r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2acd891dc6eb1f09f57a2b086791781
1e2088306501a61edcca1ade62c4d54f23b3b083
51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3065
Expires: Fri, 09 Dec 2022 13:19:12 GMT
Date: Fri, 09 Dec 2022 12:28:07 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 388f6fea5bafa378266622b72311a6ee
447f102dc12172ce1ba44c5e94e1d7bb49d43372
a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7447
Expires: Fri, 09 Dec 2022 14:32:14 GMT
Date: Fri, 09 Dec 2022 12:28:07 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 09 Dec 2022 12:08:18 GMT
content-type: application/json
age: 1189
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4ee537977be9c03702f8ffe0025bf1fe
21637881c4aa34c4add703f8bff4eff573159f45
4819229fd8f502a0c68c80bd7409e104c1b4d1a98ca8a6cd9deba629b1511aea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4819229FD8F502A0C68C80BD7409E104C1B4D1A98CA8A6CD9DEBA629B1511AEA"
Last-Modified: Thu, 08 Dec 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12864
Expires: Fri, 09 Dec 2022 16:02:31 GMT
Date: Fri, 09 Dec 2022 12:28:07 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: XkDPtktwuY3pxSUUSl0zH/rbgyA0R6R2bN8XRbLSeBEZwiDsA3C8MnwT+rHNw7tpuRlFsARbJCKYVgKCFErp8Q==
x-amz-request-id: EGCEKRQCW8K1BRZM
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 09 Dec 2022 11:50:14 GMT
age: 2273
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 09 Dec 2022 12:28:07 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Last-Modified, ETag, Cache-Control, Alert, Content-Length, Pragma, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 09 Dec 2022 12:07:55 GMT
age: 1212
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash e6be4d2155028ffff5d01ab6e7edf6da
07172071b5cf43c4cd7d7930b4ad8518ec1e32e9
4d8a5fa2362fd0910babd6d128d850d4460829468eb23d34ee5ee6eaa42d5a38
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1543
Cache-Control: max-age=162271
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:07 GMT
Etag: "6392faaf-1d7"
Expires: Sun, 11 Dec 2022 09:32:38 GMT
Last-Modified: Fri, 09 Dec 2022 09:06:55 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 5QlH8qqH73ChNhU0Fjw6BQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: D0h9O7LewX7l3lfdRaYKyJm0rsg=
ww16.dgsgfsdgd.aliranto.uk.com/?sub1=20221209-2327-47c9-92a2-7766aab1eb31
200 OK 1.4 kB URL HTTP/1.1 ww16.dgsgfsdgd.aliranto.uk.com/?sub1=20221209-2327-47c9-92a2-7766aab1eb31
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (768)
Hash e373060986c395cb18502d8ad1810a40
7203552935295dfa06ec1711430209477582f2ed
0f482157872d5992d831bb38237c97400938210d3f61fd9f2b008a5dddffcf20
GET /?sub1=20221209-2327-47c9-92a2-7766aab1eb31 HTTP/1.1
Host: ww16.dgsgfsdgd.aliranto.uk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
date: Fri, 09 Dec 2022 12:28:08 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_twTLG8LnubjcBlytsqZf+K8jI+lnI9kInzl899DdrKfsQyDvjR0BmxPqOvGkCE6T/UFkHDwq0anqcb3OnFNa2A==
last-modified: Fri, 09 Dec 2022 12:28:07 GMT
x-cache-miss-from: parking-7887f445cc-dv59s
server: NginX
content-encoding: gzip
img.sedoparking.com/images/js_preloader.gif
200 OK 4.3 kB URL HTTP/1.1 img.sedoparking.com/images/js_preloader.gif
IP
File type GIF image data, version 89a, 16 x 16\012- data
Hash 90c93102a88c2ab94bff1575b7a6e86e
56d71bf13de464534643db9d127629a0a3bf677a
5f6ad7031600056b578a6e8c6b34bc718d13125cc8256aa4a9050e549576f81a
GET /images/js_preloader.gif HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/
HTTP/1.1 200 OK
Date: Fri, 09 Dec 2022 12:28:08 GMT
Content-Type: image/gif
Content-Length: 4254
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Fri, 16 Dec 2022 12:28:08 GMT
X-CFHash: "90c93102a88c2ab94bff1575b7a6e86e"
X-CFF: B
Last-Modified: Fri, 15 Mar 2019 12:24:07 GMT
X-CF3: H
CF4Age: 156700
x-cf-tsc: 1648179742
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: bedfad4755058b0f129c5f647d04dd2a
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes
ww16.dgsgfsdgd.aliranto.uk.com/search/tsc.php?200=NDE0NDE5NzM4&21=OTEuOTAuNDIuMTU0&681=MTY3MDU4ODg4ODliYWYwYmJhMDliZWZiYTJjNDA2YWQzZDVlMmQ2NjNk&crc=3c3948cb023464a5b4fce5b2c45acab25ed09c5c&cv=1
200 OK 0 B URL HTTP/1.1 ww16.dgsgfsdgd.aliranto.uk.com/search/tsc.php?200=NDE0NDE5NzM4&21=OTEuOTAuNDIuMTU0&681=MTY3MDU4ODg4ODliYWYwYmJhMDliZWZiYTJjNDA2YWQzZDVlMmQ2NjNk&crc=3c3948cb023464a5b4fce5b2c45acab25ed09c5c&cv=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /search/tsc.php?200=NDE0NDE5NzM4&21=OTEuOTAuNDIuMTU0&681=MTY3MDU4ODg4ODliYWYwYmJhMDliZWZiYTJjNDA2YWQzZDVlMmQ2NjNk&crc=3c3948cb023464a5b4fce5b2c45acab25ed09c5c&cv=1 HTTP/1.1
Host: ww16.dgsgfsdgd.aliranto.uk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/?sub1=20221209-2327-47c9-92a2-7766aab1eb31
HTTP/1.1 200 OK
date: Fri, 09 Dec 2022 12:28:08 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
x-cache-miss-from: parking-7887f445cc-dv59s
server: NginX
ww16.dgsgfsdgd.aliranto.uk.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D
302 Found 0 B URL HTTP/1.1 ww16.dgsgfsdgd.aliranto.uk.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1
Host: ww16.dgsgfsdgd.aliranto.uk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/?sub1=20221209-2327-47c9-92a2-7766aab1eb31
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Fri, 09 Dec 2022 12:28:08 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Fri, 09 Dec 2022 12:28:08 GMT
location: /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D
x-cache-miss-from: parking-7887f445cc-2ksr7
server: NginX
ww16.dgsgfsdgd.aliranto.uk.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D
302 Found 311 B URL HTTP/1.1 ww16.dgsgfsdgd.aliranto.uk.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 78f31bb7c7998400afeb390b56f9873a
bb4ff1f389f67a61f1f732c11c5758e267d30317
9fbd4612f6e0c14ac1bfbefebdafe21b66ae31fc9ddf4373ef185e687dca1792
