www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
301 Moved Permanently 178 B URL HTTP/1.1 www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sun, 27 Nov 2022 21:27:53 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cdbad2434b7d127a4fc769807a9dc3e7
fa98cd9fc2309ab4423f33f683d17bdb17d76713
560cbbb751ab2884024da3b93fba6bc45c6434797dba72a98c05e7fc2bb94bc1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "560CBBB751AB2884024DA3B93FBA6BC45C6434797DBA72A98C05E7FC2BB94BC1"
Last-Modified: Sat, 26 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14642
Expires: Mon, 28 Nov 2022 01:31:55 GMT
Date: Sun, 27 Nov 2022 21:27:53 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 64b2a23eab6e5ae8c010ec7242be930c
0673e4385ba01a5a245711bab96cafc34f765793
64751d193f7af72431e9689581faffcae1a30ff50ea425697b2b80ff61c87909
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5161
Cache-Control: max-age=138561
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:53 GMT
Etag: "63833c71-1d7"
Expires: Tue, 29 Nov 2022 11:57:14 GMT
Last-Modified: Sun, 27 Nov 2022 10:31:13 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 71f9c681a82440fd55e76c780a20e55d
3147768cfbcdd06e0c6e69684292e68e99917a80
5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2216
Expires: Sun, 27 Nov 2022 22:04:49 GMT
Date: Sun, 27 Nov 2022 21:27:53 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 27 Nov 2022 21:19:25 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 508
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: grFr9uIAZGHDI6C8Eefu2EAtGu50ao+ZMRVbQRafytsos9F0wD/1bYhdGr4hzW4zrhA5OuBMOFM=
x-amz-request-id: XYR8ATX4D0KKN0QB
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 27 Nov 2022 20:44:46 GMT
age: 2587
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d4f221590df4f7ca92d41bad23d80010
6915815951976a6ea9c0dcc65d18a55029bb7787
790c90f0ea6f733284d04e773448d16fe8a325c2db63b83a72fb042d8e1a31df
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "790C90F0EA6F733284D04E773448D16FE8A325C2DB63B83A72FB042D8E1A31DF"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10716
Expires: Mon, 28 Nov 2022 00:26:29 GMT
Date: Sun, 27 Nov 2022 21:27:53 GMT
Connection: keep-alive
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 21:27:53 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
200 OK 10 kB URL HTTP/1.1 www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (512)
Hash 5ea985b0f0439c4ad71285a9b6ccc23f
967948142320114facb743ffc6cb2bd938cd2c33
cfff4b7d9b0629aa9036534370b8fb2aafe725ecdfdf1e71f4599119fba9f318
GET /lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:53 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: DENY
Vary: Accept-Encoding, Cookie, Accept-Language
Content-Language: en-gb
X-Content-Type-Options: nosniff
Set-Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; Path=/
visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; expires=Mon, 28 Nov 2022 00:27:53 GMT; Max-Age=10800; Path=/
da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; Path=/
csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; expires=Sun, 26 Nov 2023 21:27:53 GMT; Max-Age=31449600; Path=/; SameSite=Lax
sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar; expires=Sun, 11 Dec 2022 21:27:53 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax
Content-Encoding: gzip
www.mrfreeslots.com/static/mfs_assets/css/new_offers_page.css?v=24
200 OK 3.2 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/css/new_offers_page.css?v=24
IP
File type assembler source, ASCII text
Hash eb35daa1816ff8eda17cf88ba366b007
22898895b6279343be2eca508b3935b409b313f2
ebe011a07198cdca52d620eceaa8e6018a8f6ca8c655900167d4c9035baf77d8
Analyzer Verdict Alert fortinet Phishing
GET /static/mfs_assets/css/new_offers_page.css?v=24 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:53 GMT
Content-Type: text/css
Last-Modified: Tue, 28 Jun 2022 09:37:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:53 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 279 B IP
Hash 2620cb440711056d80ec6ee6a4101116
0de0450475dd899906c36956881f9db5ecad90fd
9a84a21b1cb5e13c925b144beef55b87669a02836087e1a9cf74fa4964ef43f4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4750
Cache-Control: max-age=125562
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:53 GMT
Etag: "63830b45-117"
Expires: Tue, 29 Nov 2022 08:20:35 GMT
Last-Modified: Sun, 27 Nov 2022 07:01:25 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 279
www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
200 OK 1.3 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
IP
File type assembler source, ASCII text
Hash c50c81c69173e5ee771eeb26c88b344e
9ce0719dcbd78518e9dedd1ddfcf4786edaa8edb
1a3e63230a57c7d2736f5cd4170160dc6ce8e65dbfd55f42aeaa89006fd8cd13
Analyzer Verdict Alert fortinet Phishing
GET /static/mfs_assets/css/ticker-strip.css?v=24 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:53 GMT
Content-Type: text/css
Last-Modified: Thu, 18 Feb 2021 14:33:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:53 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 280 B IP
