Overview

URLinoradde.com/4/4292615/
IP 139.45.197.238 (United Kingdom)
ASN#9002 RETN Limited
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-12-06 03:59:38 UTC
StatusLoading report..
IDS alerts0
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (27)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
www.leovegas.com (1) 354851 2013-05-02 06:13:28 UTC 2020-04-27 12:35:54 UTC 107.154.248.168
vars.hotjar.com (1) 1014 2020-11-05 10:13:14 UTC 2022-12-05 11:18:35 UTC 143.204.55.118
fonts.googleapis.com (1) 8877 2013-06-10 20:14:26 UTC 2022-12-05 11:11:06 UTC 142.250.74.106
stats.g.doubleclick.net (1) 96 2013-06-10 20:21:11 UTC 2022-12-05 14:40:05 UTC 64.233.165.155
www.google.com (1) 7 2016-03-22 03:56:07 UTC 2022-12-05 09:18:03 UTC 142.250.74.132
sgtm.leovegas.com (1) 0 2021-10-28 13:02:37 UTC 2022-12-05 15:06:54 UTC 34.107.236.224 Domain (leovegas.com) ranked at: 196618
static.hotjar.com (1) 641 2014-11-01 05:14:27 UTC 2020-04-26 08:32:02 UTC 143.204.55.54
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 52.13.173.34
script.hotjar.com (1) 887 2020-11-05 16:23:46 UTC 2022-12-05 08:46:28 UTC 143.204.55.68
ntrfr.leovegas.com (1) 0 No data No data 95.101.10.168 Domain (leovegas.com) ranked at: 196618
promo.leovegas.com (19) 535866 No data No data 34.159.75.132
www.google-analytics.com (1) 40 2012-10-03 01:04:21 UTC 2022-12-05 12:07:35 UTC 142.250.74.110
vc.hotjar.io (1) 2334 No data No data 54.230.111.91
ocsp.digicert.com (5) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-12-05 04:09:09 UTC 34.102.187.140
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76
leo-promo-redirect-service.leo-prod-common.lvg-tech.net (1) 695620 2021-03-24 17:49:25 UTC 2022-12-05 15:56:53 UTC 34.117.190.191
d33wubrfki0l68.cloudfront.net (1) 0 2021-09-29 06:32:39 UTC 2022-12-05 10:48:08 UTC 143.204.42.80 Unknown ranking
r3.o.lencr.org (9) 344 No data No data 23.33.119.27
www.google.no (1) 25607 2016-04-05 19:50:59 UTC 2022-12-05 10:29:06 UTC 142.250.74.67
my.rtmark.net (1) 9054 2017-08-22 14:11:49 UTC 2022-12-05 13:11:00 UTC 139.45.195.8
inoradde.com (2) 0 2021-10-25 15:22:46 UTC 2022-12-06 00:13:22 UTC 139.45.197.238 Unknown ranking
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-12-05 04:09:48 UTC 34.117.237.239
ocsp.pki.goog (14) 175 2018-07-01 06:43:07 UTC 2020-05-02 20:58:16 UTC 142.250.74.131
fonts.gstatic.com (3) 0 2014-09-09 00:40:21 UTC 2022-12-05 08:18:24 UTC 216.58.207.227 Domain (gstatic.com) ranked at: 540
images.ctfassets.net (1) 4623 2019-09-28 11:39:53 UTC 2020-04-29 16:07:10 UTC 54.230.111.77

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2022-12-06 2 inoradde.com Sinkholed
2022-12-06 2 inoradde.com Sinkholed


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 139.45.197.238
Date UQ / IDS / BL URL IP
2023-02-03 10:11:46 +0000 0 - 1 - 2 rouonixon.com/4/4232331/ 139.45.197.238
2023-02-03 09:23:20 +0000 0 - 1 - 4 forprimeapeon.com/4/5086998/ 139.45.197.238
2023-02-03 02:57:59 +0000 0 - 2 - 2 inoradde.com/4/4326563/ 139.45.197.238
2023-02-03 01:02:27 +0000 0 - 0 - 2 rouonixon.com/4/5110323/ 139.45.197.238
2023-02-03 00:54:35 +0000 0 - 0 - 2 atraichuor.com/ 139.45.197.238


Last 5 reports on ASN: RETN Limited
Date UQ / IDS / BL URL IP
2023-02-03 13:18:30 +0000 0 - 0 - 2 chooxaur.com/4/4357524 139.45.197.237
2023-02-03 11:04:57 +0000 0 - 0 - 4 x.yourbestlandever.com/ 139.45.197.151
2023-02-03 11:00:06 +0000 0 - 0 - 4 m.yourbestlandever.com/ 139.45.197.151
2023-02-03 10:42:36 +0000 0 - 0 - 9 wansultoud.com/?l=CnZqpKgP8D7qUGD&b=15428269& (...) 139.45.197.151
2023-02-03 10:11:46 +0000 0 - 1 - 2 rouonixon.com/4/4232331/ 139.45.197.238


Last 5 reports on domain: inoradde.com
Date UQ / IDS / BL URL IP
2023-02-03 02:57:59 +0000 0 - 2 - 2 inoradde.com/4/4326563/ 139.45.197.238
2023-02-02 19:08:21 +0000 0 - 0 - 7 inoradde.com/4/4292615/ 139.45.197.238
2023-02-02 15:58:39 +0000 0 - 0 - 12 inoradde.com/4533056/ 139.45.197.238
2023-02-02 12:16:50 +0000 0 - 0 - 1 inoradde.com/4/5473348/ 139.45.197.238
2023-02-02 07:58:05 +0000 0 - 1 - 1 inoradde.com/4/4292618/ 139.45.197.238


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-12-06 08:11:49 +0000 0 - 0 - 9 hungryforhungry.blogspot.com/2007/03/9307.html 142.250.74.161
2022-12-06 06:52:14 +0000 0 - 0 - 1 supapush.net/ck 139.45.197.253
2022-12-06 06:13:57 +0000 0 - 0 - 2 tele123.store/cl/500/bx/nl 79.98.29.10
2022-12-06 03:42:39 +0000 0 - 0 - 3 fgmc.anathothonline.us/ 81.171.22.7
2022-12-06 03:29:44 +0000 0 - 0 - 2 media2.site/br/env/nl/ 194.135.87.146

JavaScript

Executed Scripts (11)

