ffa-4f22-a409-534355fbea79.woff HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=-432600572%7CMCIDTS%7C19261%7CvVersion%7C4.5.2; mbox=session#7d8a6976e52e4520a45567e0e990b2e0#1664139989
HTTP/1.1 200 OK
accept-ranges: bytes
content-length: 16372
date: Sun, 25 Sep 2022 20:35:29 GMT
last-modified: Thu, 14 Mar 2019 02:19:30 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
strict-transport-security:
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18999
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 20:35:30 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18999
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 20:35:30 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7038cca95198779d8bb479045eb56652
e9dcf9451e849f4d55b0909b33a51bd0b1a35296
0fc47dba3f2789b7c509a4916b1fe3c7b6b30c6778e5354742256125730310f3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FC47DBA3F2789B7C509A4916B1FE3C7B6B30C6778E5354742256125730310F3"
Last-Modified: Fri, 23 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18999
Expires: Mon, 26 Sep 2022 01:52:09 GMT
Date: Sun, 25 Sep 2022 20:35:30 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c48523c-250d-4030-8145-14c8967dc600.jpeg
200 OK 8.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c48523c-250d-4030-8145-14c8967dc600.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dfdacc8edea3c24dad020d7e9c11b3f4
2b6e37596e88b62f288dc8e8c937fd904fae28d5
338a44f3bcc01bdd197f037dd8f8bf58a18dea00127465488efe76fb72a6fdff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c48523c-250d-4030-8145-14c8967dc600.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8914
x-amzn-requestid: 8cfdc32e-f04a-4fd6-a1f1-632934a682fd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y-_EUHqJoAMF7MQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632f7881-14a6d8ef126409964607e0aa;Sampled=0
x-amzn-remapped-date: Sat, 24 Sep 2022 21:37:05 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: kdF6En2vbJhRH1bkYMOuNm5XOIsT1qs3FE281N1SKn1FbyW-oNZsEw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 21:37:06 GMT
etag: "2b6e37596e88b62f288dc8e8c937fd904fae28d5"
content-type: image/jpeg
age: 82704
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1deb918e-bcb0-4629-aaa7-0ae0322969be.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1deb918e-bcb0-4629-aaa7-0ae0322969be.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3 DIY-Thermocam raw data\012- (Lepton 2.x), scale 3-257, spot sensor temperature 0.000000, unit celsius, color scheme 0, show scale bar, calibration: offset 0.000000, slope 241253891388563521536.000000\012- data
Hash b3a72e81317074689a71dac7059e4b6a
b6d56333d7f1ea7ddc8838d84de498ff913c5464
e665a8821b5e7b2e78787647a08d629bf70cbf4cbfee2057c8601cf0565154a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1deb918e-bcb0-4629-aaa7-0ae0322969be.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12826
x-amzn-requestid: f075cf62-acfc-4bc1-be14-7c3dafb7aaed
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YfVRNFP-oAMFgrA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6322cf3a-184b678042d64ac9266b1128;Sampled=0
x-amzn-remapped-date: Thu, 15 Sep 2022 07:07:38 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: rN_8rm10Pxb0AUKW6ECfNulcYxBaS7FgGD15gT14dX-FlsGJfqahxA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 21:37:19 GMT
age: 82691
etag: "b6d56333d7f1ea7ddc8838d84de498ff913c5464"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd719f7db-20e1-4834-9525-3117f1824f36.webp
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd719f7db-20e1-4834-9525-3117f1824f36.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash aa150280eb113504d61a25935c0f0127
ed04f74fbb4c77b21e2babc51a82857f5e23d169
07df17fffb391aa82efb09e30d97e88fa4dbe6df00e37bb90304f69179f4848e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd719f7db-20e1-4834-9525-3117f1824f36.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10032
