Overview

URL free-illustrations-ls01.gatag.net/
IP69.16.230.42
ASNLIQUIDWEB
Location United States
Report completed2022-09-29 06:17:51 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-29 2 boirbonx-1.com/api/v1/px?xmlid=oqtZ38oOqFFwuNhGDzf0pY67SEU51Mknt1EKYFVE Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS
Scan Date Severity Indicator Comment
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed
2022-09-29 2 girlsdivine.life Sinkholed


Files

No files detected



Passive DNS (18)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS r3.o.lencr.org (9) 344 2020-12-02 08:52:13 UTC 2022-09-28 04:36:09 UTC 23.36.76.226
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-28 04:36:06 UTC 34.117.237.239
mnemonic passive DNS xml.sedodna.com (1) 278378 2020-10-22 08:18:03 UTC 2022-09-28 18:25:03 UTC 173.239.53.32
mnemonic passive DNS girlsdivine.life (23) 0 2022-09-20 03:47:07 UTC 2022-09-29 02:16:24 UTC 146.19.213.113 Unknown ranking
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-28 17:26:30 UTC 2022-09-29 05:05:36 UTC 143.204.55.35
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-29 05:03:41 UTC 143.204.55.25
mnemonic passive DNS free-illustrations-ls01.gatag.net (1) 0 2017-02-07 12:22:29 UTC 2022-09-15 07:19:13 UTC 69.16.230.42 Unknown ranking
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-28 05:02:28 UTC 44.242.41.15
mnemonic passive DNS ocsp.pki.goog (1) 175 2017-06-14 07:23:31 UTC 2022-09-28 04:36:20 UTC 142.250.74.3
mnemonic passive DNS data-jsext.com (1) 0 2022-07-27 05:02:20 UTC 2022-09-28 21:05:53 UTC 54.37.5.177 Unknown ranking
mnemonic passive DNS ww1.gatag.net (4) 0 2022-03-08 07:19:57 UTC 2022-03-08 19:56:20 UTC 64.190.63.136 Unknown ranking
mnemonic passive DNS img.sedoparking.com (1) 54200 2013-04-22 22:23:29 UTC 2022-09-28 16:37:06 UTC 205.234.175.175
mnemonic passive DNS xml-v4.netload1.com (1) 0 2022-09-26 13:05:57 UTC 2022-09-29 02:08:40 UTC 198.134.116.17 Unknown ranking
mnemonic passive DNS go.findservice.xyz (1) 283167 2021-11-22 07:34:17 UTC 2022-09-28 18:22:19 UTC 20.113.67.50
mnemonic passive DNS fonts.googleapis.com (1) 8877 2013-06-10 20:14:26 UTC 2022-09-29 00:04:53 UTC 142.250.74.10
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-09-29 04:12:37 UTC 93.184.220.29
mnemonic passive DNS boirbonx-1.com (2) 0 2022-09-26 12:59:21 UTC 2022-09-29 05:10:17 UTC 3.33.192.145 Unknown ranking
mnemonic passive DNS img-getpocket.cdn.mozilla.net (7) 1631 2017-09-01 03:40:57 UTC 2022-09-29 04:10:37 UTC 34.120.237.76


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 69.16.230.42

Date UQ / IDS / BL URL IP
2022-11-27 13:46:20 +0000
0 - 0 - 1 mbooknom.com/book-es.php?id=639479&src=aeroba (...) 69.16.230.42
2022-11-27 13:43:06 +0000
0 - 0 - 1 exclusiveloader.com/?op=payments&amount=15.00 (...) 69.16.230.42
2022-11-27 07:51:18 +0000
0 - 0 - 17 www.filediva.com/results.php?search=www+video (...) 69.16.230.42
2022-11-27 06:27:29 +0000
0 - 0 - 1 autodiscover.btcnos.com/ 69.16.230.42
2022-11-26 11:44:13 +0000
0 - 0 - 1 alk.luwnln.com/ 69.16.230.42

Last 5 reports on ASN: LIQUIDWEB

Date UQ / IDS / BL URL IP
2022-11-28 04:44:04 +0000
0 - 0 - 8 duqiujnu5touzhu.win8mi.com/ 72.52.179.174
2022-11-28 04:32:12 +0000
0 - 0 - 1 nearby-store.us/ 67.227.226.240
2022-11-28 03:57:14 +0000
0 - 0 - 2 hincllc.com/wp-admin/network/RE0652E/netcor/2 (...) 67.225.143.167
2022-11-28 03:55:09 +0000
0 - 0 - 2 akemidentalspecialists.com/snr.ines/login.php (...) 64.91.226.161
2022-11-28 03:52:17 +0000
0 - 0 - 3 aardsolutions.com/wp-admin/network/abramdocop (...) 67.227.226.240

Last 2 reports on domain: gatag.net

Date UQ / IDS / BL URL IP
2022-11-22 04:44:51 +0000
0 - 0 - 1 01.gatag.net/tag/%E8%8A%B1/page/48/ 69.16.230.42
2022-09-29 06:17:51 +0000
0 - 0 - 24 free-illustrations-ls01.gatag.net/ 69.16.230.42