Executed Evals (91)
#1 JavaScript::Eval (size: 106) - SHA256: 44016e43fa4f0dcf110125630bf1d017234026081a2b93726932a727cea1fc6c
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(13))).get("utm_source")
})();
#2 JavaScript::Eval (size: 152) - SHA256: a1c1c0c5a06aa8d50dab0a7eaaa1420503565a82934f465492767894f31cff41
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(12) ? google_tag_manager["GTM-WGS5KD"].macro(14) : google_tag_manager["GTM-WGS5KD"].macro(19)
})();
#3 JavaScript::Eval (size: 108) - SHA256: bcb56769020cb140b5c7e552b889d00c427161277b5e67c385c38e8460f21ebe
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(32))).get("utm_campaign")
})();
#4 JavaScript::Eval (size: 123) - SHA256: 6ee88f294314cad35a11c2dbab248326dc2a3465cd329ee17d39e760cf2627f6
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(38))).get("btag").split("_")[0];
    return a
})();
#5 JavaScript::Eval (size: 99) - SHA256: ce3e18a8510a65da5b2f621b3c28f3866a5e6b3ea4ae25468e1c664812638e3e
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(85))).get("pid")
})();
#6 JavaScript::Eval (size: 114) - SHA256: 7b8cdfb439a9696a17f1e19589d2055d1cf1e6308fd1725f447ae8a964eedb0c
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(104)) return google_tag_manager["GTM-WGS5KD"].macro(106)
})();
#7 JavaScript::Eval (size: 124) - SHA256: 8c786163d5b73d7bc01f2f53e0c1ca06d19f0d3be6b6e403ffd389f51f7926cc
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(124))).get("btag").split("_")[0];
    return a
})();
#8 JavaScript::Eval (size: 123) - SHA256: ea63b9843eac3e3ccefca4aacb623024051159f9e09306e7143fad34b0a25bf1
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(96))).get("btag").split("_")[0];
    return a
})();
#9 JavaScript::Eval (size: 110) - SHA256: b44315dfd59ca38274202c3d0708b5c79f3b8ea78cf86c400591e71e6a3a38a9
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(7)) return google_tag_manager["GTM-WGS5KD"].macro(9)
})();
#10 JavaScript::Eval (size: 123) - SHA256: 18ee1f5475962d3b38e052819db4d2d4366b96afb2541b9067673d63a0d5a1e5
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(24))).get("btag").split("_")[0];
    return a
})();
#11 JavaScript::Eval (size: 152) - SHA256: e4a2b38eee8536909dc34f01426f70e51132efbd801770d657fe8d5701d96f8b
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(66) ? google_tag_manager["GTM-WGS5KD"].macro(68) : google_tag_manager["GTM-WGS5KD"].macro(74)
})();
#12 JavaScript::Eval (size: 123) - SHA256: ed0ece0b6e472c857b1730cced51bc469b2ad0450dd93ff5d4ae510ce31d5309
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(94))).get("btag").split("_")[0];
    return a
})();
#13 JavaScript::Eval (size: 105) - SHA256: df2267e3e07d3ae370c5d274f0554604e5b61eeace3aeb5153f356b63b7eff47
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(4))).get("utm_source")
})();
#14 JavaScript::Eval (size: 150) - SHA256: 954640cb295a2a917672de217b87cbfab0b892329d129e58739c00f2a9b612dc
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(3) ? google_tag_manager["GTM-WGS5KD"].macro(5) : google_tag_manager["GTM-WGS5KD"].macro(10)
})();
#15 JavaScript::Eval (size: 171) - SHA256: 48cb6b0fa5a474252426424beefd352a47e25234514c9fe3f4949c22a6780274
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(20);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#16 JavaScript::Eval (size: 106) - SHA256: 498b95ddeefbfc3f8f575dde2b3e76b3aafa99c241418c5f577cedb02838ed56
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(22))).get("utm_medium")
})();
#17 JavaScript::Eval (size: 152) - SHA256: 8830b35ea78c950806c4972c8cc6857dcf77bafb266b0a90e34fcdd4ce7d77e7
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(21) ? google_tag_manager["GTM-WGS5KD"].macro(23) : google_tag_manager["GTM-WGS5KD"].macro(29)
})();
#18 JavaScript::Eval (size: 99) - SHA256: 56fa8584f97ab57aceee7f9b7c3b0b6f146d6204e53049dd09ca566eb6a8ba92
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(40))).get("pid")
})();
#19 JavaScript::Eval (size: 172) - SHA256: da6c050e1003df621452f4af85b0e224a2b41314a0068b2a2676325102e16fdf
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(108);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#20 JavaScript::Eval (size: 192) - SHA256: 75e7d6881f7aaf129305f16840427e2c8f62394c8816f57689b9ccc96c8563ed
(function() {
    try {
        if (window.location.search.includes("qs")) {
            var a = new URLSearchParams(window.location.search);
            return decodeURIComponent(a.get("qs"))
        }
        return window.location.search
    } catch (b) {}
})();
#21 JavaScript::Eval (size: 123) - SHA256: d794a5d005d2990361b510f2fcc1a33792baddfc4846e15ea053881aee23eff1
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(15))).get("btag").split("_")[0];
    return a
})();
#22 JavaScript::Eval (size: 115) - SHA256: 53a045ec8988877e0fc7e0017e8eec37d10952a3f1db13ef3e356e0124991fbc
(function() {
    try {
        var a = window.location.pathname + window.location.search + window.location.hash;
        return a
    } catch (b) {}
})();
#23 JavaScript::Eval (size: 123) - SHA256: 668d8290c59bbe3f716059c4a9542905d78d66738bb0f266f7b4626b1f620f00
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(69))).get("btag").split("_")[0];
    return a
})();
#24 JavaScript::Eval (size: 106) - SHA256: ab3b51d76b7283fccccbb14c48ca4b296b21d21a99da32f1aab190f9d03dda4e
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(92))).get("utm_source")
})();
#25 JavaScript::Eval (size: 124) - SHA256: 31a0929519f9f762b5228a20c29d8ebfc62541c8b50e19108f9a4fd33b1ae113
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(105))).get("btag").split("_")[0];
    return a
})();
#26 JavaScript::Eval (size: 155) - SHA256: d8b455f29a30f673681e811bf0bcb188224da0880d07eafe9298d00c35da9a03
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(109) ? google_tag_manager["GTM-WGS5KD"].macro(111) : google_tag_manager["GTM-WGS5KD"].macro(117)
})();
#27 JavaScript::Eval (size: 155) - SHA256: f8a52a3a73e0250a815dd17132803408dd6b56880c65fd14eb340e4393d40d7d
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(119) ? google_tag_manager["GTM-WGS5KD"].macro(121) : google_tag_manager["GTM-WGS5KD"].macro(123)
})();
#28 JavaScript::Eval (size: 85) - SHA256: cd6f7444b22e9ab3c56840e59daf71e50b182a51078604d63b4590f0a917f62e
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(28) ? "affiliate" : void 0
})();
#29 JavaScript::Eval (size: 114) - SHA256: 9376c54e9f4221dba2b9955f457ee5e2ddb69df7237bc51abf7f25d6f463e995
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(125)) return google_tag_manager["GTM-WGS5KD"].macro(127)
})();
#30 JavaScript::Eval (size: 152) - SHA256: 44a532b0f5d0ce4e99cab5e4d8ca630bcdc61e4619be06bd23e152ea08618425
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(31) ? google_tag_manager["GTM-WGS5KD"].macro(33) : google_tag_manager["GTM-WGS5KD"].macro(35)
})();
#31 JavaScript::Eval (size: 152) - SHA256: 2c15ffb83e32d1c92db7a321806fbba6b25f81f026468aa402e10f213fb56789
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(48) ? google_tag_manager["GTM-WGS5KD"].macro(50) : google_tag_manager["GTM-WGS5KD"].macro(55)
})();
#32 JavaScript::Eval (size: 171) - SHA256: f774376b45d27d4aecc0515c3897ada4159fd9f8e5dc3bd09f6af656b5f10bc9
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(75);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#33 JavaScript::Eval (size: 99) - SHA256: a372ea4bb9c395cf2a1b5bfd66ae00fe7cc4080339561c8c687cad60a6c233d2
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(34))).get("bid")