GET /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D0JImfWE%2AosM_0&v=MWZiOGM4OGM5ZDRhODBkZjlkNzY0YjE4NDlmYzlhOTAJMQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzJhMS4yMjcwNzUyOQl3dzE2LmRnc2dmc2RnZC5hbGlyYW50by51ay5jb202MzkzMjlkNzFiNzVmNS43OTk3OTEwNAkxNjcwNTg4ODg4CWFkXzYzXzA=&l=OAk2NjQ2YzUxZWEyNDEwOTFjMTcyNjUxOGFlY2VhM2ViMQkwCTM1CTAJZGFkMDc1NzA2MDg1Yzk1YzE5YjVkOTJiYzUxZjk0NDIJNDE0NDE5NzM4CWFsaXJhbnRvCTAJNjMJNgkyCTE2NzA1ODg4ODgJMC4wMDAzMzQJTgkwCTAJMAkxMjA1CTQwMjAyMjk3Ngk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1
Host: ww16.dgsgfsdgd.aliranto.uk.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/?sub1=20221209-2327-47c9-92a2-7766aab1eb31
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Fri, 09 Dec 2022 12:28:08 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Fri, 09 Dec 2022 12:28:08 GMT
location: http://xml.sedodna.com/click?i=0JImfWE*osM_0
x-cache-miss-from: parking-7887f445cc-kvn97
server: NginX
xml.sedodna.com/click?i=0JImfWE*osM_0
302 Found 0 B URL HTTP/1.1 xml.sedodna.com/click?i=0JImfWE*osM_0
IP
ASN #27257 WEBAIR-INTERNET
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?i=0JImfWE*osM_0 HTTP/1.1
Host: xml.sedodna.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: http://q3.quotes.com/ef831324-77bc-11ed-afc6-4bd15981e955
Pragma: no-cache
q3.quotes.com/ef831324-77bc-11ed-afc6-4bd15981e955
200 OK 170 B URL HTTP/1.1 q3.quotes.com/ef831324-77bc-11ed-afc6-4bd15981e955
IP
ASN #60781 LeaseWeb Netherlands B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with no line terminators
Hash 1317771a31bb48f4e74ab13bc5f2eb7a
8b59ff3e5880ce1bb70f354f7d2eaff608a049b6
5b5f73679c0d3799e7d237fb54e31827b1152439ad04a9cd2e357e9a109cae22
GET /ef831324-77bc-11ed-afc6-4bd15981e955 HTTP/1.1
Host: q3.quotes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww16.dgsgfsdgd.aliranto.uk.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 170
content-type: text/html; charset=utf-8
date: Fri, 09 Dec 2022 12:28:08 GMT
server: nginx
q3.quotes.com/ef831324-77bc-11ed-afc6-4bd15981e955?hr=1
302 Found 11 B URL HTTP/1.1 q3.quotes.com/ef831324-77bc-11ed-afc6-4bd15981e955?hr=1
IP
ASN #60781 LeaseWeb Netherlands B.V.
File type ASCII text, with no line terminators
Hash 32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
GET /ef831324-77bc-11ed-afc6-4bd15981e955?hr=1 HTTP/1.1
Host: q3.quotes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Fri, 09 Dec 2022 12:28:08 GMT
location: http://ciar-kep.com/zcvisitor/ef954e91-77bc-11ed-a322-0ad90c05d68f/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=15e92720-c079-11ec-bea2-128084d1ce51
server: nginx
ciar-kep.com/zcvisitor/ef954e91-77bc-11ed-a322-0ad90c05d68f/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=15e92720-c079-11ec-bea2-128084d1ce51
200 1.1 kB URL HTTP/1.1 ciar-kep.com/zcvisitor/ef954e91-77bc-11ed-a322-0ad90c05d68f/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=15e92720-c079-11ec-bea2-128084d1ce51
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 6dbcb113a44af96a2f21ee87a88a2759
4226033d4684bd2309b6e6eeb4ffacd3c4e6e86e
121161847876b9ff9f7a3e3d13049629eb292ef8f331ab3ebfdc8b832be7a7ee
Analyzer Verdict Alert fortinet Phishing
GET /zcvisitor/ef954e91-77bc-11ed-a322-0ad90c05d68f/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=15e92720-c079-11ec-bea2-128084d1ce51 HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Fri, 09 Dec 2022 12:28:09 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: BTnzOqhA
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4654
Expires: Fri, 09 Dec 2022 13:45:43 GMT
Date: Fri, 09 Dec 2022 12:28:09 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4654
Expires: Fri, 09 Dec 2022 13:45:43 GMT
Date: Fri, 09 Dec 2022 12:28:09 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4654
Expires: Fri, 09 Dec 2022 13:45:43 GMT
Date: Fri, 09 Dec 2022 12:28:09 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg
200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5de5d319f43d9c9c641419d96655541f
cde4c7fa0145d3645af17e34c83c63c08f76a076
fdb114eb142f035c7a54195d16af51b5b423642c312f4bccc0f407d8fcc245aa
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7557
x-amzn-requestid: 400d1465-ecbf-4d95-8aa8-4dce5dca0716
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctluwGo4oAMFhTg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638ee991-6dba29ae7065d5347a1a420d;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 07:04:49 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Lazl-stakC-31gMuQ2WzH9uFkIb0g7HaaM3xkwSFdFJMWKTaKqrBEQ==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 12:33:10 GMT
age: 86099
etag: "cde4c7fa0145d3645af17e34c83c63c08f76a076"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ciar-kep.com/zcredirect?visitid=ef954e91-77bc-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
200 752 B URL HTTP/1.1 ciar-kep.com/zcredirect?visitid=ef954e91-77bc-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (333)
Hash 56ebf9a837d5d64ff3c6c3acc96ff2c6
5a78cf25580aa7093b47c0bf5e3f2f81274dd0ec
71bdece4410e21f1327059290c609890cd2868cbc088211612e5ad1d2a30fa8c
GET /zcredirect?visitid=ef954e91-77bc-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ciar-kep.com/zcvisitor/ef954e91-77bc-11ed-a322-0ad90c05d68f/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=15e92720-c079-11ec-bea2-128084d1ce51
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Fri, 09 Dec 2022 12:28:09 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: XbKBTnjU
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2654f7a6-bd8b-4c13-9c46-9b7582ba979a.jpeg
200 OK 5.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2654f7a6-bd8b-4c13-9c46-9b7582ba979a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 06514ce96ae21cb01f526a5febdcbeb4
ebb97e5b97f394e8c67098f55581d5329ce819a2
