erp.camersoftware.com/
82.165.73.164301 Moved Permanently 162 B IP 82.165.73.164:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET / HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 05 Dec 2022 12:13:24 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://erp.camersoftware.com/
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash cfec3d7283a9b66d2be426ce54d210f3
808c1feb1ba918951d1928c1f6bfc0c253262774
1bad6c06aa3e88dcbc125fc98a6cb753eb2b18d2c8dd61da21d12209aeeda3f9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1BAD6C06AA3E88DCBC125FC98A6CB753EB2B18D2C8DD61DA21D12209AEEDA3F9"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6930
Expires: Mon, 05 Dec 2022 14:08:54 GMT
Date: Mon, 05 Dec 2022 12:13:24 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash ee088fab9b287e174cfd1f2c735a909f
25c3335b514a36ad1a24d00413d60c3d394f5161
494e96358ff12366213d7cc0f9197648c6c62ec14fa0d2c78732a683fa26b192
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4879
Cache-Control: max-age=171554
Content-Type: application/ocsp-response
Date: Mon, 05 Dec 2022 12:13:24 GMT
Etag: "638dc877-1d7"
Expires: Wed, 07 Dec 2022 11:52:38 GMT
Last-Modified: Mon, 05 Dec 2022 10:31:19 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1ea206ac3c440825741687351f8c6e4e
2f38dafd8c43dcce2411a0590bc5c02cd6286735
7d7232c8c91bcd18161ba2c9d23e3bff159604e058bd5b3fc1c7fcbcd03a7ee3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8366
Expires: Mon, 05 Dec 2022 14:32:50 GMT
Date: Mon, 05 Dec 2022 12:13:24 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Type, Backoff, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 05 Dec 2022 11:20:15 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3189
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: PfOE9nnK8QbFBFz9FUGoMQHi1cRvXKSij54O6ban47/p/zW82T8TVNYeUVi/lIJo5ulejoSqa5M=
x-amz-request-id: 6TY91B736YHCQ1VX
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 05 Dec 2022 11:47:58 GMT
age: 1526
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 6fb86c23da5a8209b347e0a679b34c35
9fe59c1966c69fb47d5ff0eb4d3afa2a92b5a109
65c5f17fdf09c71861724d83faef2aa133fa0d0e7d77bc7f0686d29d088f7f2a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65C5F17FDF09C71861724D83FAEF2AA133FA0D0E7D77BC7F0686D29D088F7F2A"
Last-Modified: Mon, 05 Dec 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Mon, 05 Dec 2022 18:13:24 GMT
Date: Mon, 05 Dec 2022 12:13:24 GMT
Connection: keep-alive
erp.camersoftware.com/
82.165.73.164200 OK 2.2 kB IP 82.165.73.164:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (589)
Hash b020ca5faa529e9ddf8014620df0635b
e26598af3e8bdbbb00f79c90ab5834e691eadb4b
7ac80a8faaf3710a632256b570ae5fe36805af6dcdf28fcf11372792df5d5763
GET / HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/html; charset=UTF-8
content-length: 2156
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: Public, must-revalidate
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
set-cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; path=/; HttpOnly
DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440; path=/; HttpOnly
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PHP/7.1.33, PleskLin
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/css/base/jquery-ui.css?layout=classic&version=8.0.1
82.165.73.164200 OK 8.1 kB URL HTTP/2 erp.camersoftware.com/includes/jquery/css/base/jquery-ui.css?layout=classic&version=8.0.1
IP 82.165.73.164:0
File type ASCII text, with very long lines (2363)
Hash 183f2273d36ce8170df2501ccf3d975a
8e022c9584aa814863bf20c18185b2d9a821c6b2
0430e8a1f9a837570f284940b27a58db02d6591ccc2926c4d151f701f9e7836d
GET /includes/jquery/css/base/jquery-ui.css?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/css
last-modified: Fri, 18 Feb 2022 18:24:58 GMT
etag: W/"620fe47a-8c85"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.stack.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 1.3 kB URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.stack.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
File type ASCII text, with very long lines (2324)
Hash 46284291e7d64be85c412ae4698ae0ae
aea7cc3e9928f6a176ac9a9c27add270896dcd63
f4cf7e38b31f595fe8944222fb898d45fc6f887c688b8eaf336c486eb0c58d00
GET /includes/jquery/plugins/flot/jquery.flot.stack.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-9a1"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/theme/eldy/style.css.php?lang=fr_FR&theme=eldy&userid=0&entity=1&layout=classic&version=8.0.1