Hash ebed87c2caeb00f3daca76b91f1d5856
0b524def376f7bf90143e8c002fbbdc776d4b457
9d50a898f0edaf6c38ef9827dcfc72de00b8afd71fde693644c3e7424f6efaa4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5788
Cache-Control: max-age=88422
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:53 GMT
Etag: "63827623-118"
Expires: Mon, 28 Nov 2022 22:01:35 GMT
Last-Modified: Sat, 26 Nov 2022 20:25:07 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 280
ocsp.digicert.com/
200 OK 279 B IP
Hash 2620cb440711056d80ec6ee6a4101116
0de0450475dd899906c36956881f9db5ecad90fd
9a84a21b1cb5e13c925b144beef55b87669a02836087e1a9cf74fa4964ef43f4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4751
Cache-Control: max-age=125562
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Etag: "63830b45-117"
Expires: Tue, 29 Nov 2022 08:20:36 GMT
Last-Modified: Sun, 27 Nov 2022 07:01:25 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 263fd6d40218c2b0a2945fa12db8b4e5
db616a4c91fea68c1badef3644d17c033a467dd1
9a5d043d20760ae47a125e8585da97dcaf49405321e810c12e93336f55c95a97
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4384
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Last-Modified: Sun, 27 Nov 2022 20:14:51 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 279
www.mrfreeslots.com/static/css/star-rating-svg.css
200 OK 272 B URL HTTP/1.1 www.mrfreeslots.com/static/css/star-rating-svg.css
IP
File type ASCII text, with very long lines (487), with no line terminators
Hash 35e70490396b03528922aef96a7b6158
5c83e732b4159905c7ddae10bbed46374661a0e6
d796f1a85491909b73d77bc3509835503dbf70a9d49f05cede2d7653aaab47a7
GET /static/css/star-rating-svg.css HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: text/css
Last-Modified: Wed, 28 Oct 2020 15:55:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js
200 OK 6.6 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js
IP
File type ASCII text, with very long lines (20831)
Hash 368c425fc94c424e1688caadefbed981
13d24c22c199ef6668d758434819f44307a65094
ed9c7a83e1c1300a93ecd08807a736ebe7b87ab8262a40bc7e3859d00a46a102
GET /ajax/libs/popper.js/1.14.7/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.mrfreeslots.com
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 21:27:54 GMT
content-type: application/javascript; charset=utf-8
content-length: 6646
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-520c"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 966310
expires: Fri, 17 Nov 2023 21:27:54 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=buXhpzqR5xqg7xRl2jMW9IbhoGQ%2BYVrliHmjVln14NQqeeCaLGl5lIjVAxQSAF6LyVJtY6bDyTKUaZ%2BqCKXUcfDjz9iNdgqwLKzyV09dX1T3zelme%2B6V%2B57MfjX6VLbAIa2Kugx0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770df3529effb50b-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.mrfreeslots.com/static/mfs_assets/css/footer.css?v=24
200 OK 1.1 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/css/footer.css?v=24
IP
File type assembler source, ASCII text
Hash 64d22e9b935b567b45479ab7029f1802
361fefbc1de598442c3491c392c57eb2d53b7de8
c3814d20b9c6f334f8c2c1d60ac4230a83cadb37961e9c4dcec8d1cbca03bd88
Analyzer Verdict Alert fortinet Phishing
GET /static/mfs_assets/css/footer.css?v=24 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: text/css
Last-Modified: Fri, 15 Jan 2021 11:21:45 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0ee1d1a60ec1770ec3e880a25c257f5d
015b05feff63bdcf8fae4d1a8c0c83c923a2ca67
b6845619444a37f322c044933a44cf3fd283a18a54d03bad4f76a2ed8c2cbaf6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.mrfreeslots.com/static/js/custom.js?v=24
200 OK 926 B URL HTTP/1.1 www.mrfreeslots.com/static/js/custom.js?v=24
IP
Hash a712be49f55b9de162f2d8fd992af49b
ef0d07082f772dcd523878a4f24bc8b769affd67
00d86e8eb5c558945beabfb7a4fee49e6ae97784596786dcc49449af5465b32c
Analyzer Verdict Alert fortinet Phishing
GET /static/js/custom.js?v=24 HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 25 Oct 2022 13:12:46 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 280 B IP
Hash ebed87c2caeb00f3daca76b91f1d5856
0b524def376f7bf90143e8c002fbbdc776d4b457
9d50a898f0edaf6c38ef9827dcfc72de00b8afd71fde693644c3e7424f6efaa4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5789
Cache-Control: max-age=88422
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Etag: "63827623-118"
Expires: Mon, 28 Nov 2022 22:01:36 GMT
Last-Modified: Sat, 26 Nov 2022 20:25:07 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 280
www.mrfreeslots.com/static/js/jquery.star-rating-svg.js
200 OK 3.9 kB URL HTTP/1.1 www.mrfreeslots.com/static/js/jquery.star-rating-svg.js
IP
File type ASCII text, with very long lines (661)
Hash 7bb300a2dbfed0ea4daaea7e47bd0c2c
d1cb2c5fb8692971359012a5167387554555a1c8
cee510b5f80fc1f4d6b275820a91551019098d2430688e7fd29f305dba32bf73
Analyzer Verdict Alert fortinet Phishing
GET /static/js/jquery.star-rating-svg.js HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 28 Oct 2020 15:55:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
