r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ede732d48f2c32ad5e3b899bb4348df9
15fa12733818b3ae39f3022a715ed0f431b28242
446c9bf6bc38a43f5758f6f44f89ad76eff44eb8779cf7e62bbfeb002b298dee
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "446C9BF6BC38A43F5758F6F44F89AD76EFF44EB8779CF7E62BBFEB002B298DEE"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5491
Expires: Sat, 24 Dec 2022 05:32:13 GMT
Date: Sat, 24 Dec 2022 04:00:42 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d6a971d765338f107fe9d2c67fa4bbdf
a72bdf191446a37fa0420cc9d7c087aaff757cd6
dc5291c136b0b81621a02679a31f6b7c852e2803429d54c2a9afcc8edf031328
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DC5291C136B0B81621A02679A31F6B7C852E2803429D54C2A9AFCC8EDF031328"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16654
Expires: Sat, 24 Dec 2022 08:38:16 GMT
Date: Sat, 24 Dec 2022 04:00:42 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 24 Dec 2022 03:46:13 GMT
content-type: application/json
age: 869
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f7f0ad5c2841a345f98197c2f1e86f4d
84cbfd91934a8715baba4a2da46451f35597c99c
be30540f2e06a3565c9b38bdbb9691f707d692b196bdcef5d671708aa9609795
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE30540F2E06A3565C9B38BDBB9691F707D692B196BDCEF5D671708AA9609795"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16154
Expires: Sat, 24 Dec 2022 08:29:56 GMT
Date: Sat, 24 Dec 2022 04:00:42 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: T+5O9Sh2u4baG2p1SK/ia6Z5WAeRU3CEcLmEkkWXXyD8WRpQejckG3O4bmn+E/28PfSLC8/y8vs=
x-amz-request-id: 93VS2WR45YV7NQK4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 24 Dec 2022 03:56:27 GMT
age: 255
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 24 Dec 2022 04:00:42 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Last-Modified, Retry-After, Content-Type, Alert, Pragma, ETag, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 24 Dec 2022 03:08:03 GMT
age: 3160
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash c615c937e6371bda0824b44af0c21c74
b097d69452bcc60085f563d094388185c26f0e7d
9f1194921b5d57dd52a217a47e69ad4cec7c08378c73c8dfccc3817119fcbb41
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6457
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:43 GMT
Last-Modified: Sat, 24 Dec 2022 02:13:06 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3MTg2MTAxMSwiaWF0IjoxNjcxODUzODExLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc3Bwc2Jub2NmdXRkNWhub2szM3JhY3MiLCJuYmYiOjE2NzE4NTM4MTEsInRzIjoxNjcxODUzODExMjU3NDkwfQ.sgqZ6ygLBIdo0KjZTVJTe7FLdLOHd5b06l0OipeurjU&sid=10dd07dc-833e-11ed-b08e-e84d611a3a89
302 Found 11 B URL HTTP/1.1 ic-dc.deliverydlcenter.com/pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3MTg2MTAxMSwiaWF0IjoxNjcxODUzODExLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc3Bwc2Jub2NmdXRkNWhub2szM3JhY3MiLCJuYmYiOjE2NzE4NTM4MTEsInRzIjoxNjcxODUzODExMjU3NDkwfQ.sgqZ6ygLBIdo0KjZTVJTe7FLdLOHd5b06l0OipeurjU&sid=10dd07dc-833e-11ed-b08e-e84d611a3a89
IP
File type ASCII text, with no line terminators
Hash 32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
GET /pr/72e8e276-8bc5-11e6-a5ec-0695da005429/typ_1.html?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3MTg2MTAxMSwiaWF0IjoxNjcxODUzODExLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc3Bwc2Jub2NmdXRkNWhub2szM3JhY3MiLCJuYmYiOjE2NzE4NTM4MTEsInRzIjoxNjcxODUzODExMjU3NDkwfQ.sgqZ6ygLBIdo0KjZTVJTe7FLdLOHd5b06l0OipeurjU&sid=10dd07dc-833e-11ed-b08e-e84d611a3a89 HTTP/1.1
Host: ic-dc.deliverydlcenter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Sat, 24 Dec 2022 04:00:42 GMT
location: http://ciar-kep.com/zcvisitor/8926c0b1-833f-11ed-a725-0a4b32303b2b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=186d8cc0-0d54-11ed-9465-12beee04f19b
server: nginx
set-cookie: sid=10dd07dc-833e-11ed-b08e-e84d611a3a89; path=/; domain=.deliverydlcenter.com; expires=Thu, 11 Jan 2091 07:14:50 GMT; max-age=2147483647; HttpOnly
ciar-kep.com/zcvisitor/8926c0b1-833f-11ed-a725-0a4b32303b2b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=186d8cc0-0d54-11ed-9465-12beee04f19b
200 1.1 kB URL HTTP/1.1 ciar-kep.com/zcvisitor/8926c0b1-833f-11ed-a725-0a4b32303b2b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=186d8cc0-0d54-11ed-9465-12beee04f19b
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 935afd5de1e6055ef6bc4dfaa9d588d0
0205870829b42657ee18ce526b283757389d639d
09a7db311c513efb8316cf630f1e975fe76c9ea46b2302bd5a150f607b76e858
Analyzer Verdict Alert quad9 Sinkholed
GET /zcvisitor/8926c0b1-833f-11ed-a725-0a4b32303b2b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=186d8cc0-0d54-11ed-9465-12beee04f19b HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Sat, 24 Dec 2022 04:00:43 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: mSyXkCCD
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: HvVHsjRcQnkTKV3eR2IVNA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: GpubhhQCiYHnD2SwPqH4FDtNjrM=
ciar-kep.com/zcredirect?visitid=8926c0b1-833f-11ed-a725-0a4b32303b2b&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
200 768 B URL HTTP/1.1 ciar-kep.com/zcredirect?visitid=8926c0b1-833f-11ed-a725-0a4b32303b2b&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (341)
Hash 4953c8ef356e9fc597d2ff85dcad9d21
ba27181a08ebdf0f5bd563226482922163fdfefb
4517ab109d2173d4ff83f81f9e79dd51891b1d8355599b6eaa92e6ec2736e9bf
Analyzer Verdict Alert quad9 Sinkholed
GET /zcredirect?visitid=8926c0b1-833f-11ed-a725-0a4b32303b2b&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ciar-kep.com/zcvisitor/8926c0b1-833f-11ed-a725-0a4b32303b2b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=186d8cc0-0d54-11ed-9465-12beee04f19b
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Sat, 24 Dec 2022 04:00:43 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: xqZGAKVa
ciar-kep.com/favicon.ico
404 653 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Hash ba2732b1b2fa2626ffaa15f62f9e7d66
203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: ciar-kep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ciar-kep.com/zcredirect?visitid=8926c0b1-833f-11ed-a725-0a4b32303b2b&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
HTTP/1.1 404
Date: Sat, 24 Dec 2022 04:00:44 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: bnxBGiVc
cartining-specute.com/zp-redirect?target=https%3A%2F%2Fwinnersailor.com%2Fapi%2Fv3%2Foffer%2F7%3Faffiliate_id%3D477%26url_id%3D89%26aff_sub2%3Dw2kuhke5jrtrk4dl2dlaal3k&caid=7de7b7a9-ac63-4546-b7c6-61e26aa27458&zpid=8926c0b1-833f-11ed-a725-0a4b32303b2b&cid=w2kuhke5jrtrk4dl2dlaal3k&rt=R