82.165.73.164200 OK 26 kB URL HTTP/2 erp.camersoftware.com/theme/eldy/style.css.php?lang=fr_FR&theme=eldy&userid=0&entity=1&layout=classic&version=8.0.1
IP 82.165.73.164:0
Hash 58e9e3c563f8017cd5d293450ed2e3e7
ecadef43b7032992a6c21acf9d9f95c0bf8aeb21
2038891df47044df23b0003fbab2f4ee4ecf6e5518f6bae41d265928726d9130
GET /theme/eldy/style.css.php?lang=fr_FR&theme=eldy&userid=0&entity=1&layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/css;charset=UTF-8
content-length: 26352
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: max-age=3600, public, must-revalidate
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PHP/7.1.33, PleskLin
X-Firefox-Spdy: h2
push.services.mozilla.com/
52.43.158.219101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 52.43.158.219:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0vmBPj7RAYb2uAwBP1DHzw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: YmVpU1U6XtzxpsIpL69fg2QJA/k=
away.cdnbestplatform.com/go.php?id=9677-22-5680954-11
91.211.91.104200 OK 414 B URL HTTP/2 away.cdnbestplatform.com/go.php?id=9677-22-5680954-11
IP 91.211.91.104:0
ASN #206638 PE Brezhnev Daniil
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash c7162d5cc36a3d2ba3d1a245f5828ee6
320896b57ed5f7c4d6b2322da3873e7b67e9ecf6
d914932cbfa799e6e8480d30840adb5de0539d3289f8ad6e9eba9f43c60bb669
Analyzer Verdict Alert fortinet Malware
GET /go.php?id=9677-22-5680954-11 HTTP/1.1
Host: away.cdnbestplatform.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:26 GMT
content-type: text/html; charset=UTF-8
content-length: 414
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15768000;
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5794
Expires: Mon, 05 Dec 2022 13:50:00 GMT
Date: Mon, 05 Dec 2022 12:13:26 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5794
Expires: Mon, 05 Dec 2022 13:50:00 GMT
Date: Mon, 05 Dec 2022 12:13:26 GMT
Connection: keep-alive
erp.camersoftware.com/includes/jstz/jstz.min.js
82.165.73.164200 OK 8.5 kB URL HTTP/2 erp.camersoftware.com/includes/jstz/jstz.min.js
IP 82.165.73.164:0
File type ASCII text, with very long lines (12020)
Hash ab9634a246bd1278deea760aa867c967
e0efde794289940b1a3c4eaf6c87534e9bdba755
510bbed0f96cf3d04c4c2df20c9ee02dcc99594eb557693a4429865402023444
GET /includes/jstz/jstz.min.js HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-2f2c"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/core/js/lib_head.js.php?lang=fr_FR&layout=classic&version=8.0.1
82.165.73.164200 OK 17 kB URL HTTP/2 erp.camersoftware.com/core/js/lib_head.js.php?lang=fr_FR&layout=classic&version=8.0.1
IP 82.165.73.164:0
Hash 99863d3e037c8f92001ea5b057e50b75
b5a83e310f8694c06f1df82b977bb40fb84e1063
53f92f5c1730a562068249cf82f236352d94b6510b354c80a9689a33da1486dc
GET /core/js/lib_head.js.php?lang=fr_FR&layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:25 GMT
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: max-age=3600, public, must-revalidate
x-powered-by: PHP/7.1.33, PleskLin
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba66ee21-e2f8-434c-a2b3-004950fdfd58.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba66ee21-e2f8-434c-a2b3-004950fdfd58.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 557fea28a0a540d2ffdadd828e03de0b
c314368e2e73dabf2c5d856e2c3e1fae610a3005
0fdd195911cdfff46a6dd8ba7b760953e5317fd7ee88abf1e19458518979fdee
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba66ee21-e2f8-434c-a2b3-004950fdfd58.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11253
x-amzn-requestid: e0561a00-8657-4af0-b24c-08b328282f79
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_wKE9coAMFjmQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1334-2844266d51d5c5672f34ff61;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:56 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: v2OgP5Rhp06ijoZU2F8vOhLjBfHdBMPa2mOIg6EiYJrgCRbrKgJz2g==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:52:07 GMT
age: 51679
etag: "c314368e2e73dabf2c5d856e2c3e1fae610a3005"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/js/jquery-ui.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 70 kB URL HTTP/2 erp.camersoftware.com/includes/jquery/js/jquery-ui.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
File type ASCII text, with very long lines (33326)
Hash 3b0ab7ae40f98bc187636b9caf1dec6a
7fe86f821c643c3c11548173c2133f68ad6a5c04
0abb7a78060533cdeaa6d3ee7f13ca53c6988f34bc2b07ae3c9ca937d4cf47d0
GET /includes/jquery/js/jquery-ui.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 04 Nov 2022 21:23:52 GMT
etag: W/"636582e8-3e8dc"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/ckeditor/ckeditor/ckeditor.js?layout=classic&version=8.0.1