})();
#34 JavaScript::Eval (size: 106) - SHA256: 6048538b50f3e2d149105613c637d602c0e0bdbb6786da16151538a01e137420
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(49))).get("utm_source")
})();
#35 JavaScript::Eval (size: 152) - SHA256: 59c0b6a193557f1d98f4769131b8c4ab50f29c950416aa94e004774ed73c4d65
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(57) ? google_tag_manager["GTM-WGS5KD"].macro(59) : google_tag_manager["GTM-WGS5KD"].macro(64)
})();
#36 JavaScript::Eval (size: 171) - SHA256: d18bbfc39366226ea45b0be769222c006c95b3d078b7a90671a3c446dcf6c143
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(90);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#37 JavaScript::Eval (size: 100) - SHA256: 2ef190e1ff5f9ee67483497a713866fca8982a051f6bdc5aed06c976d76f899e
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(122))).get("bid")
})();
#38 JavaScript::Eval (size: 100) - SHA256: d4f42c415fb7cac7882ad147bbaec5daa8e0bc9b2a51d7d27e4b4b58fc8c1e24
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(128))).get("pid")
})();
#39 JavaScript::Eval (size: 122) - SHA256: 1cf32fcddd085006b4b1f5a093b5b4a5f97109ab362d6ab5ba3a7b7e37c756d5
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(8))).get("btag").split("_")[0];
    return a
})();
#40 JavaScript::Eval (size: 171) - SHA256: 54f2fbd41d0e2ae4e39cccc16b7ee210aa2d6fb6ccfb6d0067d55c85228d5dd1
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(11);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#41 JavaScript::Eval (size: 112) - SHA256: c841ad1044f1280ede71fe699f66310a9d2807f9c7bef6b89a4a8f8b9252b4f8
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(70)) return google_tag_manager["GTM-WGS5KD"].macro(72)
})();
#42 JavaScript::Eval (size: 99) - SHA256: d17fd190e57cddcc99937eebab090c8741b1c00f39fde23b824d36056b8e5a6b
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(79))).get("bid")
})();
#43 JavaScript::Eval (size: 155) - SHA256: 2b5c718020edf189b5d5d66cbf97a44dec13c8615d709eab026fae0d839a113f
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(100) ? google_tag_manager["GTM-WGS5KD"].macro(102) : google_tag_manager["GTM-WGS5KD"].macro(107)
})();
#44 JavaScript::Eval (size: 124) - SHA256: 920d4ca9ae716cf2a121d0cb6147c90749c2086ee944e97b5333c0dc5323164e
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(114))).get("btag").split("_")[0];
    return a
})();
#45 JavaScript::Eval (size: 109) - SHA256: 79f2bdc0ed253382e0153731d6bd985912616621354f41eaf23d0d8f8874a450
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(120))).get("utm_campaign")
})();
#46 JavaScript::Eval (size: 107) - SHA256: 4fcaab3a7f479df8e2e6efe8644304bfc11fb4b9db9b7ea047c828c381a0f091
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(110))).get("utm_medium")
})();
#47 JavaScript::Eval (size: 112) - SHA256: be4cf8963e8756a3536f6dd2faf468dac4a10772368c3bf6924326e817e82f2d
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(37)) return google_tag_manager["GTM-WGS5KD"].macro(39)
})();
#48 JavaScript::Eval (size: 112) - SHA256: 97b829038d51c87fe300ab6ac8e854efb485ebf051f7928ad7c6b218e073d900
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(52)) return google_tag_manager["GTM-WGS5KD"].macro(54)
})();
#49 JavaScript::Eval (size: 123) - SHA256: 87be8eb5c7696ceaa4708480fa74889d2493c0723084f9b0a7c461b3be870910
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(62))).get("btag").split("_")[0];
    return a
})();
#50 JavaScript::Eval (size: 123) - SHA256: ad5bc53fcce651e5551ef50b46590aaaababa66dabad0a274a82f46a8db6e239
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(71))).get("btag").split("_")[0];
    return a
})();
#51 JavaScript::Eval (size: 85) - SHA256: 960a1ce06a687e502972307511ba7c7ffc2efa98af52b1984415a1bd7cbec116
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(73) ? "affiliate" : void 0
})();
#52 JavaScript::Eval (size: 123) - SHA256: c64736bd279cb29a4d624025b9f6fe887a2c3c6c9a278e3d5db22eecb68d12ba
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(81))).get("btag").split("_")[0];
    return a
})();
#53 JavaScript::Eval (size: 136) - SHA256: aa2b8b8c5144f2fbfe7b08bbab552cd4f1dcb5603de0ec59b4724e27973fb493
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(86)) {
        var a = google_tag_manager["GTM-WGS5KD"].macro(87).split("/")[1];
        return a
    }
})();
#54 JavaScript::Eval (size: 86) - SHA256: f74a0f07f35ce720d19e06b96d16d0b366c1563b80fbba36636f0de86023db49
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(116) ? "affiliate" : void 0
})();
#55 JavaScript::Eval (size: 124) - SHA256: fe1d3bd6a7d18eec6383a2fcdefee8051009c2e0348e636ee0376fc6290f306b
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(126))).get("btag").split("_")[0];
    return a
})();
#56 JavaScript::Eval (size: 112) - SHA256: abd1a29e10277e55453e7cd98169538787d14205deef4b8e4b8bd4cabf079843
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(25)) return google_tag_manager["GTM-WGS5KD"].macro(27)
})();
#57 JavaScript::Eval (size: 171) - SHA256: 45dd79403b47a170bba397edb3e05298a676d17de159da0c49ec6a241f3d8a62
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(30);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#58 JavaScript::Eval (size: 481) - SHA256: 29672ec2833e5638671699664918a17cb2f8ef6c24c7e95f317f191eb2a734d7
(function() {
    return function(c) {
        var d = "37",
            e = !1,
            f = "_" + c.get("trackingId") + "_sendHitTask",
            g = window[f] = window[f] || c.get("sendHitTask");
        c.set("sendHitTask", function(a) {
            var h = window[window.GoogleAnalyticsObject],
                b = a.get("hitPayload");
            if (a.get("exp")) {
                if ("data" === a.get("hitType") && !e) {
                    b = a.get("name");
                    g(a);
                    h(b + ".send", "event", "Optimize", a.get("exp"), {
                        nonInteraction: !0
                    });
                    e = !0;
                    return
                } - 1 === b.indexOf("\x26cd" + d + "\x3d") && a.set("hitPayload", b + "\x26cd" + d + "\x3d" + a.get("exp"), !0)
            }
            g(a)
        })
    }
})();
#59 JavaScript::Eval (size: 196) - SHA256: 1f50cb6f9ff55ae43ae2853c0863d681dd058d1e4f9c949b9900a9ac8c6b774f
(function() {
    try {
        var b = ga.getAll(),
            c;
        var a = 0;
        for (c = b.length; a < c; a += 1)
            if (b[a].get("trackingId") === google_tag_manager["GTM-WGS5KD"].macro(88)) return b[a].get("clientId");
        return "false"
    } catch (d) {}
})();
#60 JavaScript::Eval (size: 112) - SHA256: d357a4a08ac5665d86654cfbe8060448643637b0762e15fafd88677f82cd0509
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(95)) return google_tag_manager["GTM-WGS5KD"].macro(97)
})();
#61 JavaScript::Eval (size: 171) - SHA256: d82f8b1c19320143b113106f113e12e11eaf02d572553c08828af6308cd6a8af
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(99);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#62 JavaScript::Eval (size: 138) - SHA256: 970c21e7b7ab3e6222aedaf15a05861f5fe8a15505066c7c53489164b3404976
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(129)) {
        var a = google_tag_manager["GTM-WGS5KD"].macro(130).split("/")[1];
        return a
    }
})();
#63 JavaScript::Eval (size: 172) - SHA256: 372a47d4bcf5c10be3bf46a79adcf93a61c8c67dbfb7a756c038534f759b5ad1