302 Found 0 B URL HTTP/2 cartining-specute.com/zp-redirect?target=https%3A%2F%2Fwinnersailor.com%2Fapi%2Fv3%2Foffer%2F7%3Faffiliate_id%3D477%26url_id%3D89%26aff_sub2%3Dw2kuhke5jrtrk4dl2dlaal3k&caid=7de7b7a9-ac63-4546-b7c6-61e26aa27458&zpid=8926c0b1-833f-11ed-a725-0a4b32303b2b&cid=w2kuhke5jrtrk4dl2dlaal3k&rt=R
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /zp-redirect?target=https%3A%2F%2Fwinnersailor.com%2Fapi%2Fv3%2Foffer%2F7%3Faffiliate_id%3D477%26url_id%3D89%26aff_sub2%3Dw2kuhke5jrtrk4dl2dlaal3k&caid=7de7b7a9-ac63-4546-b7c6-61e26aa27458&zpid=8926c0b1-833f-11ed-a725-0a4b32303b2b&cid=w2kuhke5jrtrk4dl2dlaal3k&rt=R HTTP/1.1
Host: cartining-specute.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ciar-kep.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Sat, 24 Dec 2022 04:00:44 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://winnersailor.com/api/v3/offer/7?affiliate_id=477&url_id=89&aff_sub2=w2kuhke5jrtrk4dl2dlaal3k
pragma: no-cache
set-cookie: cc-v4=mEUwTa%2ByRW%2BnfD7VhHUl1EsJz5e%2BeZO8UEY6Dt%2FHIyzsQyzDUU1Tf1WjswkVx9tkgz8QeIFHSayZwjj47zhyaCQR%2Fj2Xx0wSynnWAutdb8eDWpP%2FYm9nKCC1%2BpqpsmGA8m2Qj156Mgexfu6OsH4I3w%3D%3D; Max-Age=31536000; Expires=Sun, 24-Dec-2023 04:00:44 GMT; Domain=cartining-specute.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash a368925277fa362ba0ecd8aca319674f
ee031fd879a095cb5c9b87eafa69754891f8fc63
dec334388d16a3b681c8cbd19c0cd7c07f1a9818880b6128f2360f6149ff202b
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "DEC334388D16A3B681C8CBD19C0CD7C07F1A9818880B6128F2360F6149FF202B"
Last-Modified: Thu, 22 Dec 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8483
Expires: Sat, 24 Dec 2022 06:22:07 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash a368925277fa362ba0ecd8aca319674f
ee031fd879a095cb5c9b87eafa69754891f8fc63
dec334388d16a3b681c8cbd19c0cd7c07f1a9818880b6128f2360f6149ff202b
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "DEC334388D16A3B681C8CBD19C0CD7C07F1A9818880B6128F2360F6149FF202B"
Last-Modified: Thu, 22 Dec 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8483
Expires: Sat, 24 Dec 2022 06:22:07 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash c9244d71c71cc1c399c0417cfa21287a
0e360e49b5203a9d51b625b4fdc0bfc111c9146f
533aaffb209425a02665cd5faca166fc8c7fa139b809638c59eefdcf1e6d7629
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "533AAFFB209425A02665CD5FACA166FC8C7FA139B809638C59EEFDCF1E6D7629"
Last-Modified: Thu, 22 Dec 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8562
Expires: Sat, 24 Dec 2022 06:23:26 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6ce699bd0db3ee9d3a4ef6dcf941f9f1
14d813942d74d801024c42e2a4628ecd9306d2ad
060de67922db1f612b7f4c173f11e8714c8329d20fbec45a421bcefe7451f388
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "060DE67922DB1F612B7F4C173F11E8714C8329D20FBEC45A421BCEFE7451F388"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10785
Expires: Sat, 24 Dec 2022 07:00:29 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6ce699bd0db3ee9d3a4ef6dcf941f9f1
14d813942d74d801024c42e2a4628ecd9306d2ad
060de67922db1f612b7f4c173f11e8714c8329d20fbec45a421bcefe7451f388
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "060DE67922DB1F612B7F4C173F11E8714C8329D20FBEC45A421BCEFE7451F388"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10785
Expires: Sat, 24 Dec 2022 07:00:29 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6ce699bd0db3ee9d3a4ef6dcf941f9f1
14d813942d74d801024c42e2a4628ecd9306d2ad
060de67922db1f612b7f4c173f11e8714c8329d20fbec45a421bcefe7451f388
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "060DE67922DB1F612B7F4C173F11E8714C8329D20FBEC45A421BCEFE7451F388"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10785
Expires: Sat, 24 Dec 2022 07:00:29 GMT
Date: Sat, 24 Dec 2022 04:00:44 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3b796350-ff1b-4da6-91c7-f598bab0dde2.jpeg
200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3b796350-ff1b-4da6-91c7-f598bab0dde2.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 42578645a06eaf381fd25ddc41b91820
8656fddf2a13fff129a073fc85c8197c78ffaaed
f1afcf62cbe9ce3a786f2f38a851781450fe52ce8f367d30fc31c31977624379
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3b796350-ff1b-4da6-91c7-f598bab0dde2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9343
x-amzn-requestid: 2720f2c1-7d46-4a81-b570-f63490384967
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnnqZGyDIAMF4Fw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a61fdb-79c3107c2c0465885bd76558;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 21:38:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: __u_FxIZqX0xmVm_8zpvS4XqqtDvdiuvhNGV8LOpcY3fZ0omwFQG_Q==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:46:05 GMT
etag: "8656fddf2a13fff129a073fc85c8197c78ffaaed"
content-type: image/jpeg
age: 22479
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98adc653-f9a6-4ecb-ac9e-bc2f050bce18.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98adc653-f9a6-4ecb-ac9e-bc2f050bce18.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f8c72ec1e9749463326e11f003982211
a76cc3e7d6ca04b4e1d1c947c25ad10a11e9750c
afeea88b39c0fa6957e58d13562222415705d408f89583adcf428a02140abbdd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98adc653-f9a6-4ecb-ac9e-bc2f050bce18.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8691
x-amzn-requestid: e8b31f4c-cf9e-4027-ba28-86dcc5ac5190
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnnRDHvSIAMF9Vw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a61f39-06c81a124ae007023d03c375;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 21:35:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ukk1KAfPyoU8ml-m2Etsyqga5bkkVdLL8PQLzuQb7lDA_to8GinuOw==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:39:51 GMT
age: 22853
etag: "a76cc3e7d6ca04b4e1d1c947c25ad10a11e9750c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fafc522eb-7237-4387-a813-3d8a7c2ad6cc.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fafc522eb-7237-4387-a813-3d8a7c2ad6cc.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c5b0f55bf63a36fce0a246df2039a407
2970cf26ace931d06195838af978ae13b8ccd843
cf84f2b532bc16c028fc93c3d910e2431f989a3d8fe1ffcbc3c08122ec18fe65
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fafc522eb-7237-4387-a813-3d8a7c2ad6cc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6157
x-amzn-requestid: 10e24df4-2ac1-46cc-86ac-6fbbb25a2ece
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnnbBHexIAMFX4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a61f79-13279779115da25e040775f7;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 21:36:57 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: v_XlpT3Oy2lyDC3c0wjqIcD4oKjU0Ry9zSaly_xbX-62sF40OWXuhg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:56:20 GMT