Last 5 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-10-26 15:34:29 +0000
0 - 0 - 10 fipy.marelux.eu/jill-morgan-escort-review.html 172.67.200.191
2022-10-26 10:47:05 +0000
0 - 0 - 37 www.roompeopleunder.buzz/ 104.21.2.219
2022-10-25 12:36:06 +0000
0 - 0 - 14 hotdating-girl.life/?u=e89p605&o=7yukbz8&m=1&t=100 94.103.188.91
2022-10-24 19:39:22 +0000
0 - 0 - 1 joxo.prodiss.eu/Casual-Sex-With-Women-In-Waco (...) 104.21.72.42
2022-10-24 17:46:07 +0000
0 - 0 - 22 www.linkefin.com/in/Karim 93.115.28.104


JavaScript

Executed Scripts (13)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (59)


Request Response
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-stale=0
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Thu, 29 Sep 2022 05:29:34 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: tU2iVKRfDeirhRKU-dKMrKrrDLXRVL3irx224FSpGdv2h0orCWmcbQ==
Age: 2885


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A382476D14B6AE14003333E7ACDFBBD9AE8775D4C1A7D5C31116F33987043CFF"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2967
Expires: Thu, 29 Sep 2022 07:07:06 GMT
Date: Thu, 29 Sep 2022 06:17:39 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.25
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Thu, 29 Sep 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 a6d89f7e2d55548b941f1ff5d5b3c8d4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: pGtZP7jBAZoU_yTgTVKpiNWZS1AY4rPzXgO70UoMQhuGWiJ638zT9A==
age: 2952
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Thu, 29 Sep 2022 06:17:40 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Thu, 29 Sep 2022 05:29:33 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Thu, 29 Sep 2022 05:35:58 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 5de23153ac267c206221751e1cccb6e8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 8XRZymRI_TB4X4yQRnXe308YQwnXOIhBZQMPo0lRGXD5N-CVk4g2tQ==
Age: 2887


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET / HTTP/1.1 
Host: free-illustrations-ls01.gatag.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         69.16.230.42
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
                                        
Date: Thu, 29 Sep 2022 06:17:39 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Location: http://ww1.gatag.net
Keep-Alive: timeout=5, max=77
Connection: Keep-Alive
Transfer-Encoding: chunked

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5930
Cache-Control: 'max-age=158059'
Date: Thu, 29 Sep 2022 06:17:40 GMT
Last-Modified: Thu, 29 Sep 2022 04:38:50 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: haHhQddd9o6xbXpXUO4QvA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         44.242.41.15
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 5lcFDsQyo+gn/Nfm1YZiBKmWxlM=

                                        
                                            GET / HTTP/1.1 
Host: ww1.gatag.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         64.190.63.136
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Thu, 29 Sep 2022 06:17:41 GMT
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_1AQLRUektF9yf2UZhWl8iGaTMg3wllV705Ncd5TFuwrc7Iw0LOrL7yEr/rWuS1w9tV36iE/LMjGX4wVONN4dYA==
last-modified: Thu, 29 Sep 2022 06:17:40 GMT
x-cache-miss-from: parking-57b8c7f6b-p7xff
server: NginX
content-encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (676)
Size:   1301
Md5:    5e18d1915b2206b8d7b380e313ba7d59
Sha1:   a3f21a92a1205e6ea01e4bb1b43ae0e9b860cd1e
Sha256: 5bd0b334fa8386b9b1a1625a88a1377d6ca78d7cd99ff943b294bac0085059c3
                                        
                                            GET /search/tsc.php?200=MzQwNzQwODQ3&21=OTEuOTAuNDIuMTU0&681=MTY2NDQzMjI2MTI4MWVmMjNkNmM2NDAyY2M4MWQ5ZjY0OTEyODJmNDg3&crc=ebf4d870905fe877bd23fa63b25a2850c58ca40a&cv=1 HTTP/1.1 
Host: ww1.gatag.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.gatag.net/

                                         
                                         64.190.63.136
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Thu, 29 Sep 2022 06:17:41 GMT
content-length: 0
x-powered-by: PHP/8.1.9
x-cache-miss-from: parking-57b8c7f6b-phfpl
server: NginX

                                        
                                            GET /images/js_preloader.gif HTTP/1.1 
Host: img.sedoparking.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.gatag.net/

                                         
                                         205.234.175.175
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Thu, 29 Sep 2022 06:17:41 GMT
Content-Length: 4254
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Thu, 06 Oct 2022 06:17:41 GMT
X-CFHash: "90c93102a88c2ab94bff1575b7a6e86e"
X-CFF: B
Last-Modified: Fri, 15 Mar 2019 12:24:07 GMT
X-CF3: H
CF4Age: 156700
x-cf-tsc: 1648179742
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: 7c8fa57c7075c7113e37049c19b028e6
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 16 x 16\012- data
Size:   4254
Md5:    90c93102a88c2ab94bff1575b7a6e86e
Sha1:   56d71bf13de464534643db9d127629a0a3bf677a
Sha256: 5f6ad7031600056b578a6e8c6b34bc718d13125cc8256aa4a9050e549576f81a
                                        