x-amzn-requestid: 521c4012-9834-4100-a7ed-30093502f1a9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y7sPBHGYoAMFh-Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632e272c-77b03c321240d76a572d603a;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 21:37:48 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5CzA52-o7GYViSJ4lna7ptv9dycJCUL-NLWOk-iCW-ZxDU_FQH_OoQ==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 21:51:18 GMT
age: 81852
etag: "ed04f74fbb4c77b21e2babc51a82857f5e23d169"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0737a7ae-3ae7-4fe5-b739-e988b295c795.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0737a7ae-3ae7-4fe5-b739-e988b295c795.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a89e7161745036637a66e8ab5b7efdf9
79c83cc27996b2339bd63764dbb2ae9744db6d70
13b990c3c6a9bee6def25d007e14628c52e427b6f4c718895b1817d5e8e59760
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0737a7ae-3ae7-4fe5-b739-e988b295c795.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8715
x-amzn-requestid: d5e237f4-4c0e-4e3b-b3ae-ea1eb5b7cafc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y5JmTEAwIAMF_Mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632d22f4-48a975a866edc1755858600f;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 03:07:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Sm6N8Un8XKHtGGZwxLd1aYygBns1l8siRvcc2w_9V2imJopvt8Ockw==
via: 1.1 44cd593d82a2d200a94217033c614c6a.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 07:09:15 GMT
age: 48375
etag: "79c83cc27996b2339bd63764dbb2ae9744db6d70"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F254286e1-1c63-4609-9dfb-0eb4b9096238.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F254286e1-1c63-4609-9dfb-0eb4b9096238.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 714af732a9aa1db2b13ffb62810fd532
358e74de395352a9529ff1c17856daf8900888c5
1d2035cfcd283560ebe8494f9438e52f8d96cd092dd41cb0eb899a3f905c1e05
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F254286e1-1c63-4609-9dfb-0eb4b9096238.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6199
x-amzn-requestid: d26f22d9-4e9b-4764-8c96-2e1c7ce36340
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y--OKHowoAMFbQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632f7727-7adb7c4925e6e50e13889544;Sampled=0
x-amzn-remapped-date: Sat, 24 Sep 2022 21:31:19 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: LryqVGSkKbiNOwcqXMULY9FXbOuZBBenjgGPDME3NZLZOdp5divXmw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 24 Sep 2022 22:02:29 GMT
age: 81181
etag: "358e74de395352a9529ff1c17856daf8900888c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1730b63d-9494-4330-acb8-7cb387a0cf08.jpeg
200 OK 5.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1730b63d-9494-4330-acb8-7cb387a0cf08.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9773faaac4deac40b96cd0802e974f36
db601663fa6ee5564eddaf8d3d84c7b04bf3871c
40e7a573f510ff29db04b3fbfacde2ad6ecd67b4c0be30034e057654c86408a4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1730b63d-9494-4330-acb8-7cb387a0cf08.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5305
x-amzn-requestid: df7ba218-d20c-4389-8895-affd870ad15f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y5JqKGtHoAMFcJw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632d230d-1854a5420f7091316aa4f211;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 03:07:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: v37Rjs_OtmFd6UKau0Flv_J6GAWTe0UdA8hXaDmmn6SmLXQbEHeBVQ==
via: 1.1 44cd593d82a2d200a94217033c614c6a.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 03:45:44 GMT
age: 60586
etag: "db601663fa6ee5564eddaf8d3d84c7b04bf3871c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 8a3b7b9ac1bb0993ebe151e626823acf
4d2b88775a2e5de7c05d72cefaa3bc8c75d6806a
76424f968a0619482cbf117b96a210e2555b4ab947880672f50584a800c76db8
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6076