www.mrfreeslots.com/static/js/jquery-3.3.1.min.js
200 OK 30 kB URL HTTP/1.1 www.mrfreeslots.com/static/js/jquery-3.3.1.min.js
IP
File type ASCII text, with very long lines (65450), with CRLF line terminators
Hash 2d495f5054edf410ef67b9fe39614157
f5048eecb20bffb83bf13f272d2b6599d2ed1a89
97ada30dad98a4983f45c054190b82147114acf4145f843c1c9ee9cd3123f698
Analyzer Verdict Alert fortinet Phishing
GET /static/js/jquery-3.3.1.min.js HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 23 Oct 2020 17:50:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
www.googleoptimize.com/optimize.js?id=OPT-KDLNH7M
200 OK 44 kB URL HTTP/2 www.googleoptimize.com/optimize.js?id=OPT-KDLNH7M
IP
File type ASCII text, with very long lines (1921)
Hash ffd1480dce6703ba772a05188e983750
a61dc3855842bed2e6befeec8de8a9a248804e83
fe42a7483457ae0be7168de79ce1fa4abda5b48e602eaee84c5d110f6f7c5476
GET /optimize.js?id=OPT-KDLNH7M HTTP/1.1
Host: www.googleoptimize.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 27 Nov 2022 21:27:54 GMT
expires: Sun, 27 Nov 2022 21:27:54 GMT
cache-control: private, max-age=900
last-modified: Sun, 27 Nov 2022 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43978
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.mrfreeslots.com/static/str_assets/img/GambleAware.svg
200 OK 6.2 kB URL HTTP/1.1 www.mrfreeslots.com/static/str_assets/img/GambleAware.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (6164), with no line terminators
Hash a2372d6ae8006d52f6cc63facc6bc783
049b076d85a8487b926fe456858e5b184080ccf2
a309913528b8537b116609b9a8bb63cdd95f02f44fe40ec6f550d43f83813d9f
Analyzer Verdict Alert fortinet Phishing
GET /static/str_assets/img/GambleAware.svg HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/svg+xml
Content-Length: 6164
Last-Modified: Fri, 23 Oct 2020 17:50:27 GMT
Connection: keep-alive
ETag: "5f9317e3-1814"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/mfs_assets/img/Logo.svg
200 OK 2.4 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/img/Logo.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (2427), with no line terminators
Hash f5737d1f1c7bdfa58856400df4c1df2d
adc94186482cb97a17918bebad0eb8042d515391
ef0bd6338222716b8f5cfb947f481e2d233b7edb01f2f7efb1ebacf3c37efd1e
Analyzer Verdict Alert fortinet Phishing
GET /static/mfs_assets/img/Logo.svg HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/svg+xml
Content-Length: 2427
Last-Modified: Fri, 15 Jan 2021 11:21:45 GMT
Connection: keep-alive
ETag: "60017ac9-97b"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/str_assets/img/18.svg
200 OK 1.3 kB URL HTTP/1.1 www.mrfreeslots.com/static/str_assets/img/18.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (1334), with no line terminators
Hash f7e06c1e23a211c3a24442064edf3e8b
5fbc29965dc91868595051c5270527d92139affa
3021698ecb6873de4aab9de5ba733b75ece21b12f5c46bb584c731b59e918f6f
Analyzer Verdict Alert fortinet Phishing
GET /static/str_assets/img/18.svg HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/svg+xml
Content-Length: 1334
Last-Modified: Fri, 23 Oct 2020 17:50:27 GMT
Connection: keep-alive
ETag: "5f9317e3-536"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/str_assets/img/GamCare.svg
200 OK 7.5 kB URL HTTP/1.1 www.mrfreeslots.com/static/str_assets/img/GamCare.svg
IP
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (7462), with no line terminators
Hash 24543821b1e8213539622f4abe8735b9
f287d3c51296363ef100a22ae6fe3f032c39f669
bd1cfcdb6b7660b212d3ebf4b33b417b89cc390cbc7bdd6965d939ff5b0648f6
Analyzer Verdict Alert fortinet Phishing
GET /static/str_assets/img/GamCare.svg HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/svg+xml
Content-Length: 7462
Last-Modified: Fri, 23 Oct 2020 17:50:27 GMT
Connection: keep-alive
ETag: "5f9317e3-1d26"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 27 Nov 2022 21:08:54 GMT
cache-control: public,max-age=3600
age: 1140
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash 2620cb440711056d80ec6ee6a4101116
0de0450475dd899906c36956881f9db5ecad90fd
9a84a21b1cb5e13c925b144beef55b87669a02836087e1a9cf74fa4964ef43f4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4751
Cache-Control: max-age=125562
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Etag: "63830b45-117"
Expires: Tue, 29 Nov 2022 08:20:36 GMT
Last-Modified: Sun, 27 Nov 2022 07:01:25 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 279
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/05/1664988394COSTA-BINGO.png
200 OK 22 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/05/1664988394COSTA-BINGO.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 9be1473ba3b6ff7bfc41bc4284a1950a
c3751f864889d25beb9318edeaf504bf5f276de7
acb28a029a4af8b672413464c7c599c1cd0d667bf3df92d2fc5813416c0ada3a
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/05/1664988394COSTA-BINGO.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1664988394COSTA-BINGO.webp"
content-type: image/webp
etag: "9be1473ba3b6ff7bfc41bc4284a1950a"