4099a2fb6ddc4feaa30f357a180d64aeb7c9fc73f115fc762d5fe5c221d2e89e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2654f7a6-bd8b-4c13-9c46-9b7582ba979a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5169
x-amzn-requestid: 277a1b04-4e19-4313-8aac-5f9ab9076305
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctEdkFGrIAMFvHg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638eb456-5b21edd57297665012d536cc;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 03:17:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Xi-bshsYa4LlKbJgAt0h-lPnB_5uQbqln5JGBRE8io2Fp1y41cS9xg==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 04:08:48 GMT
age: 29961
etag: "ebb97e5b97f394e8c67098f55581d5329ce819a2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg
200 OK 7.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8c3214044657f3b876d1f1848bca5684
7558222788f06623ddae6e883413e38e1146281e
e1f9c9c445bba7765f371dbb655cab43c1e12de7cbd015f8034c494118f7f708
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7897
x-amzn-requestid: 032fd8ae-b7e9-4e12-8546-838191a73688
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cwVM_F51IAMFunw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63900252-345ae6cd107d207f5dbe29a8;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 03:02:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: N-zFZ8yeL7RrOZ5xfqvfBaE3zcXWecvr6Jd-93nKiUZlCXp2n2_Bgw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 03:41:46 GMT
age: 31583
etag: "7558222788f06623ddae6e883413e38e1146281e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a20bda5-6ca4-42c4-8729-6e975652e66a.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a20bda5-6ca4-42c4-8729-6e975652e66a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8546542f00ea29ef4df6ab8d3c7c2164
5c8ffe91490006a9890188b53f875568c2b6bd8f
7fb11750ac339ac283da62fd370862c6b95a103a585ca5dd8c90038718d818a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6a20bda5-6ca4-42c4-8729-6e975652e66a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6578
x-amzn-requestid: 6392feb9-e33e-42fa-bc10-b5e31e654c9b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cw4beGG7oAMF8hA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63903aaf-2c890b7b0a16617346a0f7e7;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 07:03:11 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: H067kZXU_djWxbWO34bYMqa0xZ-WF9ntEBhZ-kV_TDoJFXQL_J1hqQ==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 03:34:27 GMT
age: 32022
etag: "5c8ffe91490006a9890188b53f875568c2b6bd8f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg
200 OK 8.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash eb00a2a503a690cee3e4dd729b5bc9bd
cfb1e5bcab2148a777889680e6e36b9d7e8917ec
7e4583ae78ab597639f53669ac2d67d1ebd26be3278c2fc3fc95af934178c116
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9f25ad59-b8ed-49ea-9611-21f63c20c8fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7960
x-amzn-requestid: beadd240-39d0-407d-a890-6a095657cac3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctEd8HC0oAMFUag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638eb459-44d4f63c62f58684782ef14a;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 03:17:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: kTEbkncBnAJmQE8cdAqvDtejiwaetpRBsVcpLXy1h52lO4iUkzmOGA==
via: 1.1 74aa91fe819001bcedd882694f52b436.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 16:28:48 GMT
age: 71961
etag: "cfb1e5bcab2148a777889680e6e36b9d7e8917ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg
200 OK 5.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash fba9a3854df65740512f96efe7442e58
8fbff7725c842d70e047c635a725723a9dc9c55a
6e639298ebc82343cee9267d2910d15735af55f910e2c3de9218266b7c6fffc9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5188
x-amzn-requestid: afb8cbd2-3674-4dac-9cd9-9ff83618ac0a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ck2-5G9joAMFlPA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638b6b92-2979ff216b9028aa70baef8b;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 15:30:26 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 7Dp35PIr_WYUI1bBa21AvmCMEPi0d3jnhuS8eEk3Q3CXRcGWAnkD8g==
via: 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 17:01:04 GMT
age: 70025
etag: "8fbff7725c842d70e047c635a725723a9dc9c55a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 1d0d1fd1f6fc0e6b2621e908e31fceb3
0e3e91c48d00577aef6ac29f3f507894e11dc2cc
724ae1a2761f7ae311818739983504b74c1fa66fc565f4440986ff215bb62c2e
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "724AE1A2761F7AE311818739983504B74C1FA66FC565F4440986FF215BB62C2E"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2636
Expires: Fri, 09 Dec 2022 13:12:05 GMT
Date: Fri, 09 Dec 2022 12:28:09 GMT
Connection: keep-alive
ciar-kep.com/favicon.ico
404 653 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Hash ba2732b1b2fa2626ffaa15f62f9e7d66
203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
GET /favicon.ico HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ciar-kep.com/zcredirect?visitid=ef954e91-77bc-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
HTTP/1.1 404
Date: Fri, 09 Dec 2022 12:28:09 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: SWEvxhgD
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 1d0d1fd1f6fc0e6b2621e908e31fceb3
0e3e91c48d00577aef6ac29f3f507894e11dc2cc
724ae1a2761f7ae311818739983504b74c1fa66fc565f4440986ff215bb62c2e
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "724AE1A2761F7AE311818739983504B74C1FA66FC565F4440986FF215BB62C2E"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2635
Expires: Fri, 09 Dec 2022 13:12:05 GMT
Date: Fri, 09 Dec 2022 12:28:10 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 278 B IP
Hash f124ce48489f81cc7b3c6853270450e2
89a44b882bea390d04059e37ef08b7e35acd53a8
43c921468d52b77a95389030fd64cfd3ba7caa9b15e34550404694aa5e016e7e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=94468