82.165.73.164200 OK 170 kB URL HTTP/2 erp.camersoftware.com/includes/ckeditor/ckeditor/ckeditor.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (586)
Size 170 kB (170455 bytes)
Hash ecf379782defaecaa8faf4dd12f31f67
6f9b5f4a71fe4f223c7451e09108f333dadd9c9f
a27773d8cb46cf9f8bc92e1806b6b40f786885b2db6d7e905244cfee663ab22d
GET /includes/ckeditor/ckeditor/ckeditor.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:57 GMT
etag: W/"620fe479-90be6"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7663e5fc-37de-4be8-9be7-49805622f85d.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7663e5fc-37de-4be8-9be7-49805622f85d.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 99d1ff8fa2e095dcf2bda3d1e1af1221
f914f04a0e1fb45a221d31d2105bfc73015b03e6
90325d4299a44dbd213857ada6f6880db8c33ad61685cfcb60c4a2455a84cf87
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7663e5fc-37de-4be8-9be7-49805622f85d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10183
x-amzn-requestid: 0cdea572-aab4-4d52-948b-976170a787a4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_uLHQZoAMF4hA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1327-7948052f39c4f6071b4a0e0d;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:43 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WDqUFMBT59kulx4WLxNh5XTsHzr4_u524juvZJnGMYBH-mUaJclnTg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:49:03 GMT
age: 51863
etag: "f914f04a0e1fb45a221d31d2105bfc73015b03e6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash a8e573cf25d9f149ad2af6322620e7a4
e37f7e718a683692ce170d3c9bedcad74c4f15f3
eeb9083c83cfaaf54a872a5c0b0a6e572cb1ed3fa9af4a93fa63b7f3c0af9d84
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EEB9083C83CFAAF54A872A5C0B0A6E572CB1ED3FA9AF4A93FA63B7F3C0AF9D84"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8557
Expires: Mon, 05 Dec 2022 14:36:05 GMT
Date: Mon, 05 Dec 2022 12:13:28 GMT
Connection: keep-alive
blueskymotions.net/w76899721.js
185.177.94.108200 OK 48 B URL HTTP/2 blueskymotions.net/w76899721.js
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with no line terminators
Hash 3e9d44b14a3a87708af76ce7b75e647f
df92b3c1d3ee9740a8145cae2214e429b8f714a3
2f5700ca5b37899ece7d2abeac319e9988aa1699a1d858cd84bc43e70900bfe0
Analyzer Verdict Alert fortinet Phishing
GET /w76899721.js HTTP/1.1
Host: blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 48
last-modified: Sun, 09 Oct 2022 10:34:25 GMT
etag: "6342a3b1-30"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
blueskymotions.net/favicon.ico
185.177.94.108204 No Content 0 B URL HTTP/2 blueskymotions.net/favicon.ico
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Mon, 05 Dec 2022 12:13:28 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash e2b907da86e22f71ba6bf0102eea516d
0bd9b08e8333e84d9aa3426d129db7d57a8ef7ba
6f6ac774410685c07647d117ff2bc6a21a3973f24c61fae093c5f69e8a6a69dd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6F6AC774410685C07647D117FF2BC6A21A3973F24C61FAE093C5F69E8A6A69DD"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1211
Expires: Mon, 05 Dec 2022 12:33:40 GMT
Date: Mon, 05 Dec 2022 12:13:29 GMT
Connection: keep-alive
0.blueskymotions.net/w76899721.js
185.177.94.108200 OK 48 B URL HTTP/2 0.blueskymotions.net/w76899721.js
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with no line terminators
Hash 3e9d44b14a3a87708af76ce7b75e647f
df92b3c1d3ee9740a8145cae2214e429b8f714a3
2f5700ca5b37899ece7d2abeac319e9988aa1699a1d858cd84bc43e70900bfe0
Analyzer Verdict Alert fortinet Phishing
GET /w76899721.js HTTP/1.1
Host: 0.blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; uuid=8247982e-a150-4731-85a4-7f8381020fb7
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 48
last-modified: Sun, 09 Oct 2022 10:34:25 GMT
etag: "6342a3b1-30"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
0.blueskymotions.net/favicon.ico
185.177.94.108204 No Content 0 B URL HTTP/2 0.blueskymotions.net/favicon.ico
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: 0.blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://0.blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; uuid=8247982e-a150-4731-85a4-7f8381020fb7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
0.blueskymotions.net/w76899721.js
185.177.94.108304 Not Modified 0 B URL HTTP/2 0.blueskymotions.net/w76899721.js
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Phishing
GET /w76899721.js HTTP/1.1
Host: 0.blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; uuid=8247982e-a150-4731-85a4-7f8381020fb7; uuid=8247982e-a150-4731-85a4-7f8381020fb7