last-modified: Wed, 05 Oct 2022 16:50:53 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=3;cpu=2;start=2022-11-27T21:27:54.212Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 21544
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/11/11/1636633618POCKET-WIN.png
200 OK 5.8 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/11/11/1636633618POCKET-WIN.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash a964ffa85c014a3491f618bd24b3c909
e5cd3d2c00155b16e45dd13e6772463ff79f5a9d
39d1f6c3bd66a309b6a636bb8bdd9ae63e8d5ca6b16b10db4b82dc93279a8aa8
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/11/11/1636633618POCKET-WIN.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-disposition: inline; filename="1636633618POCKET-WIN.webp"
content-type: image/webp
etag: "a964ffa85c014a3491f618bd24b3c909"
last-modified: Tue, 10 May 2022 13:05:27 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=2;cpu=0;start=2022-11-27T21:27:54.218Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 5768
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash 263fd6d40218c2b0a2945fa12db8b4e5
db616a4c91fea68c1badef3644d17c033a467dd1
9a5d043d20760ae47a125e8585da97dcaf49405321e810c12e93336f55c95a97
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2400
Cache-Control: max-age=141536
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Etag: "638352db-117"
Expires: Tue, 29 Nov 2022 12:46:50 GMT
Last-Modified: Sun, 27 Nov 2022 12:06:51 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 279
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/04/29/1651222407WILD-WEST-WINS.png
200 OK 13 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/04/29/1651222407WILD-WEST-WINS.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 1c07e9d64df9661679e7da1da6ef430a
33742243206eab074d159bd39346b335ce9cf052
8cf32a07f0bda07ece35d5632befd2eb222e3f7a93276940fe154817d8964c7d
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/04/29/1651222407WILD-WEST-WINS.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-disposition: inline; filename="1651222407WILD-WEST-WINS.webp"
content-type: image/webp
etag: "1c07e9d64df9661679e7da1da6ef430a"
last-modified: Tue, 10 May 2022 10:41:08 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=2;cpu=0;start=2022-11-27T21:27:54.223Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 12992
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/12/1665577263SING_BINGO.png
200 OK 11 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/12/1665577263SING_BINGO.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 6e3f56ab9c1ad2f326f65b24c5741980
b78055a51fb502f4be8d4d73db6d7d5e1eca5eea
603fe3177e5cfb91ba25da1ead2e8c40d9ae20d673d1eb9c066a04b144cb1e7c
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/12/1665577263SING_BINGO.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1665577263SING_BINGO.webp"
content-type: image/webp
etag: "6e3f56ab9c1ad2f326f65b24c5741980"
last-modified: Wed, 12 Oct 2022 15:06:44 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=2;cpu=0;start=2022-11-27T21:27:54.225Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 10720
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/11/1665484498SLOTSBABY2.png
200 OK 12 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/11/1665484498SLOTSBABY2.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 8866baad8b1658a5f287bbcfd699b7de
7e6f3e273c712e048dd03efe1c8ed47fbd595cb0
d4078121220b82b5bc311f81642b25a6fb40e557cec1498e44ca6a0b0a1e623a
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/10/11/1665484498SLOTSBABY2.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1665484498SLOTSBABY2.webp"
content-type: image/webp
etag: "8866baad8b1658a5f287bbcfd699b7de"
last-modified: Tue, 18 Oct 2022 12:56:39 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=1;cpu=0;start=2022-11-27T21:27:54.232Z;desc=hit,rtt;dur=19
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 11620
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/03/04/1646399597WINK_SLOTS.png
200 OK 7.5 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/03/04/1646399597WINK_SLOTS.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 0f1df6c96641986b9b99920869d48bd9
dbda8c5733aa1fba9e3a5d532b1ebeb1896cba38
1619781ea9400d971c35a62922be3cab8564efb5516d7f2f30d618f97dffcef4
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/03/04/1646399597WINK_SLOTS.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-disposition: inline; filename="1646399597WINK_SLOTS.webp"
content-type: image/webp
etag: "0f1df6c96641986b9b99920869d48bd9"
last-modified: Thu, 01 Sep 2022 07:50:20 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=11;cpu=0;start=2022-11-27T21:27:54.219Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 7484
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/07/19/1658234850HIGHBET.png
200 OK 4.1 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/07/19/1658234850HIGHBET.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 58deaf12938252dbb7f0655b52629d95
4f29a4731819c592e22027744d1ae745b48edbda
eb51c3c145b3991af970938936d631c5b0bc3439a23d85a9d4ee309fcb3ee025