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:10 GMT
Etag: "6391f7de-116"
Expires: Sat, 10 Dec 2022 14:42:38 GMT
Last-Modified: Thu, 08 Dec 2022 14:42:38 GMT
Server: nginx
Content-Length: 278
trk.buyent.xyz/aff_c?offer_id=10742&aff_id=101167
302 Found 646 B URL HTTP/2 trk.buyent.xyz/aff_c?offer_id=10742&aff_id=101167
IP
Hash 45ef25c7c55bceba442551b8fa40fb86
c958bbed6463659c35e942028e12471c940916b8
48f89d11baced40fa0d177c37a5fbf628f5aca113ac16ca41ab8df519374ad0b
GET /aff_c?offer_id=10742&aff_id=101167 HTTP/1.1
Host: trk.buyent.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://hawkaffinity.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Fri, 09 Dec 2022 12:28:10 GMT
content-type: text/html; charset=iso-8859-1
cache-control: no-cache, no-store, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: /aff_r?offer_id=10742&aff_id=101167&url=https%3A%2F%2Fji.hotelcomparly.com%2Fa%2Fbk%3Ftransaction_id%3D1026566e61d7e1c9ce9778696e8063&urlauth=781037843444623860945928647071
p3p: CP="NOI CUR OUR NOR INT"
pragma: no-cache
set-cookie: enc_aff_session_10742=ENC03ab60a8a92b2ec5c0568d507fce67c23ef1f1bd3573fefa1f4870a2490614b7c5ab25fd7cebc8378dd2994f070d7fd5577038cdc7ef1be4ae43a0ca4c7589b267b85c71c99186558f6ecb910dfb4d7a7c6bb20e3a5b316c743850b89652da385d6dfff494bc6da2e2a992dc0e884992207b9faa121fddcab9f8e1aa05b04c5d2132c923bd451b4044f82ec8741962562c27ca9ca511d0cfcfb34a4e9c736101a00e845ef3; expires=Fri, 23 Dec 2022 12:28:10 GMT; path=/; SameSite=None; Secure
ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMDUuMCIsIm1vYmlsZV9jYXJyaWVyIjoiPyIsInVzZXJfYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgWDY0OyBSdjoxMDUuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMDUuMCIsImFjY2VwdF9sYW5ndWFnZSI6ImVuLVVTLGVuO3E9MC41IiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9; expires=Sun, 02 Nov 2025 23:08:10 GMT; path=/; SameSite=None; Secure
tracking_id: 1026566e61d7e1c9ce9778696e8063
access-control-allow-origin: *
x-request-id: 31acc21e9e81d8254ff639414256f164
access-control-allow-headers: Tune-SDK-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qc2W%2FqsM6YitFisZEjm3%2FX%2Br6TWyPaHbKEvO2yS1PuJ%2Bnlzh9WuOwvDPuQTiFybIin%2BaN9poORqX6ntddWRtLZU74hppIWt6gKvK%2B7FI%2BEZV83oyHMn8o%2BAoqQTAfvt0%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776dbd37bb01b4e8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 541 B IP
Hash 9b4eeea263acc0525b98cc644e5f95e5
99cc124f281c2672317d14f0fbb77e9e80247ca5
cbed0133f0f5809442caefd71e55daed30814440e80ff9d0e4df196bb74cd1f0
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 988
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:11 GMT
Etag: "63917c3c-116"
Last-Modified: Fri, 09 Dec 2022 12:11:44 GMT
Server: ECS (amb/6B81)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
200 OK 278 B IP
Hash 7a6bab7eda8c88ad6649feb9253ce0b7
9595db69dbdf08dee4800dcfcbb9344fbfb03e70
5bbb722ffe6c3d4ceb4e732173803bc2e5704df1e998c8febabd60403ac1a923
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 988
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:11 GMT
Last-Modified: Fri, 09 Dec 2022 12:11:44 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 278
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0d346920b33dadc2458ab9d5b069e12a
70fd69a8f314c8786d3a65e8e1fd0fd3587eae71
6db7d3710dea1fce3be9f4cafeb0b2fc0a0bbe568d96e61dd3aeca6963106c11
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6DB7D3710DEA1FCE3BE9F4CAFEB0B2FC0A0BBE568D96E61DD3AECA6963106C11"
Last-Modified: Wed, 07 Dec 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12318
Expires: Fri, 09 Dec 2022 15:53:30 GMT
Date: Fri, 09 Dec 2022 12:28:12 GMT
Connection: keep-alive
hawkaffinity.com/
200 OK 685 B IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (347), with no line terminators
Hash 1b78013e36e8bf279a8c1b84f36bf4b3
1978b3c3e277ae4ab218c21484bf992f082e7cf5
67c0d04936f528327fea8699f632594d06743ea6fb5aaa4d6155a4a9b2b21ec7
POST / HTTP/1.1
Host: hawkaffinity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 124
Origin: https://track.hawkaffinity.com
Connection: keep-alive
Referer: https://track.hawkaffinity.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:10 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iv0C%2BKvmd6a33NDzYpK0CugxP2v4xj%2BUThPyjlyNixhux7MubG6Kg%2F1Ek8bYhZM01d3wjMOLQHBL5QTR%2FLKwdEpv3Z1zyM7Wd1Q%2FRg3xRV9z1kcsw%2FyLJRSOqqQPMHb0cygy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776dbd333fb5b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.hotelcomparely.com/?ref=https%3A%2F%2Fwww.booking.com%2Fen%2Findex.en.html%3Faid%3D2083685%26label%3D639329db9e2ba903bf1ef9b8
200 OK 5.1 kB URL HTTP/1.1 www.hotelcomparely.com/?ref=https%3A%2F%2Fwww.booking.com%2Fen%2Findex.en.html%3Faid%3D2083685%26label%3D639329db9e2ba903bf1ef9b8
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (401)
Hash 124d9d7ffa6937dfe5672de32d964bda
463fb39b4df54be0a96c76acc012f8235e9099b7
cd57a932b1832a2bae9f541676338e15fd60c01d860c8905283bdd328aa4fdf3
GET /?ref=https%3A%2F%2Fwww.booking.com%2Fen%2Findex.en.html%3Faid%3D2083685%26label%3D639329db9e2ba903bf1ef9b8 HTTP/1.1
Host: www.hotelcomparely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Fri, 09 Dec 2022 12:28:13 GMT
content-type: text/html; charset=utf-8
content-length: 5062
vary: Accept-Language
content-language: en
connection: close
www.hotelcomparely.com/favicon.ico
200 OK 43 B URL HTTP/1.1 www.hotelcomparely.com/favicon.ico
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /favicon.ico HTTP/1.1
Host: www.hotelcomparely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.hotelcomparely.com/?ref=https%3A%2F%2Fwww.booking.com%2Fen%2Findex.en.html%3Faid%3D2083685%26label%3D639329db9e2ba903bf1ef9b8
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Fri, 09 Dec 2022 12:28:13 GMT
content-type: image/gif