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 18:54:14 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 471 B IP
Hash dab3e5282ac0f1ca4b167bf147382439
746358bc1c029a5ddeb3f8679020f07109f9fbea
fd299b43eafa48b711fafa6509c1d7580681e2a11ded1c24678e76a9fcef555d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4711
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 19:17:00 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash bc7883d0a03d9c3559288a600fecc70a
b0e538996510ec8c861264cba4bf79fa73f6f7d6
c3bdc9bb12c7c951ca2d861c95156de2c724acc82386e882864c464132e07ac3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
keybank.sc.omtrdc.net/b/ss/keybankcom/10/JS-2.7.0-LCUM/s61053156619215?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=25%2F8%2F2022%2020%3A35%3A28%200%200&d.&nsid=0&jsonv=1&.d&sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&mid=55107167458136927762458511322524249252&aamlh=6&ce=UTF-8&ns=keybank&pageName=general%20%3A%20unavailable&g=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&cc=USD&ch=general&server=156.77.112.34&events=event14%2Cevent33&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=general&v9=1&c10=general&v10=general%20%3A%20unavailable&c11=general&v11=New&c12=general&v12=First%20Visit&c13=1&v13=4%3A30PM&c14=New&v14=Sunday&c15=First%20Visit&c16=4%3A30PM&c17=Sunday&c29=D%3Dmid&v37=PR&c40=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&v41=D%3Dmid&c49=156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&c50=5.0-AppMeasurement1.5-20151022&c70=Article&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1
200 OK 2.3 kB URL HTTP/1.1 keybank.sc.omtrdc.net/b/ss/keybankcom/10/JS-2.7.0-LCUM/s61053156619215?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=25%2F8%2F2022%2020%3A35%3A28%200%200&d.&nsid=0&jsonv=1&.d&sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&mid=55107167458136927762458511322524249252&aamlh=6&ce=UTF-8&ns=keybank&pageName=general%20%3A%20unavailable&g=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&cc=USD&ch=general&server=156.77.112.34&events=event14%2Cevent33&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=general&v9=1&c10=general&v10=general%20%3A%20unavailable&c11=general&v11=New&c12=general&v12=First%20Visit&c13=1&v13=4%3A30PM&c14=New&v14=Sunday&c15=First%20Visit&c16=4%3A30PM&c17=Sunday&c29=D%3Dmid&v37=PR&c40=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&v41=D%3Dmid&c49=156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&c50=5.0-AppMeasurement1.5-20151022&c70=Article&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1
IP
File type ASCII text, with very long lines (2318)
Hash 1c0b55afdf8e45bce31f3707a02511c1
4ba9d4da7a9ee6389ba994fc0b81b02b49e56688
1db0117fd01df4ae38c97ef49d18980c9db06e7a775fa99c2df34dbfdc5ed47b
GET /b/ss/keybankcom/10/JS-2.7.0-LCUM/s61053156619215?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=25%2F8%2F2022%2020%3A35%3A28%200%200&d.&nsid=0&jsonv=1&.d&sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&mid=55107167458136927762458511322524249252&aamlh=6&ce=UTF-8&ns=keybank&pageName=general%20%3A%20unavailable&g=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&cc=USD&ch=general&server=156.77.112.34&events=event14%2Cevent33&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&h1=general&v9=1&c10=general&v10=general%20%3A%20unavailable&c11=general&v11=New&c12=general&v12=First%20Visit&c13=1&v13=4%3A30PM&c14=New&v14=Sunday&c15=First%20Visit&c16=4%3A30PM&c17=Sunday&c29=D%3Dmid&v37=PR&c40=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&v41=D%3Dmid&c49=156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&c50=5.0-AppMeasurement1.5-20151022&c70=Article&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=295C0C0F53DB0ED00A490D45%40AdobeOrg&AQE=1 HTTP/1.1
Host: keybank.sc.omtrdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 200 OK
access-control-allow-origin: *
date: Sun, 25 Sep 2022 20:35:30 GMT
expires: Sat, 24 Sep 2022 20:35:30 GMT