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(118);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#64 JavaScript::Eval (size: 645) - SHA256: 38f3c6ed5edf9b2b0e4e6fa7f1afb2dd77d61226c59e8fa6e896fc06aa6cbfbc
(function() {
    try {
        var d = window.location.href,
            e = window.location.search,
            f = window.location.hash,
            c = [];
        if (-1 != e.indexOf("?") || -1 != e.indexOf("\x26")) {
            for (var b = e.split("?")[1].split("\x26"), a = 0; a < b.length; a++) - 1 != b[a].search(/(btag|gclid|dclid|utm_(source|medium|campaign)|fbclid)=/i) && c.push(b[a]);
            return 0 < c.length ? d.split("?")[0] + "?" + c.join("\x26") : d.split("?")[0]
        }
        if (-1 != f.indexOf("?") || -1 != f.indexOf("\x26")) {
            b = f.split("?")[1].split("\x26");
            for (a = 0; a < b.length; a++) - 1 != b[a].search(/(btag|gclid|dclid|utm_(source|medium|campaign)|fbclid)=/i) &&
                c.push(b[a]);
            return 0 < c.length ? d.split("?")[0] + "?" + c.join("\x26") : d.split("?")[0]
        }
        return d
    } catch (g) {}
})();
#65 JavaScript::Eval (size: 171) - SHA256: 9877c5059d159d3a2189b54d05a20605fee72339bfc071006d11e4134a495202
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(56);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#66 JavaScript::Eval (size: 106) - SHA256: dc8ae8a67a5b5334e5f6daa72ed35acb9a8d4e5c59011873285c9ae05bd14715
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(58))).get("utm_source")
})();
#67 JavaScript::Eval (size: 123) - SHA256: 3edce4ca2c15de45bc58d605e6a9abf05f12278ea9cfbb1def261b7fd2dba1a1
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(83))).get("btag").split("_")[0];
    return a
})();
#68 JavaScript::Eval (size: 124) - SHA256: 06536f663928ebf2a0f137dd7c506c0b2fdd5cb536ddc6b26737a48b77e93998
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(112))).get("btag").split("_")[0];
    return a
})();
#69 JavaScript::Eval (size: 114) - SHA256: f542ff366a2985daaa4dcaae3c1ac13fc6fce19c066b80b3f893cfe9f28e822a
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(113)) return google_tag_manager["GTM-WGS5KD"].macro(115)
})();
#70 JavaScript::Eval (size: 197) - SHA256: ee07f5998d90cd538705ab2419aba824a40cbac066ce031cd5d9e77abdc0cb65
(function() {
    try {
        var b = ga.getAll(),
            c;
        var a = 0;
        for (c = b.length; a < c; a += 1)
            if (b[a].get("trackingId") === google_tag_manager["GTM-WGS5KD"].macro(131)) return b[a].get("clientId");
        return "false"
    } catch (d) {}
})();
#71 JavaScript::Eval (size: 108) - SHA256: 45a116bd9b804f927696f116e075e6ee59d09edabf987c47801f84c65aae6c91
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(77))).get("utm_campaign")
})();
#72 JavaScript::Eval (size: 152) - SHA256: 6e9d44c7388257d314532983baff8ef140cec9c336a1399787485138480ec589
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(76) ? google_tag_manager["GTM-WGS5KD"].macro(78) : google_tag_manager["GTM-WGS5KD"].macro(80)
})();
#73 JavaScript::Eval (size: 152) - SHA256: dfdfe7abd958b9ffd6777cffae3328e74fdd3211bad8a32524eb76ea827e9b5d
(function() {
    return google_tag_manager["GTM-WGS5KD"].macro(91) ? google_tag_manager["GTM-WGS5KD"].macro(93) : google_tag_manager["GTM-WGS5KD"].macro(98)
})();
#74 JavaScript::Eval (size: 106) - SHA256: 1dfd5cf3800c921ce486ff9ddbfc1af097248a2a209220e542c5a0d752050abc
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(67))).get("utm_medium")
})();
#75 JavaScript::Eval (size: 112) - SHA256: 4514b65927d2ea2ffd137d7c201268db1f2932912863a6976d8e8ee7ab7c7de4
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(16)) return google_tag_manager["GTM-WGS5KD"].macro(18)
})();
#76 JavaScript::Eval (size: 123) - SHA256: ddf3e59e52a0c2225676c83eb0fb38d5ef30a6dca0375cf12fe1a29b0e0b90a9
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(26))).get("btag").split("_")[0];
    return a
})();
#77 JavaScript::Eval (size: 136) - SHA256: 3746218d3bdf30209078b4aa7983f2eb07448b11ae6d47e49446ab036d63c3b6
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(41)) {
        var a = google_tag_manager["GTM-WGS5KD"].macro(42).split("/")[1];
        return a
    }
})();
#78 JavaScript::Eval (size: 196) - SHA256: 6de6d66be9af47a58faea809d8c496b189ff3dd55c8e996ad67f42d86074cc63
(function() {
    try {
        var b = ga.getAll(),
            c;
        var a = 0;
        for (c = b.length; a < c; a += 1)
            if (b[a].get("trackingId") === google_tag_manager["GTM-WGS5KD"].macro(43)) return b[a].get("clientId");
        return "false"
    } catch (d) {}
})();
#79 JavaScript::Eval (size: 171) - SHA256: c82899bed50ff4b066d2f9ca0e676a4d6c76376d31cc1754f03938f47c49f433
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(47);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#80 JavaScript::Eval (size: 123) - SHA256: c41f3e488fe9890f02421f2e761b977a674958d4cda4cba713ec6ab4b9da9362
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(53))).get("btag").split("_")[0];
    return a
})();
#81 JavaScript::Eval (size: 107) - SHA256: 9826c00d835f07b2fc9cc0320f48a8777d58b0120f5dad310c767bb9f3c28c6d
(function() {
    return (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(101))).get("utm_source")
})();
#82 JavaScript::Eval (size: 170) - SHA256: 4f7f6eb560e827cac4f0d2243c88ea4bd1e5285181444df4a0ea0184f7cec529
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(2);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#83 JavaScript::Eval (size: 123) - SHA256: 82155e6e97b4af69f0cc8ad5a6f1aa69ff6718de3a82b8ebfd104438205aaeb6
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(36))).get("btag").split("_")[0];
    return a
})();
#84 JavaScript::Eval (size: 123) - SHA256: a3fb585118875e7ef989d048cb240dc645b7c6e4ddad3b599f47eda85ab6e077
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(51))).get("btag").split("_")[0];
    return a
})();
#85 JavaScript::Eval (size: 123) - SHA256: bd55a7f57591df287ee397998ca31eb131722b047624358549fa627560af3b28
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(60))).get("btag").split("_")[0];
    return a
})();
#86 JavaScript::Eval (size: 171) - SHA256: 0e7021ef2a53613b0b437a8bf226aa0f17eaa531958aad1375d62a9486ea1f96
(function() {
    try {
        var a = google_tag_manager["GTM-WGS5KD"].macro(65);
        return -1 < a.indexOf("utm_campaign") || -1 < a.indexOf("utm_source") || -1 < a.indexOf("utm_medium")
    } catch (b) {}
})();
#87 JavaScript::Eval (size: 122) - SHA256: 0e803317c10ccb5c87fbdbd91f869516f42e42b0203e926fd329bfacc914ff2c
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(6))).get("btag").split("_")[0];
    return a
})();
#88 JavaScript::Eval (size: 123) - SHA256: 33101ae4058105ae8fbe7aa648fb657477df64d4d360a0eb06860a77edd9a097
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(17))).get("btag").split("_")[0];
    return a
})();
#89 JavaScript::Eval (size: 112) - SHA256: 2a2731e6215cb517b2822ddc524639e123a21e6953d458e59bd69953902feffd
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(61)) return google_tag_manager["GTM-WGS5KD"].macro(63)
})();
#90 JavaScript::Eval (size: 112) - SHA256: b88573ab8e6ed11643ca83f781611f5c9b93f4e0f021942bd139d66bdc4fbc29
(function() {
    if (google_tag_manager["GTM-WGS5KD"].macro(82)) return google_tag_manager["GTM-WGS5KD"].macro(84)
})();
#91 JavaScript::Eval (size: 124) - SHA256: b483ead6657271b2b30855c8c0faad1bb6b6e62a8376b26d168cd7815bd218b2
(function() {
    var a = (new URLSearchParams(google_tag_manager["GTM-WGS5KD"].macro(103))).get("btag").split("_")[0];
    return a
})();