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
connection: close
www.hotelcomparely.com/mtm/async/.eJxdjs1ugzAQhN_Fhx5S5KWgRJgI9VGqNSxgxX8x20JV9d1rVznlNjO7mm9-xGcyohcgKoFp2bJMNA8rc9x6gH3fpQ7hZvwix-CAPBg_0SHJy5WdfUczDU3dtZfu_GJRkx0urWobNWlFjUZVt3p-o1npLgNyMyVKmZHNGjb-8Ogo24JZA5PNjIiJ7HehlUnjSJHzB9PBUIgVxmjNiGyCh6Mkr8dz6uz1PtRSVcbhQoBfZn7InXSsTnD6v3fi9w8lElWD:1p3cU9:a921IdEgPHOZU-7SyYBi6nWJBS4/1/
200 OK 232 B URL HTTP/1.1 www.hotelcomparely.com/mtm/async/.eJxdjs1ugzAQhN_Fhx5S5KWgRJgI9VGqNSxgxX8x20JV9d1rVznlNjO7mm9-xGcyohcgKoFp2bJMNA8rc9x6gH3fpQ7hZvwix-CAPBg_0SHJy5WdfUczDU3dtZfu_GJRkx0urWobNWlFjUZVt3p-o1npLgNyMyVKmZHNGjb-8Ogo24JZA5PNjIiJ7HehlUnjSJHzB9PBUIgVxmjNiGyCh6Mkr8dz6uz1PtRSVcbhQoBfZn7InXSsTnD6v3fi9w8lElWD:1p3cU9:a921IdEgPHOZU-7SyYBi6nWJBS4/1/
IP
File type ASCII text, with no line terminators
Hash bed096fce87be715b1a416b13dcf0c44
8ad8292a4b86d3b12ead2dc1a1dd27fa94a482eb
92807e39b92d28c5b75649903831daf1118c1382cd347d40e7ca193e851702c7
Analyzer Verdict Alert fortinet Phishing
GET /mtm/async/.eJxdjs1ugzAQhN_Fhx5S5KWgRJgI9VGqNSxgxX8x20JV9d1rVznlNjO7mm9-xGcyohcgKoFp2bJMNA8rc9x6gH3fpQ7hZvwix-CAPBg_0SHJy5WdfUczDU3dtZfu_GJRkx0urWobNWlFjUZVt3p-o1npLgNyMyVKmZHNGjb-8Ogo24JZA5PNjIiJ7HehlUnjSJHzB9PBUIgVxmjNiGyCh6Mkr8dz6uz1PtRSVcbhQoBfZn7InXSsTnD6v3fi9w8lElWD:1p3cU9:a921IdEgPHOZU-7SyYBi6nWJBS4/1/ HTTP/1.1
Host: www.hotelcomparely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.hotelcomparely.com/?ref=https%3A%2F%2Fwww.booking.com%2Fen%2Findex.en.html%3Faid%3D2083685%26label%3D639329db9e2ba903bf1ef9b8
Connection: keep-alive
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Fri, 09 Dec 2022 12:28:13 GMT
content-type: text/html; charset=utf-8
content-length: 232
x-mtm-path: 10
x-mtm-prov: 1:3.43;70:38.77
x-mtm-rd: 0.00
vary: Accept-Language
content-language: en
set-cookie: mtm_delivered=WyJ3d3cuaG90ZWxjb21wYXJlbHkuY29tIiwiaHR0cDovL3d3dzYuaG90ZWxjb21wYXJlbHkuY29tLz90ZW1wbGF0ZT1BUlJPV18zJnRkZnM9MCZzX3Rva2VuPTE2NzA1ODg4OTMuMDI2MjA4MDAwMCZ1dWlkPTE2NzA1ODg4OTMuMDI2MjA4MDAwMCZ0ZXJtPUhvdGVsJTIwQm9va2luZyZ0ZXJtPUNvbXBhcmUlMjBIb3RlbCUyMFJhdGVzJnRlcm09SG90ZWwlMjBSYXRlcyUyMGZvciUyMEdyb3VwcyZzZWFyY2hib3g9MCZzaG93RG9tYWluPTAmYmFja2ZpbGw9MCIsMSwiMjAyMi0xMi0wOSAxMjoyODoxMyIsMSwiMTY3MDU4ODg5My4wMjYyMDgwMDAwIiw3MCxudWxsLG51bGxd:1p3cU9:8CBr77AqAomfeVZObM5pG3ONyKU; expires=Fri, 09-Dec-2022 13:28:13 GMT; Max-Age=3600; Path=/
connection: close
www6.hotelcomparely.com/?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0
200 OK 2.6 kB URL HTTP/1.1 www6.hotelcomparely.com/?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2551), with no line terminators
Hash 41f66bb0ac50f2d851236170e7c71341
59bcec216302151922219b51be8ad8ab6d0b8384
ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073
GET /?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0 HTTP/1.1
Host: www6.hotelcomparely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.hotelcomparely.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: openresty
Date: Fri, 09 Dec 2022 12:28:14 GMT
Content-Type: text/html
Content-Length: 2551
Last-Modified: Tue, 06 Dec 2022 22:15:21 GMT
ETag: "638fbef9-9f7"
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_V03k4ZCQKRk414ft98zyppbR7g62/Vn8cs9M/9aNh03qF0b7+L57Qk8Tv/imIIwo9qtgyLoXcFwFC4Lh8BbVEg
Cache-Control: no-cache
X-Content-Type-Options: nosniff
Set-Cookie: caf_ipaddr=91.90.42.154;Path=/;Max-Age=86400;
country=NO;Path=/;Max-Age=86400;
city="";Path=/;Max-Age=86400;
expiry_partner=;Path=/;Max-Age=86400;
Accept-Ranges: bytes
Via: 1.1 google
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b5cba4e1962a1fe17c9021f3e418975a
01293d7e4084011451f7d17936ab2427504cdb1a
ecfe30d3abc32ca9f933303d75b2055642d3c7c8197af08fe2c314394699594b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
img1.wsimg.com/parking-lander/static/js/main.4e219663.chunk.js
200 OK 58 kB URL HTTP/2 img1.wsimg.com/parking-lander/static/js/main.4e219663.chunk.js
IP
ASN #20940 Akamai International B.V.
File type ASCII text, with very long lines (65459)
Hash feb46b3c6b7556a8bf123a5e87ffd2b5
aff2efba814012e9fe1586055599069f77e6a062
6f8d46c42987c0d7b471b54065e6b8fd6e965452ccc5c2fcd12f25e5362b5fd7
GET /parking-lander/static/js/main.4e219663.chunk.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www6.hotelcomparely.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: bT1gYle8BNSLcfEqfmnwGSe1OBOZaHT0RRMjGELarYicaXV5gZbgkfpgf0pbFl/ULzcHx6sKMSI=
x-amz-request-id: C0TA1WEG63BVN5BN
last-modified: Fri, 16 Sep 2022 16:45:04 GMT
etag: "87b518e8e45487e774f8d47f2dc0026f"
x-amz-server-side-encryption: AES256
x-amz-version-id: 2Wom95JLG5jhnN_DEOMzqRfOKsQDbi7Z
accept-ranges: bytes
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=31536000
expires: Sat, 09 Dec 2023 12:28:14 GMT
date: Fri, 09 Dec 2022 12:28:14 GMT
content-length: 58202
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash a0905812e8498e6c5c0a9b4b584b972f
039b784fd1e0152ec7f49a54ba027f0b2bd1e833
ee3531ef0f334dcd73a86b1e4365a020d5db69ff7b82bad136eaf1a8e9d3b47f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www6.hotelcomparely.com/?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0
304 Not Modified 0 B URL HTTP/1.1 www6.hotelcomparely.com/?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?template=ARROW_3&tdfs=0&s_token=1670588893.0262080000&uuid=1670588893.0262080000&term=Hotel%20Booking&term=Compare%20Hotel%20Rates&term=Hotel%20Rates%20for%20Groups&searchbox=0&showDomain=0&backfill=0 HTTP/1.1
Host: www6.hotelcomparely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: caf_ipaddr=91.90.42.154; country=NO; city=""; expiry_partner=
Upgrade-Insecure-Requests: 1
If-Modified-Since: Tue, 06 Dec 2022 22:15:21 GMT
If-None-Match: "638fbef9-9f7"
Cache-Control: max-age=0
HTTP/1.1 304 Not Modified
Server: openresty
Date: Fri, 09 Dec 2022 12:28:14 GMT
Last-Modified: Tue, 06 Dec 2022 22:15:21 GMT
ETag: "638fbef9-9f7"