last-modified: Mon, 26 Sep 2022 20:35:30 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3573709424095199232-4619655412424841035
vary: *
dcs: dcs-prod-irl1-2-v042-05898b0bf.edge-irl1.demdex.com 4 ms
x-aam-tid: aMzJGwXLQrw=
content-type: application/x-javascript;charset=utf-8
content-length: 2319
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
lasteventf-tm.everesttech.net/?_les_imsOrgId=295C0C0F53DB0ED00A490D45@AdobeOrg&_les_sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&_les_last_search_click=&_les_rsid=keybankcom&_les_mid=55107167458136927762458511322524249252&_les_url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F
200 OK 0 B URL HTTP/2 lasteventf-tm.everesttech.net/?_les_imsOrgId=295C0C0F53DB0ED00A490D45@AdobeOrg&_les_sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&_les_last_search_click=&_les_rsid=keybankcom&_les_mid=55107167458136927762458511322524249252&_les_url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?_les_imsOrgId=295C0C0F53DB0ED00A490D45@AdobeOrg&_les_sdid=48620C259AB50DA2-6EE9D1B2A3ABB4F1&_les_last_search_click=&_les_rsid=keybankcom&_les_mid=55107167458136927762458511322524249252&_les_url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F HTTP/1.1
Host: lasteventf-tm.everesttech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://156.77.112.34
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Sun, 25 Sep 2022 20:35:30 GMT
via: 1.1 varnish
x-served-by: cache-bma1631-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1664138130.331248,VS0,VE0
content-type: text/plain
access-control-allow-credentials: true
access-control-allow-origin: http://156.77.112.34
content-length: 0
X-Firefox-Spdy: h2
www.facebook.com/tr?id=256406802103527&ev=PageView&cd[order_id]=0-a6a721d4-b025-4bb2-ad66-eea58dd98f6f&dpo=
200 OK 0 B URL HTTP/2 www.facebook.com/tr?id=256406802103527&ev=PageView&cd[order_id]=0-a6a721d4-b025-4bb2-ad66-eea58dd98f6f&dpo=
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tr?id=256406802103527&ev=PageView&cd[order_id]=0-a6a721d4-b025-4bb2-ad66-eea58dd98f6f&dpo= HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/plain
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
date: Sun, 25 Sep 2022 20:35:30 GMT
X-Firefox-Spdy: h2
cm.everesttech.net/cm/dd?d_uuid=55079516868455472142456625958948552450
301 Moved Permanently 134 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=55079516868455472142456625958948552450
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4aa7a432bb447f094408f1bd6229c605
1965c4952cc8c082a6307ed67061a57aab6632fa
34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a
GET /cm/dd?d_uuid=55079516868455472142456625958948552450 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/
HTTP/1.1 301 Moved Permanently
Server: awselb/2.0
Date: Sun, 25 Sep 2022 20:35:30 GMT
Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Location: https://cm.everesttech.net:443/cm/dd?d_uuid=55079516868455472142456625958948552450
tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
302 Found 0 B URL HTTP/2 tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D HTTP/1.1
Host: tapestry.tapad.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Sun, 25 Sep 2022 20:35:30 GMT
strict-transport-security: max-age=31536000
set-cookie: TapAd_TS=1664138130337;Expires=Thu, 24 Nov 2022 20:35:30 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
TapAd_DID=d87b44b2-9a3d-4c99-8a80-b57896b691c5;Expires=Thu, 24 Nov 2022 20:35:30 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d87b44b2-9a3d-4c99-8a80-b57896b691c5
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/pagead/conversion_async.js
200 OK 16 kB URL HTTP/2 www.google.com/pagead/conversion_async.js
IP
File type ASCII text, with very long lines (1654)
Hash 890f716858b5f72587e47c5eca121cb5
91871a0acd9a0ab644d51036bb5ca0c3bdc5e687
7a3629e375468328b3fb25e1a6cc5749604f09099e8d2109f366e7e0226aee4a
GET /pagead/conversion_async.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 25 Sep 2022 20:35:30 GMT