age: 21864
etag: "2970cf26ace931d06195838af978ae13b8ccd843"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ef950d0-91b0-49dc-861b-561575fba09f.jpeg
200 OK 5.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ef950d0-91b0-49dc-861b-561575fba09f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f041b688028eb1c8dcbee925ec0255fd
f60c30fd1ea1105f9a6fb23d6fd00f30f6deb757
724e5404f4b8ba9abf581972c1474fd1d497e9b16c3e5b42336a7ad48863fae6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ef950d0-91b0-49dc-861b-561575fba09f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5505
x-amzn-requestid: 971471d1-6863-4f42-ad7f-6afa0cc651e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dkUqqFrRIAMFiPA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a4ce44-664cbcc82f3949a821ddde85;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 21:38:12 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: VePhm1SJiBNCDkVOAAs-o1-wrBKcpntqTn3Yas67-02zkv9HbACpCQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:45:56 GMT
age: 22488
etag: "f60c30fd1ea1105f9a6fb23d6fd00f30f6deb757"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e532075-b8a0-41ff-8f08-8512cbb1b3d4.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e532075-b8a0-41ff-8f08-8512cbb1b3d4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3071a834e874a992c3b14f7a3f91b30f
559014c7e6e5019097b7da8b3a820a80a1f55b6c
4f8e29303936b4168f0ad765d8a2773a7247f249396147f68f6f9639b1ad1208
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e532075-b8a0-41ff-8f08-8512cbb1b3d4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10356
x-amzn-requestid: 32dbf731-a18f-4150-b3cd-f30d2ab3c6a1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnoi1GY2oAMFesg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a62145-55a5f14a6ea6e7dc3754a8be;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 21:44:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: I-X2fEUZq8ogVCK-SeYSAgdEupzhzeBxgZv0WaVunieB4pgXxjqn2w==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:48:16 GMT
age: 22348
etag: "559014c7e6e5019097b7da8b3a820a80a1f55b6c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F41c787f1-413b-442f-ad33-df2b7b4c8066.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F41c787f1-413b-442f-ad33-df2b7b4c8066.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 69507e22bc222e2ca8e8b6461c6b7994
ae0a775c60159442daa15c1975770ee251083de9
022f17ef3a20ad0eef1fb68c52a0160481d4be305e2d8b466c5f578da5435191
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F41c787f1-413b-442f-ad33-df2b7b4c8066.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7377
x-amzn-requestid: 2dd53b1b-6670-489b-bf6d-47aafed2d93a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnnPzHDoIAMFhdw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a61f31-4296afb759b198f4729c2c76;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: u19kDmiOpyZH_EwxWN6ZodrXOYki9J8Ej9eJs512a-oVcuJ43tfAlw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Dec 2022 21:42:36 GMT
age: 22688
etag: "ae0a775c60159442daa15c1975770ee251083de9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash c9244d71c71cc1c399c0417cfa21287a
0e360e49b5203a9d51b625b4fdc0bfc111c9146f
533aaffb209425a02665cd5faca166fc8c7fa139b809638c59eefdcf1e6d7629
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "533AAFFB209425A02665CD5FACA166FC8C7FA139B809638C59EEFDCF1E6D7629"
Last-Modified: Thu, 22 Dec 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8561
Expires: Sat, 24 Dec 2022 06:23:26 GMT
Date: Sat, 24 Dec 2022 04:00:45 GMT
Connection: keep-alive
ocsp.pki.goog/s/gts1p5/0_0b1vpY1Hk
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/0_0b1vpY1Hk
IP
Hash a8c3135768c41ad6a531e4ad8f104638
2c80e5353e83a19b34e676f121d22345b9337064
1055be2935e2761a6f9a7fcb0414cdb5b7933266adec544fb758fd98f4fa7e11
POST /s/gts1p5/0_0b1vpY1Hk HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:45 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
drift-offers.com/bitcoin-era/images/bitgo.png
200 OK 2.8 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/bitgo.png
IP
File type PNG image data, 92 x 38, 8-bit colormap, non-interlaced\012- data
Hash f27ed5020bef246b6728d680daad1ea2
537c501fce1aa89ab44ea482a656fcecb502449b
5a5e7bf9024b3136afba904d490c1242c2593ec628fcc1cd7ab6a84d75e59890
GET /bitcoin-era/images/bitgo.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 2781
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-add"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3v0X%2Fa9dmSb2gsSqe3FO3veSdsnYuZbYPcjDmRGEEzhT2FDJ74RD%2FaZQOjFmZEcW%2BJAeTfztpvXKi0iJ6cgQpn9ALQpXvaX%2BUC2TdC3qVhtxc2ywXP%2Br6UrAL2OVFobSmJik"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8c98acb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/secure-trading.png
200 OK 2.5 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/secure-trading.png
IP
File type PNG image data, 138 x 30, 8-bit colormap, non-interlaced\012- data
Hash c795f6fc54767559c4018d8c74b7f2eb
c691d967252493621453fda45178495dd3cd7b64
ffe1197077cb1181b5661a8ea78fe28c1062ad81f2ebb8074dc885a220fceb88
GET /bitcoin-era/images/secure-trading.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 2543
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-9ef"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHkH1d8E0yeo63jA7D8mEw6LWYq30BvNsuSq2HZSVq3AqS3RNZEeECgP%2BoF2Gr1X6ubVvD2pqKShRxfi2whbZG6qlBslUbfCaSH8iG4qzWqtUUIBDxAAAiyXo9QWgHzlPQJj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8c98b0b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/logo.png
200 OK 22 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/logo.png
IP
File type PNG image data, 1408 x 249, 8-bit colormap, non-interlaced\012- data
Hash 753d2ce47e70ab63c1429c25a4ad2627
993cd648075740fb18501fcb2a73b023e2988242
b8d10960a3b95d49ee478c3961b904afeca854eb6e827d087b552297f6891b63
GET /bitcoin-era/images/logo.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 21482
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-53ea"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=StKT8bOjwOnmwvwdbAsjPhAs%2BsjjGWumEbNMCItqArCE5%2FfongFw4OFXall2KLgPbAV4yTRGYyFE05lmhWfjFOabCT6cZP8gmtc7uxW%2FZh8Xf3PMGGaiCEVEY1EsnFwRLxeo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8c98abb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/norton.png
200 OK 2.7 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/norton.png
IP
File type PNG image data, 80 x 43, 8-bit colormap, non-interlaced\012- data