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/07/19/1658234850HIGHBET.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1658234850HIGHBET.webp"
content-type: image/webp
etag: "58deaf12938252dbb7f0655b52629d95"
last-modified: Tue, 19 Jul 2022 14:18:55 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=1;cpu=0;start=2022-11-27T21:27:54.235Z;desc=hit,rtt;dur=18
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 4052
X-Firefox-Spdy: h2
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/02/09/1644417426BUTLERS-BINGO.png
200 OK 17 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/02/09/1644417426BUTLERS-BINGO.png
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 700x350, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b92bd49d2e421dca1a204911ea42b755
5c010f83078cadaef01a80d8558123840afc3351
60b295c97a180e8e2e28f9b4571d86838a652012f5cc303ede3b71f42569afea
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2022/02/09/1644417426BUTLERS-BINGO.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1644417426BUTLERS-BINGO.webp"
content-type: image/webp
etag: "b92bd49d2e421dca1a204911ea42b755"
last-modified: Tue, 10 May 2022 11:26:23 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=3;cpu=0;start=2022-11-27T21:27:54.237Z;desc=hit,rtt;dur=18
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 16948
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0ee1d1a60ec1770ec3e880a25c257f5d
015b05feff63bdcf8fae4d1a8c0c83c923a2ca67
b6845619444a37f322c044933a44cf3fd283a18a54d03bad4f76a2ed8c2cbaf6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/03/29/1617025101POKERSTARS-CASINO.png
200 OK 3.8 kB URL HTTP/2 res.cloudinary.com/qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/03/29/1617025101POKERSTARS-CASINO.png
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 602638d9c42c780b37033b330f390fa5
e8fac790801f179ada7f60cac029c67943e808fb
7d80f01fa2c60e5c7c712ab49a1aeefb24831a96dc69513e4f8da000465bb0a9
GET /qih/image/upload/f_auto/v1/multisite/media/Merchants/2021/03/29/1617025101POKERSTARS-CASINO.png HTTP/1.1
Host: res.cloudinary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-disposition: inline; filename="1617025101POKERSTARS-CASINO.webp"
content-type: image/webp
etag: "602638d9c42c780b37033b330f390fa5"
last-modified: Tue, 10 May 2022 10:41:09 GMT
date: Sun, 27 Nov 2022 21:27:54 GMT
vary: Accept,User-Agent
strict-transport-security: max-age=604800
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: fastly;dur=10;cpu=0;start=2022-11-27T21:27:54.225Z;desc=hit,rtt;dur=27
server: Cloudinary
timing-allow-origin: *
access-control-allow-origin: *
accept-ranges: bytes
x-content-type-options: nosniff
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
content-length: 3750
X-Firefox-Spdy: h2
www.mrfreeslots.com/static/fonts/JosefinSans-Regular.ttf
200 OK 58 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/JosefinSans-Regular.ttf
IP
File type TrueType Font data, 16 tables, 1st "GDEF", 18 names, Microsoft, language 0x409, Copyright 2010 The Josefin Sans Project Authors (https://github.com/ThomasJockin/JosefinSansFont\012- data
Hash 6762afeccd02d16a80409b78fb85251c
1320915dbd19243be53f5458f1b6f2881efc7e67
31ed94e56b1225f07307210cc2ea46e2209b71fe284423f6929f9cdab124e86d
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/JosefinSans-Regular.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 58548
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-e4b4"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/fonts/JosefinSans-Bold.ttf
200 OK 58 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/JosefinSans-Bold.ttf
IP
File type TrueType Font data, 16 tables, 1st "GDEF", 18 names, Microsoft, language 0x409, Copyright 2010 The Josefin Sans Project Authors (https://github.com/ThomasJockin/JosefinSansFont\012- data
Hash 9ac2a60828c8f6e627f4f628899398f0
b1b440257fcb021f25f1e845b3091e41189695c4
607a55db524faad26263089be4c1a7085072cf2ccf34b3546610288b418a0381
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/JosefinSans-Bold.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 58416
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-e430"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.googletagmanager.com/gtm.js?id=GTM-WLKT5NZ
200 OK 49 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-WLKT5NZ
IP
File type ASCII text, with very long lines (2773)
Hash d736df287371eacb2d841280dfba5523
e6fa512bd9712bac1ddda5cc922ef6d029f6a87b
fd736a3867e0a1b5b270fd3e23dafad534638695b0fcbbff744d0b6b21070807
GET /gtm.js?id=GTM-WLKT5NZ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 27 Nov 2022 21:27:54 GMT
expires: Sun, 27 Nov 2022 21:27:54 GMT
cache-control: private, max-age=900
last-modified: Sun, 27 Nov 2022 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 49201
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.mrfreeslots.com/static/fonts/Roboto-Light.ttf
200 OK 170 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/Roboto-Light.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto LightRegularVersion 2.137; 2017Roboto-Ligh\012- data