expires: Sun, 25 Sep 2022 20:35:30 GMT
cache-control: private, max-age=3600
content-type: text/javascript; charset=UTF-8
etag: 3080337328058561381
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 15693
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash 68eeaf1d0cd2ef5c36ab55992430343e
7c88fc09f8d1e0a4fe2c4ae4ea14440c33d15cb4
2572d7e99a9edcf421032cb558404f86ccd263477243348c4c317425f612609e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 25 Sep 2022 20:35:30 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 25 Sep 2022 01:42:53 GMT
Expires: Sun, 02 Oct 2022 01:42:52 GMT
Etag: "7c88fc09f8d1e0a4fe2c4ae4ea14440c33d15cb4"
Cache-Control: max-age=536241,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 75068bf28c02b509-OSL
ocsp.digicert.com/
200 OK 471 B IP
Hash dab3e5282ac0f1ca4b167bf147382439
746358bc1c029a5ddeb3f8679020f07109f9fbea
fd299b43eafa48b711fafa6509c1d7580681e2a11ded1c24678e76a9fcef555d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4711
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 19:17:00 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
156.77.112.34/kco/ui/modular/fonts/50d35bbc-dfd4-48f1-af16-cf058f69421d.woff
200 OK 60 kB URL HTTP/1.1 156.77.112.34/kco/ui/modular/fonts/50d35bbc-dfd4-48f1-af16-cf058f69421d.woff
IP
File type Web Open Font Format, TrueType, length 59972, version 1.0\012- data
Hash 186124fbe78a81fbc1d10badfbbd07e3
82b45d2af5a29f4d7108032a021bc6e593ba3554
b8a03b0121cadf5100578a03a3040be0b82a010aee64bd957e7b08288d2be88e
Analyzer Verdict Alert fortinet Phishing
GET /kco/ui/modular/fonts/50d35bbc-dfd4-48f1-af16-cf058f69421d.woff HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://156.77.112.34/kco/ui/modular/css/styles.min.css?v=366
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=-432600572%7CMCIDTS%7C19261%7CvVersion%7C4.5.2; mbox=session#7d8a6976e52e4520a45567e0e990b2e0#1664139989
HTTP/1.1 200 OK
accept-ranges: bytes
content-length: 59972
date: Sun, 25 Sep 2022 20:35:29 GMT
last-modified: Thu, 11 Jan 2018 21:57:58 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
strict-transport-security:
t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d87b44b2-9a3d-4c99-8a80-b57896b691c5
200 OK 43 B URL HTTP/1.1 t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_d87b44b2-9a3d-4c99-8a80-b57896b691c5
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /sync?prid=1001&ao=0&pruuid=TAPAD_d87b44b2-9a3d-4c99-8a80-b57896b691c5 HTTP/1.1
Host: t.myvisualiq.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
access-control-allow-origin: *
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
cross-origin-resource-policy: cross-origin
Date: Sun, 25 Sep 2022 20:35:30 GMT
Content-Length: 43
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 8a3b7b9ac1bb0993ebe151e626823acf
4d2b88775a2e5de7c05d72cefaa3bc8c75d6806a
76424f968a0619482cbf117b96a210e2555b4ab947880672f50584a800c76db8
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6076
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 18:54:14 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4474bfba80fa3257384d1c908e1353bf
9a2869a3888743d575e6f87d2a7479d5d97fa123
63378e949c0ea9564e7660ea0522ce7a59727a0a5232b81b77f8525899f67a2b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
idsync.rlcdn.com/420356.gif?partner_uid=0-eebf34ef-eb4e-4ebe-9f02-0943ae120b61
451 Unavailable For Legal Reasons 0 B URL HTTP/2 idsync.rlcdn.com/420356.gif?partner_uid=0-eebf34ef-eb4e-4ebe-9f02-0943ae120b61
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /420356.gif?partner_uid=0-eebf34ef-eb4e-4ebe-9f02-0943ae120b61 HTTP/1.1
Host: idsync.rlcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 451 Unavailable For Legal Reasons
date: Sun, 25 Sep 2022 20:35:30 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1d095ec6a56142cb2084481b06881ef4
82ff236023008fbfb871aaa7c1e976e0cf15e91a
791ac45152415413d4af27f3dde61a021c9c57dcf7ca5b0e65300ebc3cd8815d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