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_V03k4ZCQKRk414ft98zyppbR7g62/Vn8cs9M/9aNh03qF0b7+L57Qk8Tv/imIIwo9qtgyLoXcFwFC4Lh8BbVEg
Cache-Control: no-cache
X-Content-Type-Options: nosniff
Set-Cookie: caf_ipaddr=91.90.42.154;Path=/;Max-Age=86400;
country=NO;Path=/;Max-Age=86400;
city="";Path=/;Max-Age=86400;
expiry_partner=;Path=/;Max-Age=86400;
Via: 1.1 google
img1.wsimg.com/parking-lander/static/js/2.5940ae1c.chunk.js
304 Not Modified 0 B URL HTTP/2 img1.wsimg.com/parking-lander/static/js/2.5940ae1c.chunk.js
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /parking-lander/static/js/2.5940ae1c.chunk.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www6.hotelcomparely.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Fri, 16 Sep 2022 17:52:00 GMT
If-None-Match: "04bb6e8d9135d976f28e9ba68fbc6f67"
Cache-Control: max-age=0
TE: trailers
HTTP/2 304 Not Modified
content-type: application/javascript
last-modified: Fri, 16 Sep 2022 17:52:00 GMT
etag: "04bb6e8d9135d976f28e9ba68fbc6f67"
cache-control: max-age=31536000
expires: Sat, 09 Dec 2023 12:28:14 GMT
date: Fri, 09 Dec 2022 12:28:14 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2
img1.wsimg.com/parking-lander/static/js/main.4e219663.chunk.js
304 Not Modified 0 B URL HTTP/2 img1.wsimg.com/parking-lander/static/js/main.4e219663.chunk.js
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /parking-lander/static/js/main.4e219663.chunk.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www6.hotelcomparely.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Fri, 16 Sep 2022 16:45:04 GMT
If-None-Match: "87b518e8e45487e774f8d47f2dc0026f"
Cache-Control: max-age=0
TE: trailers
HTTP/2 304 Not Modified
content-type: application/javascript
last-modified: Fri, 16 Sep 2022 16:45:04 GMT
etag: "87b518e8e45487e774f8d47f2dc0026f"
cache-control: max-age=31536000
expires: Sat, 09 Dec 2023 12:28:14 GMT
date: Fri, 09 Dec 2022 12:28:14 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash be67c27ceb2cc2a16e2d704c68805c8e
9292e20ce955e94870dcbbfc8b9970062a429cac
84cc9e3a4aa93dfc2a2a55b13f1e17e4b641ff03d52e3f13348b7150b3e5dff0
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Fri, 09 Dec 2022 12:28:14 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 08 Dec 2022 21:59:35 GMT
Expires: Fri, 09 Dec 2022 21:59:35 GMT
ETag: "9292e20ce955e94870dcbbfc8b9970062a429cac"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash be67c27ceb2cc2a16e2d704c68805c8e
9292e20ce955e94870dcbbfc8b9970062a429cac
84cc9e3a4aa93dfc2a2a55b13f1e17e4b641ff03d52e3f13348b7150b3e5dff0
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Fri, 09 Dec 2022 12:28:14 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 08 Dec 2022 21:59:35 GMT
Expires: Fri, 09 Dec 2022 21:59:35 GMT
ETag: "9292e20ce955e94870dcbbfc8b9970062a429cac"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
api.aws.parking.godaddy.com/v1/parkingEvents
200 OK 0 B URL HTTP/2 api.aws.parking.godaddy.com/v1/parkingEvents
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /v1/parkingEvents HTTP/1.1
Host: api.aws.parking.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://www6.hotelcomparely.com/
Origin: http://www6.hotelcomparely.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Cache-Control: max-age=0
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:14 GMT
content-type: text/plain
content-length: 0
set-cookie: AWSALB=vEg0Em24sa/mWXksVgInv1zWyigXnFJm78CyP6mv+kVKfXUAEhgayKbZ+lkFGgaVc/SbXGPkHnOy2HjAJlaNp4PppInqrbSwDYI0QRGMI/A7s2vX1qLJU7Vi3kry; Expires=Fri, 16 Dec 2022 12:28:14 GMT; Path=/
AWSALBCORS=vEg0Em24sa/mWXksVgInv1zWyigXnFJm78CyP6mv+kVKfXUAEhgayKbZ+lkFGgaVc/SbXGPkHnOy2HjAJlaNp4PppInqrbSwDYI0QRGMI/A7s2vX1qLJU7Vi3kry; Expires=Fri, 16 Dec 2022 12:28:14 GMT; Path=/; SameSite=None; Secure
access-control-allow-methods: POST
access-control-allow-headers: content-type
access-control-allow-origin: *
X-Firefox-Spdy: h2
api.aws.parking.godaddy.com/v1/parkingEvents
200 OK 0 B URL HTTP/2 api.aws.parking.godaddy.com/v1/parkingEvents
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/parkingEvents HTTP/1.1
Host: api.aws.parking.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www6.hotelcomparely.com/
Content-Type: application/json
Origin: http://www6.hotelcomparely.com
Content-Length: 721
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:15 GMT
content-type: text/plain
content-length: 0
set-cookie: AWSALB=gbmZuI/RsN8pqDen9PEzlpLqYszD/LRgXz//ZDIBZchTtP80QiXypHt4LcNSwVzJUc2tW45aT1Y5jXWV/Y2XDc7g+LEdrlrynDgOhcxoMdSECAe9XW/ZJPJMWpgo; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/
AWSALBCORS=gbmZuI/RsN8pqDen9PEzlpLqYszD/LRgXz//ZDIBZchTtP80QiXypHt4LcNSwVzJUc2tW45aT1Y5jXWV/Y2XDc7g+LEdrlrynDgOhcxoMdSECAe9XW/ZJPJMWpgo; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/; SameSite=None; Secure
access-control-allow-origin: *
X-Firefox-Spdy: h2
api.aws.parking.godaddy.com/v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId=
200 OK 54 kB URL HTTP/2 api.aws.parking.godaddy.com/v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId=
IP
File type gzip compressed data, max compression\012- data
Hash d61d5848e781103065d5bca54bb2f5d3
0c1410cc40187c59ff57497a601bc5a0914b94ba
f07be716e8073ec4f47c14978e5bb3d2ab7905d9f012131dd848e158fb41df78
OPTIONS /v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId= HTTP/1.1
Host: api.aws.parking.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-request-id
Referer: http://www6.hotelcomparely.com/
Origin: http://www6.hotelcomparely.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Cache-Control: max-age=0
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:15 GMT
content-length: 0
set-cookie: AWSALB=9cCOuoOB9Y3cbtg94fh7A6U263CKlmziyJjenbqZ0MYax6EEXKv4giRH6DBASskbss575b6N8zEoPy7UdFJPMXvLzkpGTEGrF/IVRaXyrF9+PhDcWcFUiCKflcfS; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/