Size 170 kB (170012 bytes)
Hash 88823c2015ffd5fa89d567e17297a137
92cc3b6f9440193c12fd02ed690e434d685a9cc8
db02096a91c20ab62d459001a1059bc8d78caa35d637dc91494c4440815a6ac1
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/Roboto-Light.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 170012
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-2981c"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/mfs_assets/img/Background.png
200 OK 158 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/img/Background.png
IP
File type PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced\012- data
Size 158 kB (158359 bytes)
Hash 7f95101572540001a259b2bd538f77fc
5b0d4034173d3122182c9aa4e624d53ee7d0edc8
f56c29fbae418a9e54355df723b50bc69fe5f40811da2fc94af692fd6b993ca8
GET /static/mfs_assets/img/Background.png HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/new_offers_page.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/png
Content-Length: 158359
Last-Modified: Fri, 15 Jan 2021 11:21:45 GMT
Connection: keep-alive
ETag: "60017ac9-26a97"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/fonts/Roboto-Bold.ttf
200 OK 170 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/Roboto-Bold.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.137; 2017Roboto-Bo\012- data
Size 170 kB (170348 bytes)
Hash e07df86cef2e721115583d61d1fb68a6
3dd713113ff2d79b94d2df343e2e28fa8e7279cf
c9cc991deb5d27f267830a19f2301eb164d9e61ec08669c1a1a291c5620ff40a
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/Roboto-Bold.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 170348
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-2996c"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.mrfreeslots.com/static/fonts/RobotoCondensed-Light.ttf
200 OK 168 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/RobotoCondensed-Light.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto Condensed LightRegularVersion 2.137; 2017R\012- data
Size 168 kB (167568 bytes)
Hash 885e5558c90864ddb72ad486f36470cc
b65ec310689040b32a54e62269e8b83e3c40f89e
e4787def35e6d46bb0bef6f6086cceddfc357476858b0e77b3587f6faebe666d
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/RobotoCondensed-Light.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 167568
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-28e90"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ocsp.digicert.com/
200 OK 471 B IP
Hash a6fee11dfe1b88cd768a0ca3e2bd0c89
59cec9a44a4a92467678afe65f347f68641a2174
50870c499aae4d5dfd6df25a36cd04b6d185b66ef0590e46933984bf52e2483f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2253
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 21:27:54 GMT
Last-Modified: Sun, 27 Nov 2022 20:50:21 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471
www.mrfreeslots.com/static/mfs_assets/img/Favicon.png
200 OK 1.7 kB URL HTTP/1.1 www.mrfreeslots.com/static/mfs_assets/img/Favicon.png
IP
File type PNG image data, 201 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash c6a853f0f5efb340594524a32afe03e4
34729b43c4e7714122c9e9e8d7623449a89feeea
8aae7d3977e78a2681b6d0ac4bf33fa2ab14e97d4221957e25d1cbf7ad4175c6
GET /static/mfs_assets/img/Favicon.png HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/lp265/?lavi=BSC14635065&conversion_method=sms&conversion_campaign=6548&send_id=6548
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: image/png
Content-Length: 1727
Last-Modified: Fri, 15 Jan 2021 11:21:45 GMT
Connection: keep-alive
ETag: "60017ac9-6bf"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fb0ce5bcc83f8548143c8f32414db6ba
6d392cbfc66186d0d502b151446a3e0d4eb8992c
e01a2c61da8fbb5060c68b0cf9d6ccef255cc47b8452ee24af03d54c64d6f026
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E01A2C61DA8FBB5060C68B0CF9D6CCEF255CC47B8452EE24AF03D54C64D6F026"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15703
Expires: Mon, 28 Nov 2022 01:49:37 GMT
Date: Sun, 27 Nov 2022 21:27:54 GMT
Connection: keep-alive
www.slotswise.com/api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO
301 MOVED PERMANENTLY 0 B URL HTTP/1.1 www.slotswise.com/api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO HTTP/1.1
Host: www.slotswise.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 301 MOVED PERMANENTLY
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Language, Cookie
X-Frame-Options: SAMEORIGIN
Location: https://www.slotswise.com/api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar/?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO
Content-Language: en-gb
Access-Control-Allow-Origin: slotswise.com
www.mrfreeslots.com/static/fonts/RobotoCondensed-Bold.ttf
200 OK 169 kB URL HTTP/1.1 www.mrfreeslots.com/static/fonts/RobotoCondensed-Bold.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto CondensedBoldRoboto Condensed BoldVersion \012- data
Size 169 kB (169352 bytes)
Hash cbd4e701269338259ee0b39a0b768167
97289a9d7448164e46ea8b3107a24ac1807f6c0e
d1ab7a9092d779eb7eb97f3f7d4563c857e86572fb829c42f2972a8e232ec67d