Executed Writes (0)


HTTP Transactions (79)


Request Response
                                        
                                            GET /4/4292615/ HTTP/1.1 
Host: inoradde.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         139.45.197.238
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf8
                                        
Server: nginx
Date: Tue, 06 Dec 2022 03:59:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Trace-Id: 2dc7e2ad9fe98b3e3b2b000dd65ade19
Link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch", <https://ntrfr.leovegas.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Timing-Allow-Origin: *
Set-Cookie: OAID=854d10887dfb4d9bbbb9dc72c2b4eeef; expires=Wed, 06 Dec 2023 03:59:26 GMT; path=/ oaidts=1670299166; expires=Wed, 06 Dec 2023 03:59:26 GMT; path=/ syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
Pragma: no-cache, no-cache
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
Access-Control-Allow-Origin: *, *
Access-Control-Allow-Methods: GET, POST, OPTIONS, POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Accept, Content-Type, Content-Length, Accept-Encoding
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   606
Md5:    e87e6ecd4925d364f724fe2863ed3df3
Sha1:   33f24ac68f01cce928b7d19a45223e0bd182e8b7
Sha256: 0807e484428284c79044d0048fa446ce6d9ba35e66f68e08078fd18e5055a1c2

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "1BAD6C06AA3E88DCBC125FC98A6CB753EB2B18D2C8DD61DA21D12209AEEDA3F9"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2764
Expires: Tue, 06 Dec 2022 04:45:30 GMT
Date: Tue, 06 Dec 2022 03:59:26 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2243
Cache-Control: max-age=112156
Date: Tue, 06 Dec 2022 03:59:26 GMT
Etag: "638dc877-1d7"
Expires: Wed, 07 Dec 2022 11:08:42 GMT
Last-Modified: Mon, 05 Dec 2022 10:31:19 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5823
Expires: Tue, 06 Dec 2022 05:36:29 GMT
Date: Tue, 06 Dec 2022 03:59:26 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 06 Dec 2022 03:20:21 GMT
cache-control: public,max-age=3600
age: 2345
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: Cko+3nCTn340udcJMGS32EtZ9ZIBppvscV6imv5qFMLwnDHElfqWd/aTS+oJRBDSjelYseznhRM=
x-amz-request-id: K07QER9EB9SBE4NT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 06 Dec 2022 03:48:46 GMT
age: 640
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    53341dea33f4f3d9b4966f80589f429a
Sha1:   20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
Sha256: 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 06 Dec 2022 03:59:26 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "18D3562684C32ED7B8D7CF02C853D8F1F08BF1074151891D9B756D14FDDDFA1F"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5450
Expires: Tue, 06 Dec 2022 05:30:16 GMT
Date: Tue, 06 Dec 2022 03:59:26 GMT
Connection: keep-alive

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: inoradde.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: OAID=854d10887dfb4d9bbbb9dc72c2b4eeef; oaidts=1670299166

search
                                         139.45.197.238
HTTP/1.1 204 No Content
                                        
Server: nginx
Date: Tue, 06 Dec 2022 03:59:26 GMT
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Pragma: public
Cache-Control: max-age=315360000, public, must-revalidate, proxy-revalidate


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST /img.gif?f=merge&userId=854d10887dfb4d9bbbb9dc72c2b4eeef HTTP/1.1 
Host: my.rtmark.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

search
                                         139.45.195.8
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Tue, 06 Dec 2022 03:59:26 GMT
content-length: 43
access-control-allow-origin: null
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=854d10887dfb4d9bbbb9dc72c2b4eeef; expires=Wed, 06 Dec 2023 03:59:26 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    b4491705564909da7f9eaf749dbbfbb1
Sha1:   279315d507855c6a4351e1e2c2f39dd9cd2fccd8
Sha256: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
                                        
                                            GET /redirect.aspx?pid=3748557&bid=13362&rdk=rk1 HTTP/1.1 
Host: ntrfr.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         95.101.10.168
HTTP/2 307 Temporary Redirect
content-type: text/html
                                        
content-length: 0
location: https://promo.leovegas.com/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
p3p: CP="This is not a P3P policy! It is used to bypass IEs problematic handling of cookies"
x-aspnet-version: 4.0.30319
request-context: appId=cid-v1:83ffbda4-9458-475e-90ec-4427cfb5c3b0
access-control-expose-headers: Request-Context
expires: Tue, 06 Dec 2022 03:59:26 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Tue, 06 Dec 2022 03:59:26 GMT
set-cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; SameSite=None;; domain=.leovegas.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; domain=.leovegas.com; expires=Thu, 06-Dec-3021 03:59:26 GMT; path=/; secure; SameSite=Strict
server-timing: cdn-cache; desc=MISS, edge; dur=53, origin; dur=36
X-Firefox-Spdy: h2

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 06 Dec 2022 03:11:20 GMT
cache-control: public,max-age=3600
age: 2886
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "19C446681B5229C4DC010D36C154328802A4BBB49BB454E168DABFE1553609FA"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12760
Expires: Tue, 06 Dec 2022 07:32:07 GMT
Date: Tue, 06 Dec 2022 03:59:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2222
Cache-Control: 'max-age=158059'
Date: Tue, 06 Dec 2022 03:59:27 GMT
Last-Modified: Tue, 06 Dec 2022 03:22:25 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362 HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         34.159.75.132
HTTP/2 301 Moved Permanently
content-type: text/plain; charset=utf-8
                                        
age: 0
cache-control: public, max-age=0, must-revalidate
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Tue, 06 Dec 2022 03:59:27 GMT
location: /no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAE8CG3M8AZTG4QYJMP7
x-xss-protection: 1; mode=block
content-length: 32
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   32
Md5:    39dacc1839fbc93e31c1d2d53217a24c
Sha1:   bab0715449a8c2d79b67b5fa7f7d464f774fb77d
Sha256: 391c5184370e9aa51e55f54f79e9cb518cabbdf1d0806db6a832f38b9364b28b
                                        
                                            GET /no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362 HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
age: 35599
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:06:09 GMT
etag: "67822a40934479402c5bf2b45514a010-ssl-df"
link: </webpack-runtime.js>; rel=preload; as=script, </framework.js>; rel=preload; as=script, </dc6a8720040df98778fe970bf6c000a41750d3ae.js>; rel=preload; as=script, </app.js>; rel=preload; as=script, </47c41b0c4f3753646af9b0e10dfd7be6f02b99db.js>; rel=preload; as=script, </7bdf0be5c8efe81cdad9ba3761024df107bef3b0.js>; rel=preload; as=script, </ff324cc4fcad5c37469103212758a68962a91703.js>; rel=preload; as=script, </8e399fed3a6b1522e3959e34b00067a9519e807d.js>; rel=preload; as=script, </05901c0cdc340371e5e64de460e805993147c75a.js>; rel=preload; as=script, </component---src-templates-leo-universe-index-jsx.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/no/mc-livecasino/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAM0VWDR6ZRXM27FA6FG
x-xss-protection: 1; mode=block
content-length: 16385
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6578)
Size:   16385
Md5:    2b0ae82eb4e6737975bd2d7e26b18c94
Sha1:   fe34affac3567563b4ea1750515afe501b171d5e
Sha256: d3d91a70292603a2cff12cbbc42fe456d37f0bdcad28c58b003baaea5a2ca3c5
                                        
                                            GET /webpack-runtime.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "d50f19024fb972e823cb9cedda51d294-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAPVD37G1X33HP1EC8DN
x-xss-protection: 1; mode=block
content-length: 1432
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2978)
Size:   1432
Md5:    fc6275e91b83fb1861d667aff0bd5ab2
Sha1:   64cede2d4178f82eb8a11cb2b32706cef16f601e
Sha256: 98003f07ca794236c4b933ef2bbe37c75a8b0748912ad4e967886a4915625b89
                                        
                                            GET /framework.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "3e379ad990653adc04137a3854730ff5-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAPWG9G19TZRJJ318SW8
x-xss-protection: 1; mode=block
content-length: 40243
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65469)
Size:   40243
Md5:    167ec0d46f57fb00494a84e783c5c5e4
Sha1:   47601f21c3974edb503b0509143978b64049affb
Sha256: 6d95d63d1bfca8c205c2f6d4487c9bc63c5b229b2abb3d8b14ca25bed949ec4b
                                        
                                            GET /47c41b0c4f3753646af9b0e10dfd7be6f02b99db.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "eea2c190fa6c75b8568cff2969365888-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ1203WPJ6T12X4F4NS
x-xss-protection: 1; mode=block
content-length: 6218
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (16666)
Size:   6218
Md5:    5c4e7e14f8659373e45400cf68c97a41
Sha1:   a2df475919893462415902ab0da086acc4f77033
Sha256: 58b06d80fbd4927e361ce301821f790c35782282eb6943dc9ce6b786ec63b352
                                        
                                            GET /app.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "efc56438502dc0b09b588bf8cc771969-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ05TFV58CVSQ46QZFS
x-xss-protection: 1; mode=block
content-length: 14841
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (51500)
Size:   14841
Md5:    ec592e8e4f9763adef6b0b99b3cd7b0e
Sha1:   01d801875af7b18e8192078e990957b880191d03
Sha256: 962058ff21e777eb4c6aa82fbfc08c07aaab0a154ba037be60b82ddbcfcff9f0
                                        