Hash f09134a25691a53add6186a1ca3faa2f
557b926d4927ad7e518076d7e9c6f46a2efd205e
1990f2515957f87343bd3044ddbdb7aa8c5043bdc2697c089c617aa520a7450b
GET /bitcoin-era/images/norton.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 2675
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-a73"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fqw1bOxr5pLxKbIcka8%2BTVIjMJWy88MWrO1R7PlgyWLByKSzire22Ir5r6teI%2FBm7h%2BhC5HPupUvhOhW6DqYp4Q3SAIhG9mNmt%2FCaewi4CSf0tHAY4AKtpv9gtnEVSalxage"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8c98aeb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/mcafee.png
200 OK 2.6 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/mcafee.png
IP
File type PNG image data, 130 x 31, 8-bit colormap, non-interlaced\012- data
Hash fd28ea855b811945fc60e39ff58ce160
d89372b47b316955bf8b33165007ff6f1d26f6af
84889440b1d26f213285dad200ddbea59b97c62c7b74b7c416b6c420c2cd553c
GET /bitcoin-era/images/mcafee.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 2631
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-a47"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vJtmanL8krTF5TxGf7QdmHYn40oBmYVA7an925azXbc4gIyr9YMqjR6I78NgKiOtoClQcoU8BklS%2BOXGn2aKrifOYIbRvynxAPO7cXVqaBFtCgEilGmCqJxmr0Hc%2BgBU9RxG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8b9b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/seenon.png
200 OK 51 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/seenon.png
IP
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2018 (Windows), datetime=2018:06:22 23:29:56], baseline, precision 8, 644x51, components 3\012- data
Hash d75dfb0c1fb21a65165840140d0058af
1222a2c54386439e0f2ea1bb017da264fc430ae7
084f732f8a7b4b6ae833e14ad630860328b775e38b094e4c71940c040d85a7d6
GET /bitcoin-era/images/seenon.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 50693
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-c605"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qXlArqOQeFDYO5%2FNIwwtK5IGWr8mIeJYmzI48sQjMXz6rsVqGDj8Ssrgvm65i8DEZg0qnC54Mw8CPZJUa%2F7UxRwot3x4%2B0SzvHgvCaJdSLQkJadAMSJZCMGZaIoDGxfIQ6zS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8bab512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/feature-img-1.png
200 OK 6.3 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/feature-img-1.png
IP
File type PNG image data, 119 x 113, 8-bit/color RGBA, non-interlaced\012- data
Hash 1154b770c07a0cfb1e6697f10a08c576
57b6bf5d5691145bbbed588149a97c992704d415
5d325681a72685121ef7e8fe39b06e0555dc991be8135006a26c026fcca08916
GET /bitcoin-era/images/feature-img-1.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 6278
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-1886"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sONv9H3PIc0JTzhYrWQr7IQl8n2CMrq6HIdCdOhSQhmzEbjM%2BXo3iC39f2IRMotMRF5%2FVaB8gL1wiGgnLGxIUkQVrY4oGdYwHDa3ofN2ADA9JfXoRHEMBRje1NdVEx1jbzHf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8beb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/feature-img-2.png
200 OK 2.4 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/feature-img-2.png
IP
File type PNG image data, 120 x 102, 8-bit/color RGBA, non-interlaced\012- data
Hash 9d17ad723f8e42bf27c576cf31272dc2
a08a4a3b59845fdf8104034d58381150ea513a84
63590b41f1d94048485847ceaf28dfe9943cce476b14ffad878889d1b25749ed
GET /bitcoin-era/images/feature-img-2.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 2422
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-976"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WbXsV%2BvvUrcf7ilNF755tv7RnPMvkhEeoeluiaiI5dZG6UdEMvBQ79R2ZYqE5PoXQHIJzjESXd%2BxrE3gJ09L6UwVurVHc5eBdmkcHWoVp5%2B10n7yYvoVIl4rid6KwSuS01Qt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8bfb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/girl-holding-bitcoin.png
200 OK 236 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/girl-holding-bitcoin.png
IP
File type PNG image data, 822 x 988, 8-bit colormap, non-interlaced\012- data
Size 236 kB (235560 bytes)
Hash 94f9942eb689071506c0aa022d09fe96
a3da10bd76a59354875db8b293aab942cd58900c
22e17735962c4db70746d5180aa1936c6f3c14dc65a648541cb3a9ccfeaa4757
GET /bitcoin-era/images/girl-holding-bitcoin.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 235560
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-39828"
expires: Mon, 26 Dec 2022 11:51:15 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403770
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JHGHUXfD4ZxWktfb5G%2FCGupBbzNT9RFkDBHKyvIKAWeLsxEEOwWyidXbhp3IGMWjtwn0qbK9lVHWf1JIFL5imXoPDQQIMtS%2BZE4Td8tNwizr5dsJ%2B9MnjJd9TF%2FWyxKh4PdJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8bcb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/feature-img-3.png
200 OK 3.9 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/feature-img-3.png
IP
File type PNG image data, 124 x 112, 8-bit/color RGBA, non-interlaced\012- data
Hash c8cdd536e2a491281e7007964f820c8d
41ab5674c7a378d8549d5f2f2fa5ad413a057aa0
6ba7555d46ebf8b8611af1a70bf62d0cb22155efc3bb835fbdd953930349467a
GET /bitcoin-era/images/feature-img-3.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 3865
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-f19"
expires: Mon, 26 Dec 2022 11:51:16 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZApw07kohNNrY6n8AbZS3QDwvkK%2B1l6hQgVWMuzgWe2lvFBm9mhlOLtUIMVGKa%2Fw35pENKOOVWsVm%2F9atMBGrZMLJ0UqusRo77MIpKapacbiz7qgbNpdIhPMUBfO0r2RdlaZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8ca8c1b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/tick.png
200 OK 752 B URL HTTP/2 drift-offers.com/bitcoin-era/images/tick.png
IP
File type PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash 277e80270a763ab29b5534172bd78bb5
48736e4e9d0aacfa13c951f075b958a2d607bbc9
20fb2dc2107e319efc88a760cd8d02fc326923afa8d300eacd94f814b67c0c32
GET /bitcoin-era/images/tick.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 752
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-2f0"
expires: Mon, 26 Dec 2022 11:51:16 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T0IDk4cZltt%2FR43yET6rgPZqNlP7uU%2FlB2egpt8c2iz6gdN%2B5ZBN%2FYrnlRu5dcC3TsnJ%2BZ%2BaGN0wS0vwVKD8Ur8GYChnog2ZxR5n6iQAwrNJSM6r%2BQiIpJlaCW9WUFc58mZu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8cb8c4b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/step-img-1.png
200 OK 4.5 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/step-img-1.png
IP
File type PNG image data, 117 x 93, 8-bit/color RGBA, non-interlaced\012- data
Hash 4eea47e521ec56ea089eb23bbfa3830b
c8e78677e343713d62d1ed8f4fa9909c7130e77f
97e3436ec9589857a11c9e645a460f394ca417e4328c757148dae39078ba5535