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
If-Modified-Since: Sun, 09 Oct 2022 10:34:25 GMT
If-None-Match: "6342a3b1-30"
Cache-Control: max-age=0
TE: trailers
HTTP/2 304 Not Modified
server: nginx
date: Mon, 05 Dec 2022 12:13:30 GMT
last-modified: Sun, 09 Oct 2022 10:34:25 GMT
etag: "6342a3b1-30"
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash e2b907da86e22f71ba6bf0102eea516d
0bd9b08e8333e84d9aa3426d129db7d57a8ef7ba
6f6ac774410685c07647d117ff2bc6a21a3973f24c61fae093c5f69e8a6a69dd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6F6AC774410685C07647D117FF2BC6A21A3973F24C61FAE093C5F69E8A6A69DD"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5456
Expires: Mon, 05 Dec 2022 13:44:26 GMT
Date: Mon, 05 Dec 2022 12:13:30 GMT
Connection: keep-alive
erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.pie.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.pie.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/flot/jquery.flot.pie.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-2f97"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/select2/dist/js/select2.full.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/select2/dist/js/select2.full.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/select2/dist/js/select2.full.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-124aa"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
dn9.biz/sw/w1s.js
62.210.10.215200 OK 0 B IP 62.210.10.215:0
GET /sw/w1s.js HTTP/1.1
Host: dn9.biz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:30 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
expires: Tue, 05 Dec 2023 12:13:30 GMT
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
erp.camersoftware.com/viewimage.php?cache=1&modulepart=mycompany&file=thumbs%2FCamer-Software-logo---Digital-Solutions--Black_No_Background_1200px_small.jpg
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/viewimage.php?cache=1&modulepart=mycompany&file=thumbs%2FCamer-Software-logo---Digital-Solutions--Black_No_Background_1200px_small.jpg
IP 82.165.73.164:0
GET /viewimage.php?cache=1&modulepart=mycompany&file=thumbs%2FCamer-Software-logo---Digital-Solutions--Black_No_Background_1200px_small.jpg HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:25 GMT
content-type: image/jpeg
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: max-age=3600, public, must-revalidate
pragma: cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-disposition: inline; filename="Camer-Software-logo---Digital-Solutions--Black_No_Background_1200px_small.jpg"
x-powered-by: PHP/7.1.33, PleskLin
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/js/jquery.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/js/jquery.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/js/jquery.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 04 Nov 2022 21:23:52 GMT
etag: W/"636582e8-15cad"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
185.177.94.108200 OK 0 B URL HTTP/2 blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
GET /?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13 HTTP/1.1
Host: blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://away.cdnbestplatform.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:28 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
set-cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; expires=Wed, 04-Jan-2023 12:13:28 GMT; Max-Age=2592000; path=/; domain=blueskymotions.net
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/flot/jquery.flot.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/flot/jquery.flot.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-cee6"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
dn9.biz/sw/w1s.js
212.129.41.238200 OK 0 B IP 212.129.41.238:0
GET /sw/w1s.js HTTP/1.1
Host: dn9.biz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://blueskymotions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
expires: Tue, 05 Dec 2023 12:13:29 GMT
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
erp.camersoftware.com/theme/common/fontawesome/css/font-awesome.min.css?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/theme/common/fontawesome/css/font-awesome.min.css?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /theme/common/fontawesome/css/font-awesome.min.css?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/css
last-modified: Fri, 18 Feb 2022 18:25:25 GMT