                                            GET /dc6a8720040df98778fe970bf6c000a41750d3ae.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "12d1763d5f10d67e3fe2f9f00b96b2e8-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ0MW20RGF80WYJ67PB
x-xss-protection: 1; mode=block
content-length: 4159
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (11901)
Size:   4159
Md5:    bdd2aabfa66e96632039b2b607303c00
Sha1:   10a2e1d4f025f11bec61554fbd05cae1a44e6815
Sha256: 2a6d67c657a631152b3370590574a1fc84e28c01a1585104d85a2ac37860e876
                                        
                                            GET /7bdf0be5c8efe81cdad9ba3761024df107bef3b0.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "a6e0802faefeef3a99043c2daddd096f-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ2PR8DP6QTG5FC6AS8
x-xss-protection: 1; mode=block
content-length: 2937
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (6980)
Size:   2937
Md5:    4befa7048021cd47bd7c590f8219a114
Sha1:   77130fee3b5db4ff69ac115ba6392d9fbb8158a6
Sha256: ddb556400e35de0261e5bf2d35dbf9d494d203f570c05d88d61f580f9c7ccfa0
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /component---src-templates-leo-universe-index-jsx.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "79b5cfeb3602b5f1350c673c66c0d012-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ4PJP6E5R0RYMXY8ZY
x-xss-protection: 1; mode=block
content-length: 2414
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (5773)
Size:   2414
Md5:    c57f16f798f8bc3c281b33d6b29ab370
Sha1:   3608bcc2dfdd1261e8c6cd9bf43067a46c2fd8cf
Sha256: 337ee0d4a4c804aa58d7681b79a7e25f01d1b2d29de515ba3c6295632cdee006
                                        
                                            GET /page-data/sq/d/2280590532.json HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/json
                                        
accept-ranges: bytes
age: 35455
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:08:32 GMT
etag: "c3d3020a60483e49003046575338d2ec-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQVC2072RHH046SC8F3
x-xss-protection: 1; mode=block
content-length: 1967
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (13497), with no line terminators
Size:   1967
Md5:    e22316dbcf2a47b859c058ac09cd0af6
Sha1:   72d3c497ba01bd8c00e6a29d86eee932d0f3387f
Sha256: 33e0c22a52a4bc9902444b40a46512265ac381ca0092ccadfe820149a9b107cb
                                        
                                            GET /page-data/app-data.json HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/json
                                        
accept-ranges: bytes
age: 35455
cache-control: public, max-age=0, must-revalidate
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:08:32 GMT
etag: "f610b5b94695f446d38a29bb24af70cb-ssl"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQV4F274QN5Y2RW207T
x-xss-protection: 1; mode=block
content-length: 50
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text
Size:   50
Md5:    26bbc30fb95a59f85a4c4ea44452a800
Sha1:   26ce9c4a4cccd5400d9d6661a8129ba9d90bba28
Sha256: f813c77f52799503d269af274d016ca0ccb1704c7d08fd408f5f0c31d1cb992c
                                        
                                            GET /8e399fed3a6b1522e3959e34b00067a9519e807d.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "1a90c3703ecfdf94ffc928c21cf5a9be-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ39SPBT2N9NRC02EJ8
x-xss-protection: 1; mode=block
content-length: 33010
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   33010
Md5:    464e51d8049dceec3f4ba74d397009d9
Sha1:   843aba9ccf65310a3656f849667c09c73cf7e2eb
Sha256: 3fb00de7e29f0471f9c3debd72685ae639ba102e6fdef3e40edcd763977bd034
                                        
                                            GET /ff324cc4fcad5c37469103212758a68962a91703.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "33dd56650a8aed1c381ced478717e4b1-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ2PN9SM26WHF12P1Z5
x-xss-protection: 1; mode=block
content-length: 100094
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65236)
Size:   100094
Md5:    ad88f25650fae49a89fdea1db069a4b8
Sha1:   945d798c5c411c31717244ac1e79877005511e86
Sha256: 859f0841a883e48ffed94f52e3fa2b98a32f62105033550705d2ccd9a7e12056
                                        
                                            GET /05901c0cdc340371e5e64de460e805993147c75a.js HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
accept-ranges: bytes
age: 27643
cache-control: public,max-age=31536000,immutable
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 20:18:44 GMT
etag: "755b1d2e18b38895cd0871f0a1973e3d-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQ3CFBBZR0HGRDSQT9Q
x-xss-protection: 1; mode=block
content-length: 46547
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65438)
Size:   46547
Md5:    44deeb76a98ab386414deb34d45028c0
Sha1:   24954a1197a9ad874069f66729f0478b7e708b6c
Sha256: 9c5bb1b1fa4bfa6b160707e53e54c5634b45effc8d9a2ec4b4e143fc8aa6101e
                                        
                                            GET /page-data/no/mc-livecasino/page-data.json HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/json
                                        
accept-ranges: bytes
age: 35598
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:06:09 GMT
etag: "e2f99e4bcb86868a0950cbca18f9033b-ssl-df"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAQVW296P4KG8RZSNPGT
x-xss-protection: 1; mode=block
content-length: 8566
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with very long lines (24270), with no line terminators
Size:   8566
Md5:    443da80a18079443a88af2a536cbf82c
Sha1:   e9a66d635df402b52f00515f6eae01097544fa2e
Sha256: 52fe0ff6c2c2c29b4818260acb0b1eb3786b2093eb6c48c418d62ff4f1108cdf
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: J6mufwpNZs0Bg9w0Hs7mHg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.13.173.34
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: qz17yzV5IiVAfs3OuusoAnWTvKo=

                                        
                                            GET /page-data/app-data.json HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: application/json
                                        
accept-ranges: bytes
age: 35455
cache-control: public, max-age=0, must-revalidate
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:08:32 GMT
etag: "f610b5b94695f446d38a29bb24af70cb-ssl"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAT7639YFQVNCEHPMWT1
x-xss-protection: 1; mode=block
content-length: 50
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text
Size:   50
Md5:    26bbc30fb95a59f85a4c4ea44452a800
Sha1:   26ce9c4a4cccd5400d9d6661a8129ba9d90bba28
Sha256: f813c77f52799503d269af274d016ca0ccb1704c7d08fd408f5f0c31d1cb992c
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4340
Cache-Control: max-age=108086
Date: Tue, 06 Dec 2022 03:59:27 GMT
Etag: "638db061-1d7"
Expires: Wed, 07 Dec 2022 10:00:53 GMT
Last-Modified: Mon, 05 Dec 2022 08:48:33 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /page-data/no/mc-livecasino/page-data.json HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
If-None-Match: "e2f99e4bcb86868a0950cbca18f9033b-ssl-df"
TE: trailers

search
                                         34.159.75.132
HTTP/2 304 Not Modified
                                        
cache-control: public, max-age=0, must-revalidate
date: Tue, 06 Dec 2022 03:59:27 GMT
etag: "e2f99e4bcb86868a0950cbca18f9033b-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01GKJSDAW3RJRQT8YPTPEQC10Y
X-Firefox-Spdy: h2

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://promo.leovegas.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 30 Nov 2022 19:33:54 GMT
expires: Thu, 30 Nov 2023 19:33:54 GMT
cache-control: public, max-age=31536000
age: 462333
last-modified: Wed, 11 May 2022 19:24:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Size:   15744
Md5:    15d9f621c3bd1599f0169dcf0bd5e63e
Sha1:   7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
Sha256: f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://promo.leovegas.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 30 Nov 2022 19:34:15 GMT
expires: Thu, 30 Nov 2023 19:34:15 GMT
cache-control: public, max-age=31536000
age: 462312
last-modified: Wed, 11 May 2022 19:24:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Size:   15860
Md5:    e9f5aaf547f165386cd313b995dddd8e
Sha1:   acdef5603c2387b0e5bffd744b679a24a8bc1968
Sha256: f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
                                        