GET /bitcoin-era/images/step-img-1.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 4479
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-117f"
expires: Mon, 26 Dec 2022 11:51:16 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GhKB3O5ZGIfesog6znY06Rir%2BPG%2BMqZkAI6unt2rOkDviiYnr0%2BTFNEkgFcZPH2%2FTO%2FpmMso45wu81B7H%2FonzglMp9XvLBt01p5cePdv7PpKLM7%2FGnubNevzVsNwJboK%2Bsn%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8cb8c7b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/step-img-2.png
200 OK 4.6 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/step-img-2.png
IP
File type PNG image data, 110 x 97, 8-bit/color RGBA, non-interlaced\012- data
Hash 0299d90afa219e62449349aaae16d05e
1cf5515dc3ec693bfca2b71d03a9d23c581867d7
14c5c8721392664e30296129a0ff5375c0869162ee6cec8592f0d59a5d2f05bb
GET /bitcoin-era/images/step-img-2.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 4550
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-11c6"
expires: Mon, 26 Dec 2022 11:51:16 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XOZjnRZ6tyBq9cXeW7wpNM%2Fu2CsSxK%2BHRXtmz7caaWJ%2BUEzwpUlM32Q4ImlRh5tgTnaLqrMokItd5pRts4zdCmEjCJPS3V%2FZllPa81im4g8Z%2Bjt5D2GOoyY6r73rbx3BKzkG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8cb8c9b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/images/step-img-3.png
200 OK 4.2 kB URL HTTP/2 drift-offers.com/bitcoin-era/images/step-img-3.png
IP
File type PNG image data, 114 x 98, 8-bit/color RGBA, non-interlaced\012- data
Hash 32c386a9c9d10ec807e0db9b1114ca14
e9007cb61d82c7681cbe76f79d505fa542cf1292
f35940578816ce8edd85a61096cfd032fb0ce32ece251380309eec42effd7511
GET /bitcoin-era/images/step-img-3.png HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: image/png
content-length: 4182
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
etag: "63851b71-1056"
expires: Mon, 26 Dec 2022 11:51:16 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403769
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JlYBj1ztKlkLA0CQ9YWslg6Xa2ar0%2F6HsyY%2BbxAjKLFy%2BKzVn%2FNF%2BYa7jBttwTg6fIc2Wjr540lXKr5Gg4QaUcBDzz7YeIuRxohN4iYpI2FlntKn0Fb9Xr%2FZWFzh%2FlcWvCjS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e8cb8cab512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash f18d386c67703f414aa73fcbd47d11f7
18e2bfe4795c8d8f64eac78fa23f5765369fed75
a2ae295b61f28240475e08ca8d8ed25014970f4ddd55005716ab45a1289db06a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5983
Cache-Control: max-age=151444
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:45 GMT
Etag: "63a60ea2-118"
Expires: Sun, 25 Dec 2022 22:04:49 GMT
Last-Modified: Fri, 23 Dec 2022 20:25:06 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 280
polyfill.io/v3/polyfill.min.js
200 OK 94 B URL HTTP/2 polyfill.io/v3/polyfill.min.js
IP
Hash eb8b0ba88b3acfb11ea81d5c02be9108
4b7f14cc2db25abdbe25472934b7469b2488f9d4
7237f15a97fe102c6ed13eadc0f7980da03cd06a20dfb7c7b8050e60dada617d
GET /v3/polyfill.min.js HTTP/1.1
Host: polyfill.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://drift-offers.com
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
content-type: text/javascript; charset=utf-8
last-modified: Fri, 18 Nov 2022 10:54:36 GMT
content-encoding: br
age: 0
accept-ranges: bytes
useragent_normaliser: firefox/105.0.0
date: Sat, 24 Dec 2022 04:00:45 GMT
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,OPTIONS
vary: User-Agent, Accept-Encoding
server-timing: cache-bma1639, PASS, fastly;desc="Edge time";dur=11
content-length: 94
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js
200 OK 30 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js
IP
File type ASCII text, with very long lines (32077)
Hash 5e4764d3c94d1a1db8c3d0890278b6d1
e5171f2f46e16d32df5f634ba21e47256fa9689c
5077e8927721a6a3ae5d78b456b7041230d627774a0a319beebacc88290b8328
GET /ajax/libs/jquery/1.12.4/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: application/javascript; charset=utf-8
content-length: 30360
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-17b8b"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 201211
expires: Thu, 14 Dec 2023 04:00:45 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sthInaDRV4Q7PF4j8DrVqPAlL4bV05tVEqJy7Q6ZeSs2tNXVMKjdx0pae34o8Hkj34ov1e5LAOwrFT90ZOTP7kp3nNXoyXFd54gj6%2B1hsE%2FiKxzLzj6Ghv%2BvDlAp62n0vcDKXLnd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 77e66e8d2a91b518-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/flag-icon-css/3.1.0/css/flag-icon.min.css
200 OK 1.5 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/flag-icon-css/3.1.0/css/flag-icon.min.css
IP
File type ASCII text, with very long lines (33688), with no line terminators
Hash 6005cbb851a11d96e671ddf9d436c8bf
1382edddadb6c772a690af96e42c300716faeb61
9fe48f40dcfcf138c0990c952b1a3caab503373452a39a49c2cd0ebdbd86448a
GET /ajax/libs/flag-icon-css/3.1.0/css/flag-icon.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css; charset=utf-8
content-length: 1478
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5d-8398"
last-modified: Mon, 04 May 2020 16:10:05 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 160790
expires: Thu, 14 Dec 2023 04:00:45 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5H%2B1K9jJR4erY6KPFHKF%2FAodJC3lzFthfVVq4HXK3flZxdRuOwnD5JsJlv7Xwpo7d1O%2B0ty91CnHioySMvH5Vyg6PFX0nNuq8gc2hRH%2Bqw5I9b8zroBuC1Dp42V%2BK%2FyGXVbfIGlJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 77e66e8d2a97b518-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/css/custom-alt-2.css
200 OK 1.4 kB URL HTTP/2 drift-offers.com/bitcoin-era/css/custom-alt-2.css
IP
Hash dabb9480cd8aae0d0b6d38d51e82599b
ea8e35f0a42dca663d1ece3c3d810d884ef3c933
77a62e3bda4fab2529e511c1f17b9026ab1ab9d7bd43060dd2d1d3502046550a
GET /bitcoin-era/css/custom-alt-2.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-bb1"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2B8ww5lSOKCwcqm3ta%2BwafYWM%2BlcffTSpg3dNkEdyqLCHE0IG60YEMpZxEerjfeyCkCXwpoXy2TSWa3ItQwsX1uDe1vm%2FA75p%2BjlRHwFA9FlXoQoYEUz%2FsjtyQ8zMQ0cAePR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c98a9b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash dc2725df0fb812e32298bb7faaf0c231
4ce4ac649b05b8eedab5bda51f4baf5f98417689
1a60eb1f9b71718c2061dfeb9de8241bef6fecab5d48adbc8ce3a89d1dddb8f5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/0_0b1vpY1Hk
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/0_0b1vpY1Hk
IP
Hash a8c3135768c41ad6a531e4ad8f104638
2c80e5353e83a19b34e676f121d22345b9337064
1055be2935e2761a6f9a7fcb0414cdb5b7933266adec544fb758fd98f4fa7e11