                                            GET /search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DQXNM5GwtRGc_0&v=N2VjZWNhOTk2YjNhM2JlYTZmMjU5NzA4Mzc5ODVjYmEJMQl3dzEuZ2F0YWcubmV0NjMzNTM4ODRhZDM2MzkuNDExODYzMTUJd3cxLmdhdGFnLm5ldDYzMzUzODg0YWQzOWQ5Ljg2NDc5MTExCTE2NjQ0MzIyNjEJYWRfNjNfMA==&l=OAk1M2MxYmFjNTllM2M5NzY3NTk2NjU2NjY3MDk4Mzc2NwkwCTM1CTAJMDYwMWQwMDY4YzhjMGQ1NjI5MTRkNjI5N2NjOTgyYzIJMzQwNzQwODQ3CWdhdGFnCTAJNjMJNgkyCTE2NjQ0MzIyNjEJMC4wMDAyNTkJTgkwCTAJMAkxMjA1CTE5OTY1MTk1MAk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1 
Host: ww1.gatag.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.gatag.net/
Upgrade-Insecure-Requests: 1

                                         
                                         64.190.63.136
HTTP/1.1 302 Found
content-type: text/html; charset=UTF-8
                                        
date: Thu, 29 Sep 2022 06:17:41 GMT
content-length: 0
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Thu, 29 Sep 2022 06:17:41 GMT
location: /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DQXNM5GwtRGc_0&v=N2VjZWNhOTk2YjNhM2JlYTZmMjU5NzA4Mzc5ODVjYmEJMQl3dzEuZ2F0YWcubmV0NjMzNTM4ODRhZDM2MzkuNDExODYzMTUJd3cxLmdhdGFnLm5ldDYzMzUzODg0YWQzOWQ5Ljg2NDc5MTExCTE2NjQ0MzIyNjEJYWRfNjNfMA==&l=OAk1M2MxYmFjNTllM2M5NzY3NTk2NjU2NjY3MDk4Mzc2NwkwCTM1CTAJMDYwMWQwMDY4YzhjMGQ1NjI5MTRkNjI5N2NjOTgyYzIJMzQwNzQwODQ3CWdhdGFnCTAJNjMJNgkyCTE2NjQ0MzIyNjEJMC4wMDAyNTkJTgkwCTAJMAkxMjA1CTE5OTY1MTk1MAk5MS45MC40Mi4xNTQJMA%3D%3D
x-cache-miss-from: parking-57b8c7f6b-n492r
server: NginX

                                        
                                            GET /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DQXNM5GwtRGc_0&v=N2VjZWNhOTk2YjNhM2JlYTZmMjU5NzA4Mzc5ODVjYmEJMQl3dzEuZ2F0YWcubmV0NjMzNTM4ODRhZDM2MzkuNDExODYzMTUJd3cxLmdhdGFnLm5ldDYzMzUzODg0YWQzOWQ5Ljg2NDc5MTExCTE2NjQ0MzIyNjEJYWRfNjNfMA==&l=OAk1M2MxYmFjNTllM2M5NzY3NTk2NjU2NjY3MDk4Mzc2NwkwCTM1CTAJMDYwMWQwMDY4YzhjMGQ1NjI5MTRkNjI5N2NjOTgyYzIJMzQwNzQwODQ3CWdhdGFnCTAJNjMJNgkyCTE2NjQ0MzIyNjEJMC4wMDAyNTkJTgkwCTAJMAkxMjA1CTE5OTY1MTk1MAk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1 
Host: ww1.gatag.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.gatag.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         64.190.63.136
HTTP/1.1 302 Found
content-type: text/html; charset=UTF-8
                                        
date: Thu, 29 Sep 2022 06:17:41 GMT
transfer-encoding: chunked
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Thu, 29 Sep 2022 06:17:41 GMT
location: http://xml.sedodna.com/click?i=QXNM5GwtRGc_0
x-cache-miss-from: parking-57b8c7f6b-phfpl
server: NginX


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   311
Md5:    2b405b2fdcce0428d82c4500d0a0f88a
Sha1:   bfea2356147050e127acc04cbac9e48d858c2009
Sha256: cd7707fa102a1c0bc4d5eb896a60b0e1f4432202de687e9fb053d9af4664775d
                                        
                                            GET /click?i=QXNM5GwtRGc_0 HTTP/1.1 
Host: xml.sedodna.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.gatag.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         173.239.53.32
HTTP/1.1 302 Found
                                        
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: http://boirbonx-1.com/api/v1/px?xmlid=oqtZ38oOqFFwuNhGDzf0pY67SEU51Mknt1EKYFVE
Pragma: no-cache