                                            GET /s/robotoslab/v24/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://promo.leovegas.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 32860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 04 Dec 2022 01:48:55 GMT
expires: Mon, 04 Dec 2023 01:48:55 GMT
cache-control: public, max-age=31536000
age: 180632
last-modified: Mon, 11 Jul 2022 19:12:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 32860, version 1.0\012- data
Size:   32860
Md5:    d010a9f2d5c7a0374b3b84706a43d2ec
Sha1:   c1fe465db08785c3f115555d39db23838960cb66
Sha256: 9a3993918629dfd6a59c4563e9b4d464152b51d4113957ab8ebfbdcbcdc7f536
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4340
Cache-Control: max-age=108086
Date: Tue, 06 Dec 2022 03:59:27 GMT
Etag: "638db061-1d7"
Expires: Wed, 07 Dec 2022 10:00:53 GMT
Last-Modified: Mon, 05 Dec 2022 08:48:33 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /gtm.js?id=GTM-WGS5KD HTTP/1.1 
Host: sgtm.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site

search
                                         34.107.236.224
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
server: nginx/1.23.2
date: Tue, 06 Dec 2022 03:59:27 GMT
vary: Accept-Encoding
cache-control: private, max-age=900
expires: Tue, 06 Dec 2022 04:14:09 GMT
last-modified: Tue, 06 Dec 2022 03:00:00 GMT
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   94289
Md5:    ed9995e5c4de8eaa12a52b039ec49bef
Sha1:   8def2ae63d8520452c0de5f2e6c8df22ae25552a
Sha256: 1e4b88637bdbeaf66f89b3e80c2cc596069e1d806b7d53f6a6d8441c8f058973
                                        
                                            GET /favicons/apple-touch-icon-180x180.png HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
age: 35327
cache-control: public, max-age=0, must-revalidate
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:10:40 GMT
etag: "f615bc63b95404cf50521990d16061da-ssl"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAZTD73S7TFCH5X9STB7
x-xss-protection: 1; mode=block
content-length: 39348
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Size:   39348
Md5:    1d677d2696a6decac62f6ae6702110e6
Sha1:   330819e2d40298fe76abf3b0a5b94365e48f043e
Sha256: 80ffeb0c1602f33c10915cee07509fd9bc89368bb7d423cd586c684aed55ce0a
                                        
                                            GET /favicons/favicon-16x16.png HTTP/1.1 
Host: promo.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://promo.leovegas.com/no/mc-livecasino?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670292828.1.0.1670292835.0.0.0; _ga=GA1.2.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjpmYWxzZX0=; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         34.159.75.132
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
age: 34043
cache-control: public, max-age=0, must-revalidate
content-security-policy: frame-ancestors 'self' https://optimize.google.com
date: Mon, 05 Dec 2022 18:32:04 GMT
etag: "6208a9cbcd043a27a0542191e11cd3e4-ssl"
referrer-policy: same-origin
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01GKJSDAZTCAZGWWT4D24HVXRG
x-xss-protection: 1; mode=block
content-length: 950
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Size:   950
Md5:    a4d8c288ccfff5eed3db7050117eb6a5
Sha1:   4873ff662ffd8fed661fac12bf2edb25188a2d4e
Sha256: 710d82b385bbc48af160251f0b4444b7065d8bc6df0afaaa13fbf2e04356fe0d
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gtm/optimize.js?id=OPT-K5XRHTM HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.110
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 06 Dec 2022 03:59:27 GMT
expires: Tue, 06 Dec 2022 03:59:27 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 46839
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2698)
Size:   46839
Md5:    c3a81b71bf7a5325c16533ca531b34d2
Sha1:   c5306cc3d91a983c654958fd9dc6ab508b38c424
Sha256: 47e6e6a9ffca5358fd5fc2a0674855619ee76c73682f94240f4907ecba3346b1
                                        
                                            GET /modules.d53d96d4fefc0e537bd8.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.68
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 68700
date: Mon, 05 Dec 2022 14:58:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "6f3e85a9867f8c1e87f393ee1344782f"
last-modified: Mon, 05 Dec 2022 14:57:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2afd697fc5d0058ea30d6c4b939e714c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: TMo0URd-rDWaG0BcwQxpmN1kBSxj2w2tYIBhyr7-tAe2GNaDEbUCoQ==
age: 46881
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (48714)
Size:   68700
Md5:    6f3e85a9867f8c1e87f393ee1344782f
Sha1:   9a3e0b1e33cd0bca903fbdb82e43aa71ec23d165
Sha256: 80cf78eadecdac25834fa2be80c9a96f5eba43069c0295d800ec8d14123f7fba
                                        
                                            GET /c/hotjar-380080.js?sv=7 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.54
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
date: Tue, 06 Dec 2022 03:58:42 GMT
cache-control: max-age=60
etag: W/789519ecdbae8dc663b18295412ebba7
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Qit1KVHyvhceiyyAURBb-c8yp7qeQmwwNU9vUDSJ9bMnYQvD44O4Mw==
age: 45
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   78107
Md5:    bec50fd93de1652fecd84c43761ac750
Sha1:   85f1824d2074bc3a9847dc5ee162de51e3dcbb42
Sha256: 4a7762a8244c25b988572f7c6e765cbbff57a6d88223a408f5d6140bc0c565de
                                        
                                            GET /box-5e66f98b4ee957db209dc6f63e3d59dd.html HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.55.118
HTTP/2 200 OK
content-type: text/html
                                        
content-length: 1035
date: Wed, 23 Nov 2022 13:10:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: LSNtpX8paOpsno-WKiCaC2leitjYNlZ4hbHR6DiW0yrO3HomM6_b4g==
age: 1090162
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Size:   1035
Md5:    e0652b84b7b3b650769c759fc520c3f8
Sha1:   0b55d6e28613350c7f41b88f19e726e6751ad03b
Sha256: 94b4c240f83065223dcacdd3f8b69cb229d0616edc3e2041eef3e270d859fc3d
                                        
                                            GET /sessions/380080?s=0.25&r=0.08147389666193716 HTTP/1.1 
Host: vc.hotjar.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://promo.leovegas.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.91
HTTP/2 204 No Content
                                        
access-control-allow-origin: *
cache-control: no-store
date: Tue, 06 Dec 2022 03:59:28 GMT
server: Python/3.7 aiohttp/3.5.4
x-cache: Miss from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5tNyof0cmb6WMBT3mjonLFO1URKIpU_JxyU_EqaWhFKtHHNmratVmw==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  gzip compressed data, from Unix\012- data
Size:   20072
Md5:    20b960c6754993b9de987b955a09ae54
Sha1:   702d246038b2d92584f56a7cff4ec23803c043f2
Sha256: ec17f7b91e257be50c2482a2af1f966d195c9a0a8f63a3fcd3ca5907b273c296
                                        
                                            GET /kijvoxi4q0zn/2iAjKx7BVB0peDlsYR6ZWZ/25d3852a638962f07b3a309c578fb221/LV_LP_desktop_LiveCasino_LPupdate_NO_Affiliates_D90196_RF_102022.jpg?w=1920&h=1080&q=50&fm=webp HTTP/1.1 
Host: images.ctfassets.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.77
HTTP/2 200 OK
content-type: image/webp
                                        