POST /s/gts1p5/0_0b1vpY1Hk HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:45 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
drift-offers.com/bitcoin-era/css/bootstrap.min.css
200 OK 20 kB URL HTTP/2 drift-offers.com/bitcoin-era/css/bootstrap.min.css
IP
File type ASCII text, with very long lines (65371)
Hash ffc5f2aabe9b5d1bff578043b62031c0
863f7ce49780dd5a58f543af4898e801671c01be
f627ca5e4bfab27eb64e965f8f5f712d813632f108bfffd3ef9499ad0efc161a
GET /bitcoin-era/css/bootstrap.min.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-1c591"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ncKiUJdC9ids6SnfuFhDK9ZENYVALqq1RDdx3qwJOJ7xTFoQ47lLlZcVBOw0hT8ad%2B8peeYwxEGwgq6TBrC53OE0hzh7UOpqxhRUCzZ0pS35Hegn3C73nX4LNV56bCtFa%2Bo5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c8892b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.google.com/recaptcha/api.js?onload=f1tRecaptchaCallback&render=6LcUjmoaAAAAADy6tjOg7FafQwMLUFEx4xw-lhHc
200 OK 610 B URL HTTP/2 www.google.com/recaptcha/api.js?onload=f1tRecaptchaCallback&render=6LcUjmoaAAAAADy6tjOg7FafQwMLUFEx4xw-lhHc
IP
File type ASCII text, with very long lines (947), with no line terminators
Hash b7d7b0d2e586c379532fe2de2fb6e868
309fca661467a0a00629ba6b62a696491e101da5
1ab086e1143fffb7b3ee824c2ac25fdbf6da91c1783b16a92e473642253d50cf
GET /recaptcha/api.js?onload=f1tRecaptchaCallback&render=6LcUjmoaAAAAADy6tjOg7FafQwMLUFEx4xw-lhHc HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Sat, 24 Dec 2022 04:00:45 GMT
date: Sat, 24 Dec 2022 04:00:45 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 610
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash dc2725df0fb812e32298bb7faaf0c231
4ce4ac649b05b8eedab5bda51f4baf5f98417689
1a60eb1f9b71718c2061dfeb9de8241bef6fecab5d48adbc8ce3a89d1dddb8f5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:45 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css2?family=Lato:wght@300;400;700&display=swap
200 OK 872 B URL HTTP/2 fonts.googleapis.com/css2?family=Lato:wght@300;400;700&display=swap
IP
Hash 9fbad0e4800bb7dcda944ce45f762322
b67f6437f2b4d9a41679f1eb2989ce224c91c76b
117b257bda3ae8c1ac2cb7a5089f0fcb4a1f55f0d36f7815787b8e24c884949e
GET /css2?family=Lato:wght@300;400;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 24 Dec 2022 04:00:45 GMT
date: Sat, 24 Dec 2022 04:00:45 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/css/index.css
200 OK 31 kB URL HTTP/2 drift-offers.com/bitcoin-era/css/index.css
IP
Hash c284163d08098d7ad782ba4555135fcb
b9969063c3af959198a160bff61f0332eae4f8ae
71c324dabbd460a1bdc930d925c729d9e0cd4ce5366bd8df28cd3804a336ded9
GET /bitcoin-era/css/index.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-8671"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKu3x6i9j2X9aBkxWn9dR9kszxvzu0fnmwS6Lq5nS%2BgfqPTyIip%2BNRJAKNgjH%2B%2B3ZGVJWYL0SzVbbM71jGtXYFD%2BgBBb6iQqQOMV1GJioCQytbsUBVqzcjy4rzW0zC3cc6Mw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c8897b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/js/custom.js
200 OK 32 kB URL HTTP/2 drift-offers.com/bitcoin-era/js/custom.js
IP
Hash 354eed7eb00807319aae8619d42e717a
9d49628ac4608a31a725a1f59bbd658b3ed33c14
5c20c11f108343f86eab1965a5a31db74bb2628a93aaacca93968b594900f299
Analyzer Verdict Alert fortinet Phishing
GET /bitcoin-era/js/custom.js HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: application/javascript
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-407"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQYguvTq9%2BFJgj%2FG6c2FF3zrZSqM0ua2r2%2FmUUmGZtTdLZ9GX%2FrnyEyrxGSi2lqSR1j44Ppst4NtXGywD5eonp%2Fx6yUOTQP%2BfkbGq6N0hBE1oemvEfx7KwPAV8tv%2BYju6ZTq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8cd8dcb512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/js/index.js
200 OK 2.9 kB URL HTTP/2 drift-offers.com/bitcoin-era/js/index.js
IP
Hash 419db34aa35f7aabf7fa4140070b7300
fab25c2125ee88f2d8aff2a8cc094ea701ed8323
dc4bd8079a36ba8b0795f23fa732726e147fc031304cbb6ced67935b7332edf8
Analyzer Verdict Alert fortinet Phishing
GET /bitcoin-era/js/index.js HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: application/javascript
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-2e7c"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pKgJeTmCJO0tKqqIrL5CgEgvxncpEox9bmq3lu1Hc7%2B2P6jQ6ZrugAX0KrnxhQ4xsRXrUNOLDuID2L%2B00Tc8WVddUcSsgWbjv34WfpwgSASiXmri3ICpGWk%2BhtHwHlCro5aQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8cc8d7b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
iframe.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa?muted=true&autoplay=true&loop=true&defaultTextTrack=no
200 OK 548 B URL HTTP/2 iframe.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa?muted=true&autoplay=true&loop=true&defaultTextTrack=no
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash c29b2048441edc8f72dfef4d29d586a4
7857bd1f204e2512219e14c9931ae73204c0318b
9b7abd0437ac5d3a739d82544ceb76353e040f0aa8d2af13365fe565cc8f33a2
GET /3b52b4f7fc368dfabd2a8e562b76bdfa?muted=true&autoplay=true&loop=true&defaultTextTrack=no HTTP/1.1
Host: iframe.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/html; charset=utf-8
vary: origin, referer, Accept-Encoding
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
server: cloudflare
cf-ray: 77e66e8e4ffdb523-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b9643a377daeefa9e867de25d84d90a4
7ab8aade6752606edfa9a6e68248fdbdca76dae8
0265378147b5eaa4ad2c4f570790b2b71b1abe8386e674c565bf0885396c04d0
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/thumbnails/thumbnail.jpg?height=480
200 OK 48 kB URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/thumbnails/thumbnail.jpg?height=480
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1280x1281, segment length 16, comment: "Lavc58.134.100", progressive, precision 8, 854x480, components 3\012- data
Hash 48717c2ad95edd81c2f5c4f403bd0cb7
e95af46ef9cbf385785acffc47ef62bfd36a82e8
ca8faa1d39352ecdc2bae8d4b4d3138dab9037ea4fd09e459243ffa92bf41689
GET /3b52b4f7fc368dfabd2a8e562b76bdfa/thumbnails/thumbnail.jpg?height=480 HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://iframe.cloudflarestream.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: image/jpeg
content-length: 47589
cf-ray: 77e66e9188edb523-OSL
accept-ranges: bytes
access-control-allow-origin: *
age: 116475
cache-control: public, max-age=864000
last-modified: Mon, 12 Dec 2022 21:10:08 GMT
strict-transport-security: max-age=31536000
vary: origin, referer, Accept-Encoding
cf-cache-status: HIT
access-control-allow-headers: range
access-control-expose-header: cf-ray
core-cache-status: MISS
served-in-seconds: 1.220
stream-dw-version: 2022.12.17
server: cloudflare