Analyzer Verdict Alert fortinet Phishing
GET /static/fonts/RobotoCondensed-Bold.ttf HTTP/1.1
Host: www.mrfreeslots.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/static/mfs_assets/css/ticker-strip.css?v=24
Cookie: session_key=xz3ulyj8on3gzxk1nh36twc13k1udjar; visitor_key=9d0b6d74de320aca6dea0c72b52679aa611c3c8c; da_cookies="{'query_dict': {'value': \"{'lavi': 'BSC14635065'\054 'conversion_method': 'sms'\054 'conversion_campaign': '6548'\054 'send_id': '6548'}\"\054 'expiry': '2022-11-27 21:27:53'}\054 'network': {'value': 'nonetwork'\054 'expiry': '2022-11-27 21:27:53'}\054 'channel': {'value': 'direct'\054 'expiry': '2022-11-27 21:27:53'}}"; csrftoken=XnwUUnOR3SkmIwRsV1dfv90yvTKcLTSa6azPTpFw4B7WGWGzSGOQFpHAUFoYPq2k; sessionid=xz3ulyj8on3gzxk1nh36twc13k1udjar
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Content-Type: application/octet-stream
Content-Length: 169352
Last-Modified: Mon, 21 Dec 2020 10:32:53 GMT
Connection: keep-alive
ETag: "5fe079d5-29588"
Expires: Mon, 27 Nov 2023 21:27:54 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
www.slotswise.com/api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar/?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO
200 OK 0 B URL HTTP/1.1 www.slotswise.com/api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar/?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/ga-hit/xz3ulyj8on3gzxk1nh36twc13k1udjar/?url=https%3A%2F%2Fwww.mrfreeslots.com%2Flp265%2F%3Flavi%3DBSC14635065%26conversion_method%3Dsms%26conversion_campaign%3D6548%26send_id%3D6548&user_agent=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&referrer=&ip_addr=undefined&visitor_id=9d0b6d74de320aca6dea0c72b52679aa611c3c8c&geo=NO HTTP/1.1
Host: www.slotswise.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.mrfreeslots.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Nov 2022 21:27:54 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept, Accept-Language, Cookie
X-Frame-Options: SAMEORIGIN
Content-Language: en-gb
Allow: GET, HEAD, OPTIONS
Access-Control-Allow-Origin: slotswise.com
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: bODrZytEuCx57jotKSL6Wg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: h7Y3hFVnRDffwQlBOkKfQY4m9Ns=
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1325)
Hash 47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sun, 27 Nov 2022 20:41:08 GMT
expires: Sun, 27 Nov 2022 22:41:08 GMT
cache-control: public, max-age=7200
age: 2806
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5285
Expires: Sun, 27 Nov 2022 22:56:00 GMT
Date: Sun, 27 Nov 2022 21:27:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5285
Expires: Sun, 27 Nov 2022 22:56:00 GMT
Date: Sun, 27 Nov 2022 21:27:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5285
Expires: Sun, 27 Nov 2022 22:56:00 GMT
Date: Sun, 27 Nov 2022 21:27:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5285
Expires: Sun, 27 Nov 2022 22:56:00 GMT
Date: Sun, 27 Nov 2022 21:27:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5285
Expires: Sun, 27 Nov 2022 22:56:00 GMT
Date: Sun, 27 Nov 2022 21:27:55 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg
200 OK 8.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 741ddfb19764ac9a77509e7e87cfbfb2
308c08784ce4a0757cbd112807555b83e17a1d56
e9271a76da94d8b655860c3b00d111396c5d3a227fd2f19e0ef400fd5e84d87e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8817
x-amzn-requestid: 33d3ca17-7878-4897-a634-5f626a64e820
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cJ40OEOqIAMFaOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6380a1b4-040288d571fc10b96d893fa4;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 11:06:28 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: f_U8KSYET6kaKAPbEV7sHW0tO6JGijsqUvghniwzFCRd2YGQjVlFoA==
via: 1.1 f313d3df80c4dab8f5399614116801cc.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 10:16:35 GMT
age: 40280
etag: "308c08784ce4a0757cbd112807555b83e17a1d56"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2cd887044e91d7ed0f1a8d7119ff7dd0
ae8aa4ce6ddaccba771fe65446926b60fc5628da
bad283c15531000b7a8c126d442154b64a880cc26196a46cbd2e6266a526db67
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10199
x-amzn-requestid: baee3bbe-7ded-425a-ae39-fccfc8169217
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iF1VIAMF09g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-5522727b2f09b27e63b23270;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: K2eKLQhrsCdd4ASsfEibRuZAYW4CpPTlO3fZs7xdoKrw1HBxfTGkEA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:42:14 GMT
etag: "ae8aa4ce6ddaccba771fe65446926b60fc5628da"
content-type: image/jpeg
age: 85541
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff0b2959f-9d1d-41c7-a7c1-b9f52a7766ac.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff0b2959f-9d1d-41c7-a7c1-b9f52a7766ac.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 76c00eceed956377d7469ef58b0815cb
97a135335f5b1b042adeb385718f8808cb78528b
81fb72ab752b2eb39ab6ee015055304490b3b6c3259968703fd07c2a2eed1e61