AWSALBCORS=9cCOuoOB9Y3cbtg94fh7A6U263CKlmziyJjenbqZ0MYax6EEXKv4giRH6DBASskbss575b6N8zEoPy7UdFJPMXvLzkpGTEGrF/IVRaXyrF9+PhDcWcFUiCKflcfS; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
access-control-allow-headers: X-Request-Id
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: http://www6.hotelcomparely.com
access-control-max-age: 600
x-request-id: d8P31XPi
X-Firefox-Spdy: h2
api.aws.parking.godaddy.com/v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId=
200 OK 1.0 kB URL HTTP/2 api.aws.parking.godaddy.com/v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId=
IP
File type JSON data\012- , ASCII text, with very long lines (1024)
Hash d09be2925134c36d62dd80ea0ddde3eb
44471d52949edfba16f3d513442bd367ef3d5ec1
a9cbaeb9d51faeaf110f4f00cfe93a0a64f67d76da5dc204f964831e8f65758b
GET /v1/domains/domain?domain=www6.hotelcomparely.com&portfolioId= HTTP/1.1
Host: api.aws.parking.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www6.hotelcomparely.com/
X-Request-Id: 79ac4907-3bcc-48fe-a379-0edc94d00253
Origin: http://www6.hotelcomparely.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:15 GMT
content-type: application/json
content-length: 1025
set-cookie: AWSALB=hZlHEFFnz4PX0B0Zw7BkXLemsM1wSCoE3EqEWPgtvBupKIGXaYdJ92ATH5aSlcHmFjAR88fLV+di8v7s53UGnwPtKgQRxJ+XnP036cbHvqWYYickK4a13cAL2Xil; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/
AWSALBCORS=hZlHEFFnz4PX0B0Zw7BkXLemsM1wSCoE3EqEWPgtvBupKIGXaYdJ92ATH5aSlcHmFjAR88fLV+di8v7s53UGnwPtKgQRxJ+XnP036cbHvqWYYickK4a13cAL2Xil; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
access-control-allow-origin: http://www6.hotelcomparely.com
access-control-max-age: 600
x-request-id: 79ac4907-3bcc-48fe-a379-0edc94d00253
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash cbe432d06442a6cb4f20be34e4d58026
4bcfa4ef74b42eb562cd75321f8de6bd5b54d960
09fc64ce93c2b166e64ceb5f99bc9e20785097140581f9cb363577f68e3653be
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:15 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
partner.googleadservices.com/gampad/cookie.js?domain=www6.hotelcomparely.com&client=dp-namemedia08_3ph&product=SAS&callback=__sasCookie
200 OK 247 B URL HTTP/2 partner.googleadservices.com/gampad/cookie.js?domain=www6.hotelcomparely.com&client=dp-namemedia08_3ph&product=SAS&callback=__sasCookie
IP
File type ASCII text, with very long lines (376), with no line terminators
Hash 7ff13114235cb703628b6d3d58098164
433627cc08289c64db59c0df7b19bde0e0fc01dd
4a13c60ab9ef2bbf3166e91ab340afa23f9ca36de7fdf8511841cb67ed6ab745
GET /gampad/cookie.js?domain=www6.hotelcomparely.com&client=dp-namemedia08_3ph&product=SAS&callback=__sasCookie HTTP/1.1
Host: partner.googleadservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www6.hotelcomparely.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Fri, 09 Dec 2022 12:28:15 GMT
server: cafe
cache-control: private
content-length: 247
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash cbe432d06442a6cb4f20be34e4d58026
4bcfa4ef74b42eb562cd75321f8de6bd5b54d960
09fc64ce93c2b166e64ceb5f99bc9e20785097140581f9cb363577f68e3653be
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:15 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fb8568d1b03d4cd2cc7f423aef817e2e
6a1f75627351f8adae5f4f40d85dc91b4ac6b3d5
b40d4018a0f0692d5847ec8d8f1d2a5a34c2c9ddafa7f28632aab373eeb6f5e4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:15 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fb8568d1b03d4cd2cc7f423aef817e2e
6a1f75627351f8adae5f4f40d85dc91b4ac6b3d5
b40d4018a0f0692d5847ec8d8f1d2a5a34c2c9ddafa7f28632aab373eeb6f5e4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 09 Dec 2022 12:28:15 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2
200 OK 272 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (390)
Hash bbbac37f0b6e29a6099e4aa7cb19d6ca
0acafe95e2141f0af6109203efeb2d98e6b926c6
a3d7b37475de5a3a350d4dc4790f14a6a5f4045726d2eae4cbe9bd59aeba2fe2
GET /ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2 HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 272
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Fri, 09 Dec 2022 07:00:52 GMT
expires: Sat, 10 Dec 2022 06:00:52 GMT
cache-control: public, max-age=82800
age: 19643
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
content-type: image/svg+xml
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
200 OK 174 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Hash 4de8b85c8915995b571bde50e231be7c
29c226ca7b9cbe1d44e5480ce95bbb42727b2d99
2ec9168c4507546748c5f400f5030031f0eb06f2aed8deaa11362c395bff4f7a
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Fri, 09 Dec 2022 06:17:57 GMT
expires: Sat, 10 Dec 2022 05:17:57 GMT
cache-control: public, max-age=82800
age: 22218
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
trk.buyent.xyz/aff_r?offer_id=10742&aff_id=101167&url=https%3A%2F%2Fji.hotelcomparly.com%2Fa%2Fbk%3Ftransaction_id%3D1026566e61d7e1c9ce9778696e8063&urlauth=781037843444623860945928647071
200 OK 54 kB URL HTTP/2 trk.buyent.xyz/aff_r?offer_id=10742&aff_id=101167&url=https%3A%2F%2Fji.hotelcomparly.com%2Fa%2Fbk%3Ftransaction_id%3D1026566e61d7e1c9ce9778696e8063&urlauth=781037843444623860945928647071
IP
File type HTML document text\012- HTML document, ASCII text, with no line terminators
Hash 06317ab5a83239818e4db37b4255c0f5
ec6fa9acba550ea60870ca910a73240c135c50d4
44b3759406391bb8205cec99f565c53820e6da051d2502c8231af914294b2d2d
GET /aff_r?offer_id=10742&aff_id=101167&url=https%3A%2F%2Fji.hotelcomparly.com%2Fa%2Fbk%3Ftransaction_id%3D1026566e61d7e1c9ce9778696e8063&urlauth=781037843444623860945928647071 HTTP/1.1
Host: trk.buyent.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://hawkaffinity.com/
Connection: keep-alive