                                        
                                            GET /api/v1/px?xmlid=oqtZ38oOqFFwuNhGDzf0pY67SEU51Mknt1EKYFVE HTTP/1.1 
Host: boirbonx-1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.gatag.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         3.33.192.145
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Date: Thu, 29 Sep 2022 06:17:41 GMT
Content-Length: 5238
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"1476-FEW0UuGN3X+pI4rzVwDuxHSg4Mo"


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   5238
Md5:    1e568a861815b3878643414b8ac07e79
Sha1:   1445b452e18ddd7fa9238af35700eec474a0e0ca
Sha256: a64760f0749550d307a97b836be8b0c0def0d970d4c2baf0d0bd2ed04cc03431

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /api/v1/pxcheck?impId=oqtZ38oOqFFwuNhGDzf0pY67SEU51Mknt1EKYFVE&minfo=eyJjb29raWVEaXNhYmxlZCI6ZmFsc2UsInVhIjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0OyBydjo5Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94Lzk2LjAiLCJpZnJhbWUiOmZhbHNlLCJkZXZpY2VQaXhlbFJhdGlvIjoxLCJ3bmRMb2NIcmVmIjoiaHR0cDovL2JvaXJib254LTEuY29tL2FwaS92MS9weD94bWxpZD1vcXRaMzhvT3FGRnd1TmhHRHpmMHBZNjdTRVU1MU1rbnQxRUtZRlZFIiwiZGV2aWNlU3JlZW5TaXplIjoiMTAwMngxMjgwIiwiZGV2aWNlV2luZG93U2l6ZSI6IjkzOXgxMjgwIiwid25kMnNyY1JhdGlvTHdyMDYiOmZhbHNlLCJpc0JvdCI6Im9mZiJ9 HTTP/1.1 
Host: boirbonx-1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://boirbonx-1.com/api/v1/px?xmlid=oqtZ38oOqFFwuNhGDzf0pY67SEU51Mknt1EKYFVE
Upgrade-Insecure-Requests: 1

                                         
                                         3.33.192.145
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Date: Thu, 29 Sep 2022 06:17:41 GMT
Content-Length: 174
Connection: keep-alive
Access-Control-Allow-Origin: *
Location: http://xml-v4.netload1.com/click?seat=2114927&i=ZgXOcOgBvis_0
Vary: Accept