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
200 OK 165 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
IP
Size 165 kB (164930 bytes)
Hash ed247e5f26ec2941da525b276ea721cf
de206af36a2bbad65575be1896286a7e1ded0a8a
d7056e282266892a9f472e09678c10bdff60efe6330e7aa44eab625beac74375
GET /recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://drift-offers.com
Connection: keep-alive
Referer: https://drift-offers.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 164706
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 23 Dec 2022 08:42:55 GMT
expires: Sat, 23 Dec 2023 08:42:55 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 15 Dec 2022 05:24:10 GMT
content-type: text/javascript
age: 69471
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b9643a377daeefa9e867de25d84d90a4
7ab8aade6752606edfa9a6e68248fdbdca76dae8
0265378147b5eaa4ad2c4f570790b2b71b1abe8386e674c565bf0885396c04d0
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 24 Dec 2022 04:00:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/metadata/playerEnhancementInfo.json
200 OK 391 B URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/metadata/playerEnhancementInfo.json
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (516), with no line terminators
Hash 24ac97301f79e8879159a5d05d60ce28
3571a994117360124ae07589a0252fc800d8ed33
9d1013ebb0d5c68f9a4421938488db7acced8d1e39a564ac72f80ecd5022c0ea
GET /3b52b4f7fc368dfabd2a8e562b76bdfa/metadata/playerEnhancementInfo.json HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://iframe.cloudflarestream.com/
Origin: https://iframe.cloudflarestream.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=600
vary: origin, referer, Accept-Encoding
access-control-allow-headers: range
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
server: cloudflare
cf-ray: 77e66e9168e0b523-OSL
content-encoding: br
X-Firefox-Spdy: h2
customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/887.fb639d1f.chunk.js
200 OK 33 kB URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/887.fb639d1f.chunk.js
IP
File type ASCII text, with very long lines (36134), with no line terminators
Hash 914fb3b9258278b5d2c7c6df4844afd1
2796bca36dc40b3d295eff74548803c1d8be1650
b4752fd18341fd7cbc3deebe35d0de85b5daaca9eb9384074d3398c439a3c3eb
GET /embed/887.fb639d1f.chunk.js HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://iframe.cloudflarestream.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/javascript
cf-ray: 77e66e9138cfb523-OSL
cache-control: max-age=180
etag: W/"7166a8708d577019d90495202e7dd78b"
expires: Sat, 24 Dec 2022 03:58:21 GMT
last-modified: Thu, 10 Nov 2022 21:36:16 GMT
cf-cache-status: HIT
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
timing-add-origin: *
vary: Accept-Encoding
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/css/pers-sprite.css
200 OK 166 kB URL HTTP/2 drift-offers.com/bitcoin-era/css/pers-sprite.css
IP
Size 166 kB (165523 bytes)
Hash c10e15a7d522fbcb98aa2c5416f0a5e0
7cf6de089c34ecd1f16cbc945d300ec5e6d883ee
c39519ef8772c508440437e2d2077c27249d6c687212f9a8119607dbf55bf406
GET /bitcoin-era/css/pers-sprite.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-37e9"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2sdcd26uDLC%2F1Yp6pXimFodyQQS3ot6HB3j%2FGl4RLziYVuD%2Bk%2Fb%2FRRemOBPGMdooleFy%2F%2FNTF37L6M%2BUVQ1YShPscdqekb%2BwqQouzDz3%2Bpb4RREk05%2FE7bWNVWy7FHozfu5l"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c8899b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 597 B IP
ASN #20940 Akamai International B.V.
Hash 5a10faa9b32cb042bc04ade33586ed94
5a42da40f5ddbc4c2e1528e34a8a9c1ab467e817
6f90f4bf1c0e2b2e009c83a2b75d32953bf168ed560798f34c3e24d3b8805760
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2F0F30F38A3716401CDB35F3F70BD5892C541091940F1345D29FE71BF64F03BA"
Last-Modified: Fri, 23 Dec 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 24 Dec 2022 06:02:24 GMT
Date: Sat, 24 Dec 2022 04:00:47 GMT
Connection: keep-alive
o445185.ingest.sentry.io/api/5421136/envelope/?sentry_key=a37bd96361a84a13aec68cc8fc230f3c&sentry_version=7
200 OK 41 B URL HTTP/2 o445185.ingest.sentry.io/api/5421136/envelope/?sentry_key=a37bd96361a84a13aec68cc8fc230f3c&sentry_version=7
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 660953832a3db9c67f3fd5677d36f215
71a25f7800381f89d67b6adbca9c1bcf0b8ffd2a
379d4ed2c02ed71cc54d324f067a8cec596a0e9f9fdfaf02b875645453abc535
POST /api/5421136/envelope/?sentry_key=a37bd96361a84a13aec68cc8fc230f3c&sentry_version=7 HTTP/1.1
Host: o445185.ingest.sentry.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://drift-offers.com/
Content-Type: text/plain;charset=UTF-8
Origin: https://drift-offers.com
Content-Length: 24472
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 24 Dec 2022 04:00:47 GMT
content-type: application/json
content-length: 41
access-control-allow-origin: https://drift-offers.com
access-control-expose-headers: x-sentry-error, x-sentry-rate-limits, retry-after
vary: Origin
x-envoy-upstream-service-time: 0
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4b5405071b06356fcfed8adbcfd4e71b
7a24f36763789e54f9dc5e62eb23b209e0785c35
2f0f30f38a3716401cdb35f3f70bd5892c541091940f1345d29fe71bf64f03ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2F0F30F38A3716401CDB35F3F70BD5892C541091940F1345D29FE71BF64F03BA"
Last-Modified: Fri, 23 Dec 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 24 Dec 2022 06:02:24 GMT
Date: Sat, 24 Dec 2022 04:00:47 GMT
Connection: keep-alive
customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/sdk-iframe-integration.fla9.latest.js
200 OK 0 B URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/sdk-iframe-integration.fla9.latest.js
IP
GET /embed/sdk-iframe-integration.fla9.latest.js HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://iframe.cloudflarestream.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/javascript
cf-ray: 77e66e8f985eb523-OSL
age: 143
cache-control: max-age=180
etag: W/"f0706de51bb79f0fcd66dd783c9fe443"
expires: Sat, 24 Dec 2022 03:57:48 GMT
last-modified: Thu, 10 Nov 2022 21:36:22 GMT
cf-cache-status: HIT
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
timing-add-origin: *
vary: Accept-Encoding
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/lifecycle
200 OK 0 B URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/lifecycle
IP
GET /3b52b4f7fc368dfabd2a8e562b76bdfa/lifecycle HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://iframe.cloudflarestream.com/
Origin: https://iframe.cloudflarestream.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/json
access-control-allow-origin: *
vary: Accept-Encoding
server: cloudflare