156.77.112.34/kco/images/favicon.ico
200 OK 348 B URL HTTP/1.1 156.77.112.34/kco/images/favicon.ico
IP
File type MS Windows icon resource - 1 icon, -128x-128, 16 colors\012- data
Hash cbce8774a4ba7e412a5cfc6602c56efa
fd00399d8bd5be4c2766c0f8c56237f54c4413cb
4d85969883edcc24f1aa9a17954813fc982e0ce8cfdf0b7f3d591d21e214bca8
GET /kco/images/favicon.ico HTTP/1.1
Host: 156.77.112.34
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://156.77.112.34/locations/ny/w-haverstraw/brch32900445/
Cookie: key.com.sid=kco_d740a264-f971-45e6-a69e-5f952fc9f0bd; key.com.tid=kco_b6ee4efc-bf6f-4f17-b6d8-86723fe665fb; AMCV_295C0C0F53DB0ED00A490D45%40AdobeOrg=-432600572%7CMCIDTS%7C19261%7CMCMID%7C55107167458136927762458511322524249252%7CMCAAMLH-1664742928%7C6%7CMCAAMB-1664742928%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1664145328s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.5.2; mbox=session#7d8a6976e52e4520a45567e0e990b2e0#1664139989|PC#7d8a6976e52e4520a45567e0e990b2e0.37_0#1727382929; _gcl_au=1.1.1913663182.1664138128; AMCVS_295C0C0F53DB0ED00A490D45%40AdobeOrg=1; s_sess=%20s_ppvl%3D%3B%20s_ppv%3Dgeneral%252520%25253A%252520unavailable%252C100%252C133%252C939%252C1280%252C939%252C1280%252C1024%252C1%252CP%3B%20s_cc%3Dtrue%3B; s_pers=%20s_vnum%3D1664582400572%2526vn%253D1%7C1664582400572%3B%20s_invisit%3Dtrue%7C1664139928572%3B%20s_nr%3D1664138128573-New%7C1821818128573%3B%20m%3D1664138128575%7C1758746128575%3B%20m_s%3DFirst%2520Visit%7C1664139928575%3B%20s_gpv_pn%3Dgeneral%2520%253A%2520unavailable%7C1664139928576%3B%20s_gpv_ch%3Dgeneral%7C1664139928576%3B
HTTP/1.1 200 OK
accept-ranges: bytes
content-encoding: gzip
content-type: image/x-icon
date: Sun, 25 Sep 2022 20:35:29 GMT
last-modified: Mon, 03 Oct 2011 19:01:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding,User-Agent
transfer-encoding: chunked
strict-transport-security:
googleads.g.doubleclick.net/pagead/viewthroughconversion/1052626284/?random=1664138128808&cv=9&fst=1664138128808&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&auid=1913663182.1664138128&hn=www.google.com&async=1&rfmt=3&fmt=4
200 OK 1.1 kB URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/1052626284/?random=1664138128808&cv=9&fst=1664138128808&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&auid=1913663182.1664138128&hn=www.google.com&async=1&rfmt=3&fmt=4
IP
File type ASCII text, with very long lines (2368), with no line terminators
Hash 75fbdf7cb0664bf743cf4cf57ea63ee5
dd7dc4a5d68d88d476d045b8f0586bf53f9aba9e
80f29a78644e7c9b5d6882f9ab0c21121f776ff83b8233a8aaba9983d573b33b
GET /pagead/viewthroughconversion/1052626284/?random=1664138128808&cv=9&fst=1664138128808&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&ig=0&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&auid=1913663182.1664138128&hn=www.google.com&async=1&rfmt=3&fmt=4 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 25 Sep 2022 20:35:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 1081
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Sep-2022 20:50:30 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash cd8e3570655a88b47a20fb93af0fc0c5
6ebbd655af47cbe0788f5ea6a7d9cd457bda2f33
12bc57afd44ddf43fc3802ecc23e743660b146acff0958093fcea30e96b02f6b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.sectigo.com/
200 OK 471 B IP
Hash 68eeaf1d0cd2ef5c36ab55992430343e
7c88fc09f8d1e0a4fe2c4ae4ea14440c33d15cb4
2572d7e99a9edcf421032cb558404f86ccd263477243348c4c317425f612609e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 25 Sep 2022 20:35:30 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 25 Sep 2022 01:42:53 GMT
Expires: Sun, 02 Oct 2022 01:42:52 GMT
Etag: "7c88fc09f8d1e0a4fe2c4ae4ea14440c33d15cb4"
Cache-Control: max-age=536241,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 75068bf34d36b509-OSL
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9f61c5ada09e4fa747144a96e95a943f
e7f3119b4d75a72dd0409673b9789ac1f3233d23