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   174
Md5:    37daec0e12a37112d2d1185aec369473
Sha1:   d74137615758eab01c75184768d64052c3b42630
Sha256: 50dcc9be3f5dd989d9f93469104c589463884796bd54e6817147ab02d65d580f
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9461
Expires: Thu, 29 Sep 2022 08:55:23 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9461
Expires: Thu, 29 Sep 2022 08:55:23 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9461
Expires: Thu, 29 Sep 2022 08:55:23 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9461
Expires: Thu, 29 Sep 2022 08:55:23 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9461
Expires: Thu, 29 Sep 2022 08:55:23 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e97b5ce-1b94-4a15-a121-825f38a9d7d9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9034
x-amzn-requestid: ccfaad8d-c270-491f-b0fa-ac56fb1ba14e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZGVJ_G2doAMFXqw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633268a6-1599ec83051ceef5038d1296;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 03:06:14 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: G--ubYYfq5CFGAZzorD-TAgKentdIyvzSjrvqjTf_yGWDvjwX75KHg==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 04:20:21 GMT
age: 7041
etag: "927d5a375d9607b23caadae148566fdff10147b1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9034
Md5:    2054ae778a3079d8233ee33045127df6
Sha1:   927d5a375d9607b23caadae148566fdff10147b1
Sha256: 6b33c83c2b78b413ae375966860e1a9c8aa8e28dee107f9dd5bb8ceb221e607a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F99f26bb4-2c5c-44ef-86d3-90fd05ec1ce0.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9654
x-amzn-requestid: 7277f59f-452d-4cb6-a76e-1561b4ff3de0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZGW2REPzoAMFrww=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63326b5b-4f5d775830c95b065ce40d3f;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 03:17:47 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: jTiWrrcC29QaFlnaiNH_KmEaphRZhWyzf1JbWb6uL00D3vOMR7Wfyg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 03:28:09 GMT
age: 10173
etag: "44cc19b21912d07f82a88af5b2fa6d3e370459bf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9654
Md5:    36ae9444071dd70dcf86802c370ffda9
Sha1:   44cc19b21912d07f82a88af5b2fa6d3e370459bf
Sha256: 99984d108bf31d733414f7f1352e17225ac21ac2dbfb4b1e7fa7ae80e5b6b822
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F658e1cdd-3e54-47dd-9724-ec65659721ea.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6390
x-amzn-requestid: b2681ff8-ab83-41e6-adef-3e6772c93c3f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZGFJ6Gc_oAMF44g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63324f0c-3dbf9f4e2047567b5abdbe74;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 01:17:00 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: VwWbbPJtnsSB1Y6riPtCZXX0Ocmxw024YRmlebWN1UQxZX3uvjsvOw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 05:41:14 GMT
age: 2188
etag: "61676358cdbb2373bc644e66f8a84fbc8cc5daf6"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6390
Md5:    14218a43c5e5bbce546735a780c8ccce
Sha1:   61676358cdbb2373bc644e66f8a84fbc8cc5daf6
Sha256: 905b1c30a2273aef69904f2eb1451c756fc1fdba02e86ea5c957629dd056aeda
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d0e9057-f203-4080-95b8-652ecd15effa.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7859
x-amzn-requestid: 34d0718f-46d4-446f-bb06-8449bd8f4287
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZIlO4FcBoAMFy0w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63334f2b-58ae81c9077e4f1575750f15;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 19:29:47 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: XwUZAphoqael30FgWCRQlHqBpjBOSG7rnlbPNKyojhONZ625gCUI5g==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 91356d2137f5a7345e93da4516c49ec4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 28 Sep 2022 08:28:02 GMT
age: 78580
etag: "35ec6e80d324bb215796c590a7ffafbaea55d88e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7859
Md5:    c62a6368c456e9614ca4c8e360a2ef12
Sha1:   35ec6e80d324bb215796c590a7ffafbaea55d88e
Sha256: 90a37acc6beda1aa98a98cb84e00a7e469d6d919a14f4709c5f67a83ae95278d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2016911-a1a6-4bdf-a8f3-89e94a0aaff7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7810
x-amzn-requestid: 7f6d92e1-c7b1-4dd2-9efa-52ad324ca19d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZMK6pFvkoAMF_yA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6334beaa-362b7368566955966db78385;Sampled=0
x-amzn-remapped-date: Wed, 28 Sep 2022 21:37:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TbPFEVDpMOjK26iu1UGcx56vtP7Pywq05VAylNubOIfbMgo1qGsA-w==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 04:12:40 GMT
age: 7502
etag: "31b8538deb0f00d5b4182739a4a2fcc1b956a998"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7810
Md5:    456968f691ae9464d69a37bffe9bd7ce
Sha1:   31b8538deb0f00d5b4182739a4a2fcc1b956a998
Sha256: 5cde1e3158e6c6c0b7a01d3bd32f2aa292b3b205f604e5c4ed71cafedad06bf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d393f81-26d4-4afa-b6ba-940a54002d7f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6795
x-amzn-requestid: 20067932-e2e5-410a-8c7a-a5f623f33454
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZDCs6FbooAMFyHg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633117ec-65749cd04e48e49a46b4c215;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 03:09:32 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: o1q8r6PSQDQyLs4xfhCSXu4q8fFi3zIoAIMlwNznvOsEtORfuVumCA==
via: 1.1 6a63e853422f3197776fb098fab5a416.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 05:17:35 GMT
age: 3607
etag: "7057c6707c7299ac386c6b2164240eff241db294"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6795
Md5:    9f94853ffae41ec3c0e002bc152da1c4
Sha1:   7057c6707c7299ac386c6b2164240eff241db294
Sha256: 818f3ff90d7b7923b4af4e423dbb01388795490ac2097e1d58d70608b95618f4
                                        
                                            GET /click?seat=2114927&i=ZgXOcOgBvis_0 HTTP/1.1 
Host: xml-v4.netload1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boirbonx-1.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         198.134.116.17
HTTP/1.1 302 Found
                                        
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: https://go.findservice.xyz/15Gu5p?zoneid=127db787b01bdaa12fb46f788&pubfeed=295724/295724.127db787b01bdaa12fb46f788&campaign=671642&cost=0.00055
Pragma: no-cache

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C8C38BD7F558090061ABF5EF99F013448F61AE9CDE4812C23B6AC535E1FFDC33"
Last-Modified: Tue, 27 Sep 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12157
Expires: Thu, 29 Sep 2022 09:40:19 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            GET /15Gu5p?zoneid=127db787b01bdaa12fb46f788&pubfeed=295724/295724.127db787b01bdaa12fb46f788&campaign=671642&cost=0.00055 HTTP/1.1 
Host: go.findservice.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://boirbonx-1.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         20.113.67.50
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.23.0
Date: Thu, 29 Sep 2022 06:17:42 GMT
Content-Length: 320
Connection: keep-alive
X-Powered-By: Express
Set-Cookie: 15Gu5po=20220929091664432709407; domain=.go.findservice.xyz; path=/;expires=Fri, 30 Sep 2022 06:17:42 GMT; httpOnly=true;SameSite=None; Secure; _pc_lc_id=15Gu5p; domain=.go.findservice.xyz; path=/;expires=Fri, 30 Sep 2022 06:17:42 GMT; httpOnly=true;SameSite=None; Secure; peerclickcid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929; domain=.go.findservice.xyz; path=/;expires=Fri, 30 Sep 2022 06:17:42 GMT; httpOnly=true;SameSite=None; Secure; _norg=1; domain=.go.findservice.xyz; path=/;expires=Fri, 30 Sep 2022 06:17:42 GMT; httpOnly=true;SameSite=None; Secure;
Location: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Vary: Accept