Cookie: enc_aff_session_10742=ENC03ab60a8a92b2ec5c0568d507fce67c23ef1f1bd3573fefa1f4870a2490614b7c5ab25fd7cebc8378dd2994f070d7fd5577038cdc7ef1be4ae43a0ca4c7589b267b85c71c99186558f6ecb910dfb4d7a7c6bb20e3a5b316c743850b89652da385d6dfff494bc6da2e2a992dc0e884992207b9faa121fddcab9f8e1aa05b04c5d2132c923bd451b4044f82ec8741962562c27ca9ca511d0cfcfb34a4e9c736101a00e845ef3; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMDUuMCIsIm1vYmlsZV9jYXJyaWVyIjoiPyIsInVzZXJfYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgWDY0OyBSdjoxMDUuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMDUuMCIsImFjY2VwdF9sYW5ndWFnZSI6ImVuLVVTLGVuO3E9MC41IiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:11 GMT
content-type: text/html
cache-control: no-cache, no-store, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
pragma: no-cache
access-control-allow-origin: *
x-request-id: ad014042e7dd02909628fdfa2578d504
access-control-allow-headers: Tune-SDK-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r2FV1FsTRblmhAFGM1Xe4xYLPmQBIgIul%2Fl9AM4Tib4DOC4UKe6vVuDYdHTiev%2B%2FOP5DVPLdgj%2Fg7aTTEyV4MKu0sdQuKcpSNYuMh%2FY%2FvICFTr0JOikpShrf0IbEIGhCDw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776dbd386bb5b4e8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
api.aws.parking.godaddy.com/v1/parkingEvents
200 OK 0 B URL HTTP/2 api.aws.parking.godaddy.com/v1/parkingEvents
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/parkingEvents HTTP/1.1
Host: api.aws.parking.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www6.hotelcomparely.com/
Content-Type: application/json
Origin: http://www6.hotelcomparely.com
Content-Length: 716
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:15 GMT
content-type: text/plain
content-length: 0
set-cookie: AWSALB=brVE9jsTEpzDDiUUxipO7q2jegsdwEpMbWxNIUeThksTqYdNfzUdXi4c8PQ0qIKvXCXjkZAnsFHfozZpqabRIR6ie8jHiSDjVYVUsnn4IhReyMrgNExFh6YGPwOm; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/
AWSALBCORS=brVE9jsTEpzDDiUUxipO7q2jegsdwEpMbWxNIUeThksTqYdNfzUdXi4c8PQ0qIKvXCXjkZAnsFHfozZpqabRIR6ie8jHiSDjVYVUsnn4IhReyMrgNExFh6YGPwOm; Expires=Fri, 16 Dec 2022 12:28:15 GMT; Path=/; SameSite=None; Secure
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 782b478cf09d6823663bb6130ecf898d
e1206d0e62a5f18718c27f5502b61679b31474ef
f0d7854c57cf2870d4ac4632e29e96142b8cb384fade2d031cc94f60eed1cdca
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F0D7854C57CF2870D4AC4632E29E96142B8CB384FADE2D031CC94F60EED1CDCA"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10657
Expires: Fri, 09 Dec 2022 15:25:52 GMT
Date: Fri, 09 Dec 2022 12:28:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 782b478cf09d6823663bb6130ecf898d
e1206d0e62a5f18718c27f5502b61679b31474ef
f0d7854c57cf2870d4ac4632e29e96142b8cb384fade2d031cc94f60eed1cdca
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F0D7854C57CF2870D4AC4632E29E96142B8CB384FADE2D031CC94F60EED1CDCA"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7640
Expires: Fri, 09 Dec 2022 14:35:35 GMT
Date: Fri, 09 Dec 2022 12:28:15 GMT
Connection: keep-alive
postback.trafficmotor.com/sn/
200 OK 0 B URL HTTP/1.1 postback.trafficmotor.com/sn/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /sn/ HTTP/1.1
Host: postback.trafficmotor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://www6.hotelcomparely.com/
Origin: http://www6.hotelcomparely.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: openresty/1.13.6.1
Date: Fri, 09 Dec 2022 12:28:15 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: close
Allow: HEAD, GET, POST, OPTIONS
Access-Control-Allow-Origin: http://www6.hotelcomparely.com
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Vary: Origin
Access-Control-Allow-Headers: content-type
track.hawkaffinity.com/?sig=3RQAlpmLlDzLvSmL2DGByITM0xwZ4Z2LmtGZlRJMjtQVMaUqcWKqwI2psAUqeXG3rWzmmEabmxSIAuKDH1HBEqILzcIonuzJc1RZwEHG4OQEnOKBfATon1zJ2ywrMMzJgcSn5xJM1tzoZOGAKcIAJ5JJ1AKowOGB5kxAAu0LjVSFukH2uEKLRkzpIIzp1AJMG16t&hsh=696f1484f9a3ea44fb9a9e102afe0c35601023ba9984f38c
200 OK 0 B URL HTTP/2 track.hawkaffinity.com/?sig=3RQAlpmLlDzLvSmL2DGByITM0xwZ4Z2LmtGZlRJMjtQVMaUqcWKqwI2psAUqeXG3rWzmmEabmxSIAuKDH1HBEqILzcIonuzJc1RZwEHG4OQEnOKBfATon1zJ2ywrMMzJgcSn5xJM1tzoZOGAKcIAJ5JJ1AKowOGB5kxAAu0LjVSFukH2uEKLRkzpIIzp1AJMG16t&hsh=696f1484f9a3ea44fb9a9e102afe0c35601023ba9984f38c
IP
GET /?sig=3RQAlpmLlDzLvSmL2DGByITM0xwZ4Z2LmtGZlRJMjtQVMaUqcWKqwI2psAUqeXG3rWzmmEabmxSIAuKDH1HBEqILzcIonuzJc1RZwEHG4OQEnOKBfATon1zJ2ywrMMzJgcSn5xJM1tzoZOGAKcIAJ5JJ1AKowOGB5kxAAu0LjVSFukH2uEKLRkzpIIzp1AJMG16t&hsh=696f1484f9a3ea44fb9a9e102afe0c35601023ba9984f38c HTTP/1.1
Host: track.hawkaffinity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ciar-kep.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 09 Dec 2022 12:28:10 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vt1MxpVD%2FuqFSekGNvA9xhTbPNAKHT8eN0RWvm7aTMCnXaFVEwkntr5Pb8LtFr5ccORjVLntztI3xt8ADHy5bSpyfX8Kl0XQ8kDinQvDq25K51oBnjjDFUuWaaiTM6lT6CTGKSEAlDO%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776dbd304ce2b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
img1.wsimg.com/parking-lander/static/js/2.5940ae1c.chunk.js
200 OK 0 B URL HTTP/2 img1.wsimg.com/parking-lander/static/js/2.5940ae1c.chunk.js
IP
ASN #20940 Akamai International B.V.
GET /parking-lander/static/js/2.5940ae1c.chunk.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www6.hotelcomparely.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: a2iyKL5x2piu7WbxG8IhJTjeVIGnp7c0mYkOsCyYsqed3/14kgieTZ8SnJQ4V75GHm/7OhGvR/4=
x-amz-request-id: 91RJ56MHH1W7G2SX
last-modified: Fri, 16 Sep 2022 17:52:00 GMT
etag: "04bb6e8d9135d976f28e9ba68fbc6f67"
x-amz-server-side-encryption: AES256
x-amz-version-id: 4zafttojs22R6rxiZs_M0ICLL.vyZxyd
accept-ranges: bytes
content-type: application/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=31536000
expires: Sat, 09 Dec 2023 12:28:14 GMT
date: Fri, 09 Dec 2022 12:28:14 GMT
content-length: 135541
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2
64.190.63.136
173.239.53.32
23.36.76.249
93.184.220.29
104.21.68.113
188.114.97.1
178.162.151.164