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff0b2959f-9d1d-41c7-a7c1-b9f52a7766ac.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7380
x-amzn-requestid: 18589644-299c-4a39-9376-db1bd1472009
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iEegIAMFeuQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-23990acc0fdc599a75a534e3;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: RqsZxAtbOkWBGbXJ3sZHxcS-ZvWOw7Yg2Qd4zj0QLhrp3wAXC8w6jA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:42:14 GMT
etag: "97a135335f5b1b042adeb385718f8808cb78528b"
content-type: image/jpeg
age: 85541
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg
200 OK 5.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 433875a1b1fef34e45f2d8ac344c07e3
f2129466436cbbdd58abe42a47fb7af19eba58e6
ab1e7b46f3804640c7dd94d70c8c31ec2dfc3e2f0f015a8556d04d9d9089c450
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5099
x-amzn-requestid: 57648043-7820-453d-9549-0f743b6c2557
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4jFBvoAMFl1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-53b59d607b82c264180f469d;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VsdLWuh4rCawI5V0YYGaHxEMl2YEVNgsbjfCwzDsrnCZhRK2FkCkVw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:42:14 GMT
etag: "f2129466436cbbdd58abe42a47fb7af19eba58e6"
content-type: image/jpeg
age: 85541
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
200 OK 4.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 841a4b110022a99ddea6f7bf66df0fa1
126771b86638108050cf57c0d12faa27f80f0edb
240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4309
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: blE0hGNioAMF_Tg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 05:54:16 GMT
age: 56019
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg
200 OK 8.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4e97baa4851785eac92c719abf481c64
c32a57038d3cdbc514c9081c9938eca6a04fb481
adb59e982648082e5421f58899a5331b2747e9d45be33c495fbe3ab8cc872b22
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8387
x-amzn-requestid: fc238ea9-0169-47fc-b92e-f12b3ee27c72
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b433YGtOoAMFexg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6379d362-2f97c67a2e5f05b6746cf858;Sampled=0
x-amzn-remapped-date: Sun, 20 Nov 2022 07:12:34 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: oMrdB0NUGe5CqTY7eFd3u8xaSy9TyDdOrf1awBikFJzm3jWreD2irQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 82c2ab57bc9900898383f6b70681b9e6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 12:30:20 GMT
age: 32255
etag: "c32a57038d3cdbc514c9081c9938eca6a04fb481"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css
200 OK 0 B URL HTTP/2 stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css
IP
GET /bootstrap/4.3.1/css/bootstrap.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.mrfreeslots.com
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 21:27:54 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"a15c2ac3234aa8f6064ef9c1f7383c37"
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
cdn-cachedat: 08/15/2022 13:52:49
cdn-proxyver: 1.02
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: b6d5044a6e7b2b51455aee5e8604f87c
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 770df3528c13b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
use.fontawesome.com/releases/v5.6.3/css/all.css
200 OK 0 B URL HTTP/2 use.fontawesome.com/releases/v5.6.3/css/all.css
IP
GET /releases/v5.6.3/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 21:27:54 GMT
content-type: text/css
x-amz-id-2: pjTeMppmmKy2yfey9y7j18UIFw9WbwapUPIJ+IMkYcimIyPOQltBVapR0pw2QLVKR1ItkRwNm34=
x-amz-request-id: 34H6GRS22N6D0AJ4
last-modified: Wed, 30 Jun 2021 15:44:33 GMT
etag: W/"dc93d584e41f8417f6b7163320d34329"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 87409
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r2N1f5Hlkf524Tl0rTh2sFscispo8VFHSvCuiu6l4abPMtDG2fW2U%2FQrLd6b%2BKFpCjcAZn9KAUS6fz3N0NE%2BB7Z3nNwLyiO5Mcb6KMcPIWELqY2W3s0Ykhoeh3A3LYA7XdYwWvem"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 770df352cb758e36-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js
200 OK 0 B URL HTTP/2 stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js
IP
GET /bootstrap/4.3.1/js/bootstrap.min.js HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.mrfreeslots.com
Connection: keep-alive
Referer: https://www.mrfreeslots.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 21:27:54 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"e1d98d47689e00f8ecbc5d9f61bdb42e"
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
cdn-cachedat: 11/18/2022 06:18:31
cdn-proxyver: 1.03
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 863
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 7c506651668d520570bb1302601b26f7
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 770df3529c44b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
18.197.71.232
34.117.237.239
104.17.24.14
93.184.220.29
151.101.85.137
23.36.77.32