--- Additional Info ---
Magic:  HTML document, ASCII text, with very long lines (320), with no line terminators
Size:   320
Md5:    4d5982970cdd1d135da592dca6285832
Sha1:   d5ea58902ad38e13d9cc9c24dfc8144e7d6a0e31
Sha256: c71720e2373ba48066b03a3c6a8589a3a871670ae76ba6ddd2b83a6e98db5102
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4084097B43123CEBC502FB363EFE0FCA216D2EE75BC605E1F009DA2D0B7E5E6A"
Last-Modified: Tue, 27 Sep 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8982
Expires: Thu, 29 Sep 2022 08:47:24 GMT
Date: Thu, 29 Sep 2022 06:17:42 GMT
Connection: keep-alive

                                        
                                            GET /?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929 HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://boirbonx-1.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:42 GMT
Content-Length: 6637
Connection: keep-alive
set-cookie: sid=t2~5ilmygaik535mdingha5ogkx; path=/
cache-control: private, no-transform


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (528), with CRLF line terminators
Size:   6637
Md5:    b84450f08342bb333935de717c3cdbc7
Sha1:   57817ce4e36635df2815b2ea115f36c727742aa3
Sha256: 55c7e9ca5d1a17f2945178f35a834024153f5ee57ce01d043583f0da61059890

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 29 Sep 2022 06:17:43 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /css?family=Roboto:400,300,700|Raleway:400,700&subset=latin,cyrillic HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.10
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 29 Sep 2022 06:17:43 GMT
date: Thu, 29 Sep 2022 06:17:43 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   1223
Md5:    aa36e2d719a6bf5a4d95e8fdee771d2b
Sha1:   e7f8a231ce806c7ded3614aaca91a829e8abcf2e
Sha256: e8b1bd5b758e2a1df4c6f3a92b32239c53dfea2b44e84a98933d6aac2f2413d3
                                        
                                            GET /media/dating/sinderv2/css/bootstrap.min.css HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 109540
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "03d06426a30f77095d7511e1ca74d225"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F48A56BF9D5
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (65367), with CRLF line terminators
Size:   109540
Md5:    03d06426a30f77095d7511e1ca74d225
Sha1:   d1a349294f6fe94ffb17a50097b37bd81e9ba56a
Sha256: 3f7e6f3cb6ba8e2effbdd260131ce0d2f332fb00ba3feca1a5bc9c3ee7f9e2a6

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/css/style.css HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 19825
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "481d04e228d83633ad28310d09905526"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193FE25BD3F39D
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   19825
Md5:    481d04e228d83633ad28310d09905526
Sha1:   f5c81ac5514271f64001c41f5b03e92df55c1a02
Sha256: 25fc219b42657e82593f2b07e3d4ae7d615031234f9b2732f5457338d779cf30

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/css/vegas.css HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 19822
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "357c7befa8bdef911f02f48f49e10628"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F8616978FAA
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   19822
Md5:    357c7befa8bdef911f02f48f49e10628
Sha1:   47972e3c4591058dce82dd3b08bed8e0b8ae5c8f
Sha256: 47f3bef4746b798892c7beff212618616b0950f33f416f03db243578f89135e3

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /util/flag-icon/css/flag-icon.css HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 40627
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "0a47b937981e7389e3ebe63e4a503066"
Last-Modified: Wed, 31 Aug 2022 09:38:16 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F5F2AE1BB63
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   40627
Md5:    0a47b937981e7389e3ebe63e4a503066
Sha1:   01b395ad016a1d9d15016d765f7d2c51a6e2809b
Sha256: d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /cookie/js.cookie.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 4264
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a7e9883924072f15259de6888d5ef515"
Last-Modified: Wed, 31 Aug 2022 09:31:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F4789A5AEAF
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (1709), with CRLF line terminators
Size:   4264
Md5:    a7e9883924072f15259de6888d5ef515
Sha1:   7f4f6e5938e68f55aef81e0cd0145f008cd28382
Sha256: 985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/css/animate.css HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 61188
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "1cbfbb2c4ef85880799a74ab2f290f2a"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F542D4C2AFD
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (460), with CRLF line terminators
Size:   61188
Md5:    1cbfbb2c4ef85880799a74ab2f290f2a
Sha1:   9b6366d6c7ad05010f7070db70fba10754be6e9c
Sha256: bfdad6766b12a3826bf32024f0fc13fffbcee84f102034b9270da7e538451031

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /util/utils.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 7512
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "01816d15ca03032751161a746e2fb7c3"
Last-Modified: Wed, 31 Aug 2022 09:38:20 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F453F089EDE
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (641), with CRLF line terminators
Size:   7512
Md5:    01816d15ca03032751161a746e2fb7c3
Sha1:   dcc72ea5fa1356490ba473288159df9786b4a3c3
Sha256: 8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/js/jquery.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 93064
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "df6173bad69801a82b84701789ab16c5"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F8634F87DF7
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (32072)
Size:   93064
Md5:    df6173bad69801a82b84701789ab16c5
Sha1:   94908755cae039762ad53086b858eac553e3f56e
Sha256: cd8f413e39247d48ea354b8fb11c227e72f641403bd8d4dd81cd7473d60daafb