cf-ray: 77e66e9168e1b523-OSL
content-encoding: br
X-Firefox-Spdy: h2
drift-offers.com/static/funnels-sdk/v6/dist/assets/css/main.min.css?v=6.1.4
200 OK 0 B URL HTTP/2 drift-offers.com/static/funnels-sdk/v6/dist/assets/css/main.min.css?v=6.1.4
IP
Analyzer Verdict Alert fortinet Phishing
GET /static/funnels-sdk/v6/dist/assets/css/main.min.css?v=6.1.4 HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Thu, 15 Dec 2022 14:00:11 GMT
vary: Accept-Encoding
etag: W/"639b286b-9034"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dlg%2BywzuwMRpI%2FP2yELCjT6hYzoutDLdpNr4q%2BQAU0WdrZL5VK2obKbrC6FtIa1GvusBYBFvkvCE7lbBkbqaUfTpNtp0RI4MSMUGt7CMLsAN7bsiphLeI%2BVVLwcJF47VgHgX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c98a0b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/static/funnels-sdk/v6/dist/assets/vendor/sentry.min.js
200 OK 0 B URL HTTP/2 drift-offers.com/static/funnels-sdk/v6/dist/assets/vendor/sentry.min.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /static/funnels-sdk/v6/dist/assets/vendor/sentry.min.js HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: application/javascript
last-modified: Mon, 28 Nov 2022 20:36:18 GMT
vary: Accept-Encoding
etag: W/"63851bc2-17684"
expires: Mon, 26 Dec 2022 11:51:12 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403773
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2z9fCt9Zhts8WlyJM1glVzUfg7KfE1iab8ygL8KpJKMwI3b5MCj7KX5Jvn8fcigNw5qmlvlqoEUvySiLjAvx7SfzcQjz97fE75Sm514cp1ZbrywromEjsONC1SeAY6OjF8if"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c8891b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/css/popup.css
200 OK 0 B URL HTTP/2 drift-offers.com/bitcoin-era/css/popup.css
IP
GET /bitcoin-era/css/popup.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-57f"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=658L9Uf7pIN1NPlJXpt2UxtWgliT4F71JfqkMmI2wCUz3potYgCh1eFpaYYWN34vit0fT6SPWm9XKCV65XVIziBiWsXhdmFvGoUy0B2%2F7qsiV9vThOs6s4WwsDEsIEZa9VsU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c989cb512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/manifest/video.mpd?parentOrigin=https%3A%2F%2Fdrift-offers.com
200 OK 0 B URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/3b52b4f7fc368dfabd2a8e562b76bdfa/manifest/video.mpd?parentOrigin=https%3A%2F%2Fdrift-offers.com
IP
GET /3b52b4f7fc368dfabd2a8e562b76bdfa/manifest/video.mpd?parentOrigin=https%3A%2F%2Fdrift-offers.com HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://iframe.cloudflarestream.com/
Origin: https://iframe.cloudflarestream.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/dash+xml
access-control-allow-origin: *
cache-control: public, max-age=600
vary: origin, referer, Accept-Encoding
access-control-allow-headers: range
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
server: cloudflare
cf-ray: 77e66e9188ecb523-OSL
X-Firefox-Spdy: h2
winnersailor.com/api/v3/offer/7?affiliate_id=477&url_id=89&aff_sub2=w2kuhke5jrtrk4dl2dlaal3k
302 Found 0 B URL HTTP/2 winnersailor.com/api/v3/offer/7?affiliate_id=477&url_id=89&aff_sub2=w2kuhke5jrtrk4dl2dlaal3k
IP
GET /api/v3/offer/7?affiliate_id=477&url_id=89&aff_sub2=w2kuhke5jrtrk4dl2dlaal3k HTTP/1.1
Host: winnersailor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ciar-kep.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Sat, 24 Dec 2022 04:00:44 GMT
content-type: text/html; charset=UTF-8
location: https://sourcesailor.com/api/v1/leads-workflow/funnel/1/7?tp_hash=acf425e99b3a8592c6e0387e4c66728c&tp_offer_id=7&tp_affiliate_id=477&tp_advertiser_id=1&tp_source=&tp_aff_sub=&tp_aff_sub2=w2kuhke5jrtrk4dl2dlaal3k&tp_aff_sub3=&tp_aff_sub4=&tp_aff_sub5=
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Access-Control-Allow-Credentials,Authorization
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Access-Control-Allow-Credentials
cache-control: private, must-revalidate
expires: -1
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0WYaRjRUtdafi8jTeqSWxAU%2Bxz%2BUWHita112nkKwW6SV39fNz9V%2B1oGMq1SprIjf5q2dp%2BW7wnbMamBH8FZzHMUxsjAMv6A0hu1JBlc69utLW%2BhUQmaIz7JnQyvEhorR%2BWny"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e84ea181c06-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
200 OK 0 B URL HTTP/2 drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
IP
Analyzer Verdict Alert fortinet Phishing
GET /bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ciar-kep.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/html
last-modified: Thu, 15 Dec 2022 16:00:15 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S5EciG7%2BmMWkKZGB2mei00DSxWVZSF8aEeuieUXlygQLcCX%2FL%2BDmK92dret7MK92WR4AojOsLbTMqW0IHTScZ4BqwsJhs1H39q4qi4PlBPDnCVdnhbgc1%2FLh6zXjyaz2IDxn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8b2804b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
drift-offers.com/bitcoin-era/css/build.min.css
200 OK 0 B URL HTTP/2 drift-offers.com/bitcoin-era/css/build.min.css
IP
GET /bitcoin-era/css/build.min.css HTTP/1.1
Host: drift-offers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://drift-offers.com/bitcoin-era/index-no.html?d=eyJpZCI6MTUxMjAwMCwic2VjcmV0IjoiYzA5NzA3YWFhZjZjMDg5NyIsImRvbWFpbiI6InNvdXJjZXNhaWxvci5jb20iLCJhcGkiOiJvcHRpbXVzLWxkIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:45 GMT
content-type: text/css
last-modified: Mon, 28 Nov 2022 20:34:57 GMT
vary: Accept-Encoding
etag: W/"63851b71-117a"
expires: Mon, 26 Dec 2022 11:51:13 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 403772
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qEvNAvlr4U7YwqfxQWKO7yb%2BBwecw1k7hDTudtsDPXdYalGzsZ7p2V3havQzM6ZCXkSyIfrDqt1wLuHHyI0rNb1%2B1V8AjU4NmjAvRR8YFg4LJn3f5TgvbOyUVp5OxfyMA55p"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77e66e8c8893b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/437.801d47c8.chunk.js
200 OK 0 B URL HTTP/2 customer-tqjuowcwyvj09sgh.cloudflarestream.com/embed/437.801d47c8.chunk.js
IP
GET /embed/437.801d47c8.chunk.js HTTP/1.1
Host: customer-tqjuowcwyvj09sgh.cloudflarestream.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://iframe.cloudflarestream.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sat, 24 Dec 2022 04:00:46 GMT
content-type: application/javascript
cf-ray: 77e66e9138ceb523-OSL
cache-control: max-age=180
etag: W/"abac150b3577d7480a74a55d99036272"
expires: Sat, 24 Dec 2022 03:59:18 GMT
last-modified: Wed, 30 Nov 2022 16:10:02 GMT
cf-cache-status: HIT
access-control-expose-header: cf-ray
stream-dw-version: 2022.12.17
timing-add-origin: *
vary: Accept-Encoding
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
64.32.8.68
188.114.96.1
104.17.25.14
23.36.76.226
93.184.220.29
18.197.36.77