95afa75f054462b0db7b7b59ebadecc07ce8e4eac12b07e76645848983c52bcf
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 9723c164213754d2481b9851b1422332
9443eadcab4af3a93900bb384567d2fa1ebde3b3
b291da559f2ca5de481ba23aa5a7fc97b48115ed2bfbb2d66fde6527cbd9d981
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 19:15:06 GMT
Server: ECS (nyb/1D34)
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: T2UPiZ4h7FmPsFeiWWoWe0bIpvFxYA5bdJIHRap_fMXbBUm-JrXv-Q==
Age: 4824
www.google.no/pagead/1p-user-list/1052626284/?random=1664138128808&cv=9&fst=1664136000000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&async=1&fmt=3&is_vtc=1&random=2087363404&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
200 OK 42 B URL HTTP/2 www.google.no/pagead/1p-user-list/1052626284/?random=1664138128808&cv=9&fst=1664136000000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&async=1&fmt=3&is_vtc=1&random=2087363404&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/1052626284/?random=1664138128808&cv=9&fst=1664136000000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0>m=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2F156.77.112.34%2Flocations%2Fny%2Fw-haverstraw%2Fbrch32900445%2F&tiba=Temporarily%20Unavailable%20%7C%20KeyBank&async=1&fmt=3&is_vtc=1&random=2087363404&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://156.77.112.34/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 25 Sep 2022 20:35:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cm.everesttech.net/cm/dd?d_uuid=55079516868455472142456625958948552450
302 0 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=55079516868455472142456625958948552450
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cm/dd?d_uuid=55079516868455472142456625958948552450 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302
Date: Sun, 25 Sep 2022 20:35:30 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~YzC7kgAAABisJANe; Domain=.everesttech.net; Expires=Mon, 25-Sep-2023 20:35:30 GMT; Path=/
everest_session_v2=YzC7kgAAABisJQNe; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzC7kgAAABisJANe
Server: AMO-cookiemap/1.1
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9f61c5ada09e4fa747144a96e95a943f
e7f3119b4d75a72dd0409673b9789ac1f3233d23
95afa75f054462b0db7b7b59ebadecc07ce8e4eac12b07e76645848983c52bcf
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 471 B IP
Hash 2b35d21dd785c3a7346ab75c7babad3d
1da8e5bb2de50e8e777387ce0510753d68a9862b
16d894645d341bc3a2a89191cf346d26f882466e3b36e5b2254770467833bd59
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5165
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 20:35:30 GMT
Last-Modified: Sun, 25 Sep 2022 19:09:25 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
dpm.demdex.net/ibs:dpid=411&dpuuid=YzC7kgAAABisJANe
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/ibs:dpid=411&dpuuid=YzC7kgAAABisJANe
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ibs:dpid=411&dpuuid=YzC7kgAAABisJANe HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-1-v042-0e22fa12a.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YzC7kgAAABisJANe
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=71109589235195104812870151500711154453; Max-Age=15552000; Expires=Fri, 24 Mar 2023 20:35:30 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: iSv/UUJ5Q2E=
Content-Length: 0
Connection: keep-alive
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YzC7kgAAABisJANe
200 OK 59 B URL HTTP/1.1 dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YzC7kgAAABisJANe
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YzC7kgAAABisJANe HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://156.77.112.34/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-1-v042-0b49be531.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: 76d6lUMgTWQ=
Content-Length: 59
Connection: keep-alive
156.77.112.34
23.36.76.226
52.17.180.229
23.61.215.237
13.36.218.177
157.240.200.35
52.59.13.32
93.184.220.29
0.0.0.0