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/js/timer.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 621
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "40fe503eb84093a37b15e39365ffc587"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F83100DE69A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text
Size:   621
Md5:    40fe503eb84093a37b15e39365ffc587
Sha1:   911128043c901314d283fe478477d26e2b3d821a
Sha256: 60b0f0de4c72c1ce9c05b36ba776f12538b1d9b80858b7099068a3e7e0415bc1

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/js/trls.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 17300
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "eb1b6bc6776b3e1f520ad0d6c03a92ad"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193FA91975157E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Unicode text, UTF-8 text
Size:   17300
Md5:    eb1b6bc6776b3e1f520ad0d6c03a92ad
Sha1:   5adcdd94fd541e5ff347cb317418f77ebcd7a714
Sha256: d87b9de60e8a4d614e0f4e34da021c835852d802f8b6de2aee6a3fa034e3b2b5

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/bb.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 639
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "0d553e4bac91c74bfee2dbabba61e99e"
Last-Modified: Wed, 31 Aug 2022 09:32:33 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F483F40B1A6
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (639), with no line terminators
Size:   639
Md5:    0d553e4bac91c74bfee2dbabba61e99e
Sha1:   5af71e2377c9c012a7826a695f2724901941b19b
Sha256: 1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/exit-new/exit1.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 3473
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "625e5e2950612f771e246beb33c9ea61"
Last-Modified: Wed, 31 Aug 2022 09:34:51 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F4A5378C812
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (641), with CRLF line terminators
Size:   3473
Md5:    625e5e2950612f771e246beb33c9ea61
Sha1:   e4fc251c6c000496c285f8dc3fa097040b031681
Sha256: 618f345a156a0eda55177a1bf0e8a414104f9b6c6ff5cdbe71966f081ccb8a46

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/js/vegas.js HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 21792
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "85310f0fc6d54ab6c4aa2a2efa1e8514"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F8640158C89
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text
Size:   21792
Md5:    85310f0fc6d54ab6c4aa2a2efa1e8514
Sha1:   dbd124ed40a22170b23709711d4572ff93c9fe6f
Sha256: 17d0a5e4e45104aec83860cf51f19bb232747a586a74fc841b9771a9aa9e42b2

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/images/logo-loveme_white1.svg HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 4564
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "896592d7f2fa3d761c0b767e9399b010"
Last-Modified: Wed, 31 Aug 2022 09:34:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F9D4E788B40
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   4564
Md5:    896592d7f2fa3d761c0b767e9399b010
Sha1:   ed1c0502263392938f4cbdd72afb1a8704bf840e
Sha256: 3417f549b6a1018ee687dd84aec136cb7fba2bb5b4c83cf269f9f8e958cc48de

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/fonts/5c92d5d3e39a260d5dd06ced7eca070d.woff2 HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://girlsdivine.life/media/dating/sinderv2/css/style.css
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: font/woff2
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 22284
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "5c92d5d3e39a260d5dd06ced7eca070d"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1719400455A25562
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 22284, version 3.786\012- data
Size:   22284
Md5:    5c92d5d3e39a260d5dd06ced7eca070d
Sha1:   64df09fd462e6bb76890b7782578777b901f2003
Sha256: 2a99c11dd137ef8b515b3a95d2bdb38ec99bf745b2865196aa910628bcb144b9

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /util/flag-icon/flags/4x3/no.svg HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/util/flag-icon/css/flag-icon.css
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 331
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "c7ecfe59439b5fd23924fd206cf2fded"
Last-Modified: Wed, 31 Aug 2022 09:38:18 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193FD07E70AD52
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with CRLF line terminators
Size:   331
Md5:    c7ecfe59439b5fd23924fd206cf2fded
Sha1:   056fbd2b17c7f08bfb480d21973a96bf86fbd72a
Sha256: 4027f3320608508754640a6de4cb1cdabdef4654b5a214e875c134802345683f

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/fonts/b796339b324ec08006ca04dca90284cf.woff2 HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://girlsdivine.life/media/dating/sinderv2/css/style.css
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: font/woff2
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 21796
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "b796339b324ec08006ca04dca90284cf"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F766274AF96
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21796, version 3.786\012- data
Size:   21796
Md5:    b796339b324ec08006ca04dca90284cf
Sha1:   4283d779705f09e68939572df76c52cb41a3ec68
Sha256: d65bbca022f8953936d6e60b9a59fc27f9bfd74ba96257ffe14df83b3d8eb0e3