etag: W/"620fe495-7918"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/tablednd/jquery.tablednd.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/tablednd/jquery.tablednd.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/tablednd/jquery.tablednd.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-252f"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
0.blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
185.177.94.108200 OK 0 B URL HTTP/2 0.blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
GET /?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13 HTTP/1.1
Host: 0.blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://blueskymotions.net/
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
set-cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; expires=Wed, 04-Jan-2023 12:13:29 GMT; Max-Age=2592000; path=/; domain=0.blueskymotions.net
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
new.weatherplllatform.com/stick.js?v=8.88
91.211.91.114200 OK 0 B URL HTTP/2 new.weatherplllatform.com/stick.js?v=8.88
IP 91.211.91.114:0
ASN #206638 PE Brezhnev Daniil
Analyzer Verdict Alert fortinet Malware
GET /stick.js?v=8.88 HTTP/1.1
Host: new.weatherplllatform.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:25 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 06 Nov 2022 00:27:12 GMT
vary: Accept-Encoding
etag: W/"6366ff60-a40"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
content-encoding: gzip
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/jnotify/jquery.jnotify-alt.min.css?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/jnotify/jquery.jnotify-alt.min.css?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/jnotify/jquery.jnotify-alt.min.css?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/css
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-8f9"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/select2/dist/css/select2.css?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/select2/dist/css/select2.css?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/select2/dist/css/select2.css?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: text/css
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-44c4"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/includes/jquery/plugins/jnotify/jquery.jnotify.min.js?layout=classic&version=8.0.1
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/includes/jquery/plugins/jnotify/jquery.jnotify.min.js?layout=classic&version=8.0.1
IP 82.165.73.164:0
GET /includes/jquery/plugins/jnotify/jquery.jnotify.min.js?layout=classic&version=8.0.1 HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:59 GMT
etag: W/"620fe47b-c1a"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
erp.camersoftware.com/core/js/dst.js
82.165.73.164200 OK 0 B URL HTTP/2 erp.camersoftware.com/core/js/dst.js
IP 82.165.73.164:0
GET /core/js/dst.js HTTP/1.1
Host: erp.camersoftware.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://erp.camersoftware.com/
Cookie: DOLSESSID_016a778d5055813fd1b81b792c966c8e=2k2ravbn945tka744rqqkse24i; DOLSESSTIMEOUT_72d8164cfc4d72be0ef0125ca75431eb8d0ab2bc=1440
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:24 GMT
content-type: application/javascript
last-modified: Fri, 18 Feb 2022 18:24:53 GMT
etag: W/"620fe475-183c"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
dn9.biz/sw/w1s.js
212.129.41.238200 OK 0 B IP 212.129.41.238:0
GET /sw/w1s.js HTTP/1.1
Host: dn9.biz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://0.blueskymotions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
expires: Tue, 05 Dec 2023 12:13:29 GMT
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2
0.blueskymotions.net/?auf=gu4tgmlgmi5diojygyxtonjwgmxtemrpge3dombsgqzdimbz&s=1&sub1=&sub2=dfastspeed13&sub3=&sub4=&cpc=0&cpm=0
185.177.94.108200 OK 0 B URL HTTP/2 0.blueskymotions.net/?auf=gu4tgmlgmi5diojygyxtonjwgmxtemrpge3dombsgqzdimbz&s=1&sub1=&sub2=dfastspeed13&sub3=&sub4=&cpc=0&cpm=0
IP 185.177.94.108:0
ASN #39572 DataWeb Global Group B.V.
GET /?auf=gu4tgmlgmi5diojygyxtonjwgmxtemrpge3dombsgqzdimbz&s=1&sub1=&sub2=dfastspeed13&sub3=&sub4=&cpc=0&cpm=0 HTTP/1.1
Host: 0.blueskymotions.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://0.blueskymotions.net/?p=meygky3cmm5gi3bpg42tmmy&sub2=dfastspeed13
Cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; uuid=8247982e-a150-4731-85a4-7f8381020fb7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 12:13:29 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
set-cookie: uuid=8247982e-a150-4731-85a4-7f8381020fb7; expires=Wed, 04-Jan-2023 12:13:29 GMT; Max-Age=2592000; path=/
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2