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /media/dating/sinderv2/fonts/bcf3bb1b7f7a3436181788e748bae013.woff2 HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://girlsdivine.life/media/dating/sinderv2/css/style.css
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: font/woff2
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 14772
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "bcf3bb1b7f7a3436181788e748bae013"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17194004519BFAFB
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 14772, version 3.327\012- data
Size:   14772
Md5:    bcf3bb1b7f7a3436181788e748bae013
Sha1:   8ee24d38f618f070a43619f1d471d90f17d666f1
Sha256: 42e50c76c1bf569cb8b597ffc8cdd18a6f4a311832f46fdc1489145027550781

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "27536B3D46B6985335947761E4B211954296A96E5AEA9D2F1A26CC53860328E6"
Last-Modified: Tue, 27 Sep 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12720
Expires: Thu, 29 Sep 2022 09:49:43 GMT
Date: Thu, 29 Sep 2022 06:17:43 GMT
Connection: keep-alive

                                        
                                            GET /media/dating/sinderv2/fonts/2e5fca371696cab9fb5a9fe214c1319c.woff2 HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://girlsdivine.life/media/dating/sinderv2/css/style.css
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: font/woff2
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 21908
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "2e5fca371696cab9fb5a9fe214c1319c"
Last-Modified: Wed, 31 Aug 2022 09:34:21 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193FE26D1CB380
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 21908, version 3.786\012- data
Size:   21908
Md5:    2e5fca371696cab9fb5a9fe214c1319c
Sha1:   4bd3fe039b2f65d10d1b8c1b30c7962bdc313b7a
Sha256: f8b1a05998ba7e93e5c9f41b004496a3576b8d10d9fafc2f7014894ebc3e72e9

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /ExtService.svc/getextparams HTTP/1.1 
Host: data-jsext.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://girlsdivine.life
Connection: keep-alive
Referer: https://girlsdivine.life/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.37.5.177
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 515
Connection: keep-alive
Access-Control-Allow-Origin: *


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (472), with no line terminators
Size:   515
Md5:    2e2a7f61ae1efa530bbcebf1693ac292
Sha1:   37767c8aa04a870dd713da7cb45e451b4b24d3b9
Sha256: f41890a855fd526c0e7d9702328729cea951b676eec1056e0cdc7250a49e9646
                                        
                                            GET /media/dating/sinderv2/images/scandinavia9.jpg HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Content-Length: 141621
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f16004903b5d570ad959a2c9056ce64f"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193FD091FC6A97
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:43 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2018:12:04 11:12:47], baseline, precision 8, 1980x1080, components 3\012- data
Size:   141621
Md5:    f16004903b5d570ad959a2c9056ce64f
Sha1:   b5fa2860520973cdd38a6720714688f97697444d
Sha256: 17e63bd141a2a4195e11fd2b2c50d6af70b19b28c9e29bce869c02859dfc76ed

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 204 No Content
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:43 GMT
Connection: keep-alive
Cache-Control: no-transform


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F48e2707b-f3b2-4e52-99ae-03c359b698de.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8754
x-amzn-requestid: 175fc592-ed89-44fb-8cf7-8a4404f59d4b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZC5OcHKkIAMFafA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633108c2-2c0c36007bc8bcb56a54e8a1;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 02:04:50 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: -AhTOJwgY3-DnA_pYXdBL18wPP_fNeyDmZjkdkQ2J-xrBZSyRcdK3Q==
via: 1.1 71e7943ea0729c284a06faa05a567236.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 28 Sep 2022 20:59:31 GMT
age: 33497
etag: "ba797da9b2d6942161fa02a0e431de4868b84327"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8754
Md5:    556ea631652cbb77ff38dbe3bbc8c4d1
Sha1:   ba797da9b2d6942161fa02a0e431de4868b84327
Sha256: 130dab67cb6d80c741a7f2dadfd536bd6900204880dc3b68b2afbfa53dd3d781
                                        
                                            GET /media/dating/sinderv2/images/scandinavia16.jpg HTTP/1.1 
Host: girlsdivine.life
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://girlsdivine.life/?u=7pfk605&o=e9ym176&t=127db787b01bdaa12fb46f788_laxy&cid=17f21aeb803a427d44a35d9d2a96f92a-11246-0929
Cookie: sid=t2~5ilmygaik535mdingha5ogkx
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         146.19.213.113
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Server: nginx
Date: Thu, 29 Sep 2022 06:17:49 GMT
Content-Length: 207498
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "fd9c73b2d026f59cec868b6ddd4e6e45"
Last-Modified: Wed, 31 Aug 2022 09:34:23 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17193F6B25A63C25
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Fri, 29 Sep 2023 06:17:49 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.02, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2018:12:04 12:28:26], baseline, precision 8, 1980x1080, components 3\012- data
Size:   207498
Md5:    fd9c73b2d026f59cec868b6ddd4e6e45
Sha1:   3a4d08aedd8de3bb84b45e835bd01576da486abf
Sha256: 9e950992b30a448d423ebb65a190dafa78eadf3aadd23dc9c2768ad273b948a0

Alerts:
  Blocklists:
    - quad9: Sinkholed