content-length: 93882
last-modified: Fri, 11 Nov 2022 12:43:16 GMT
server: Contentful Images API
access-control-allow-origin: *
date: Mon, 05 Dec 2022 05:17:05 GMT
cache-control: max-age=31536000
etag: "7ae24e8aa6154835684d65e7a288af63"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: VWhzWm-qyYomT1QxeBbVxf7VmOJdl8eJPZhq9h-L-JI6kVK3Q4Yl2w==
age: 81772
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   93882
Md5:    7ae24e8aa6154835684d65e7a288af63
Sha1:   470b516dc32dd2cf03260e98a56ee035479bfd80
Sha256: 5daea65e65c03202b0aa2ca21fadab1ea769abe71de3b0ae294f9fc803b04122
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E3CC6CC02F1FFA0BF1310190E4DD11DC2751FE09CFB2855A4DCBA6CD286476F2"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7371
Expires: Tue, 06 Dec 2022 06:02:19 GMT
Date: Tue, 06 Dec 2022 03:59:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E3CC6CC02F1FFA0BF1310190E4DD11DC2751FE09CFB2855A4DCBA6CD286476F2"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7371
Expires: Tue, 06 Dec 2022 06:02:19 GMT
Date: Tue, 06 Dec 2022 03:59:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2722
Expires: Tue, 06 Dec 2022 04:44:50 GMT
Date: Tue, 06 Dec 2022 03:59:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2722
Expires: Tue, 06 Dec 2022 04:44:50 GMT
Date: Tue, 06 Dec 2022 03:59:28 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2722
Expires: Tue, 06 Dec 2022 04:44:50 GMT
Date: Tue, 06 Dec 2022 03:59:28 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffbcb6f9-483c-4254-9451-927fa2fc2294.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3968
x-amzn-requestid: 55111bc4-d002-44a0-855a-533251b144fb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSveGo_IAMFQvA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64c9-28e0a83d7f9f1ffc7544bb3d;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:17 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: _Hf2XblY73dHIIWTqWgeDzJJalBo6ooCAit1eQ8G8n4385ORBBDakA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:47:06 GMT
etag: "1c95a1e47e903cc6775df2c5ed3f2f58cca42dc8"
age: 22342
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3968
Md5:    9838b65dde746487c806ee9739f8b222
Sha1:   1c95a1e47e903cc6775df2c5ed3f2f58cca42dc8
Sha256: cf3ddc240b33d0f588d5acb30593b6846874a192bff9f5b69455877d7f63be53
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11469
x-amzn-requestid: f60a3f0d-38f7-4f82-bdd5-9e31814ab1d9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSuZGAXIAMFwuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64c2-5b4b99e779a0aaa71a311a1c;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:10 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: bWcuXixVA50JUynSO7ar3nWfjsTa5iOteSYq88bWPlQvz__1qfv7Uw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:41:49 GMT
age: 22659
etag: "a862b74508113ae72b56b9b3de0c75ba559b9032"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11469
Md5:    5529617b0748f2d8c82ef99c1ac116a8
Sha1:   a862b74508113ae72b56b9b3de0c75ba559b9032
Sha256: 376a82ae4a5b80f59fb746be79bca569b03a74c345845c7bbf15189964b0bb96
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11224
x-amzn-requestid: 938de0b8-1055-4416-9ad7-162ab5f4db9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csUINEwdoAMFuOw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e6701-38b079ef341bb17e567de773;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:47:45 GMT
x-amz-cf-pop: YVR50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tGtiCE9C3j0BUruNaFN2j1mKxCSouLmocmTXpmLMBJaLNyVwkXu1gQ==
via: 1.1 f0ac467993db44dbfc36b778dfcaf73c.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:09:28 GMT
age: 21000
etag: "36082b7329d473829178f280cb71a83b1531e486"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11224
Md5:    b15136d60fd0a5e0f657a4f5c75d540f
Sha1:   36082b7329d473829178f280cb71a83b1531e486
Sha256: 79478269b1f5dcfd1e45ccd4264fa44805b37c5c8fec820bcbd2fa1689dfbbd8
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa99f7bcf-386e-4655-b6f0-99abdf67f097.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8469
x-amzn-requestid: c17eff92-da62-4f0f-9e75-2741012ec43a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_sqFSjoAMFQ6w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d131d-61d61d2f0bb01ecb21b809ea;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TKSlCefkyQ7VDufJJOh1D7zhioft93jfOsoXxTD4ncAK5ktxlPvIoA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:52:07 GMT
age: 22041
etag: "ff254a1df087d2c157d88a6ef04e395dc49efe5e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8469
Md5:    2f60a6490f38a772dcd50a1132e98e1b
Sha1:   ff254a1df087d2c157d88a6ef04e395dc49efe5e
Sha256: 653e40becd103cd76cc2f194a87e933e8c548d346f87520fefca3b16430fc4ab
                                        
                                            GET /css2?family=Roboto+Slab:wght@400;700&family=Roboto:ital,wght@0,400;0,500;0,700;1,400;1,500;1,700&display=swap HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.106
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 06 Dec 2022 03:59:27 GMT
date: Tue, 06 Dec 2022 03:59:27 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   5820
Md5:    4fabcfaa4549f1d2ac2cd598d48713fa
Sha1:   5b4d535d2c7e1d0464ed3d5482509db3e68dff04
Sha256: ed3b72deb22fe3bbe38c65374a407b6ce37898da7c3331cb908ebd751162a7d0
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc696fe00-4af0-41c0-a10e-ba5dcc55c22b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6920
x-amzn-requestid: 05ec2698-a5ee-4046-be77-0036755f2946
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSwaEd-IAMF_-Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64cf-783b236b79b1e9ba22098cb2;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:23 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: RF_AmYN7VQghDpDX6kEyBEBZtvR8dfLpwuqk75bGpn8q2OMc46lVgA==
via: 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:48:31 GMT
age: 22257
etag: "b76ea6ae9df756f131ec16b01cdc7ab19b2d01be"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6920
Md5:    f4193f05dfd1de8bf795f433d4387243
Sha1:   b76ea6ae9df756f131ec16b01cdc7ab19b2d01be
Sha256: b56231f3c788519751528b849a442d5c7ed828ea4ce3321fd629ca27440ea6e3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5242
Cache-Control: max-age=168436
Date: Tue, 06 Dec 2022 03:59:28 GMT
Etag: "638e989a-1d7"
Expires: Thu, 08 Dec 2022 02:46:44 GMT
Last-Modified: Tue, 06 Dec 2022 01:19:22 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-25600410-30&cid=1084551185.1670292829&jid=1122368931&_gid=1275176805.1670292829&gjid=121983542&_v=j98&z=109903538 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         64.233.165.155
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
location: https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-25600410-30&cid=1084551185.1670292829&jid=1122368931&_v=j98&z=109903538
access-control-allow-origin: null
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 06 Dec 2022 03:59:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 367
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   367
Md5:    37543bf110f520cc5fe236dc81c6a816
Sha1:   8ff08746384140576217b2bb5f007dbd8af25e2b
Sha256: 51a34504b0cebca307b87e9eb55090975e8704782ef22343b264ab43b666e1f1
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-25600410-30&cid=1084551185.1670292829&jid=1122368931&_v=j98&z=109903538 HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.132
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 03:59:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-25600410-30&cid=1084551185.1670292829&jid=1122368931&_v=j98&z=109903538&slf_rd=1&random=1757866586
access-control-allow-origin: null
access-control-allow-credentials: true
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-25600410-30&cid=1084551185.1670292829&jid=1122368931&_v=j98&z=109903538&slf_rd=1&random=1757866586 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.67
HTTP/2 200 OK
content-type: image/gif
                                        
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Dec 2022 03:59:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: null
access-control-allow-credentials: true
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 06 Dec 2022 03:59:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6aff31b2-ef3e-4782-ae28-38f9aee8b1b7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5995
x-amzn-requestid: 25b34277-c486-4642-aea7-21e0598babc3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSzOGGjoAMF4kw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64e1-6f43ab8e0c1a5260327bce11;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YzpOZW9e-54LuSSOigtmFRb0sUGpIRpqZ-UtINp-B_Uzk6lFPnb6dw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:25:46 GMT
age: 20029
etag: "5979d7dc3ba0eb61947282a4adeac8208b4148ae"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5995
Md5:    3801236dc22938e1cc18947e90ea5326
Sha1:   5979d7dc3ba0eb61947282a4adeac8208b4148ae
Sha256: 3bd4eab29590ec3c316597abd2be65281cd9a6137add037ad57c093f1fca12e2
                                        
                                            GET /set-affiliate-domain-cookie?btag=100665320_E73026BEFC39467E95AEF1AD94E37D12&rdk=rk1&pid=3748557&bid=13362&lobby=livecasino HTTP/1.1 
Host: www.leovegas.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a3748557%2c%22BID%22%3a13362%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1670292830368)%5c%2f%22%2c%22CookieTag%22%3a%22133623748557451240919C2022126213%22%7d%5d; NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222740371772%7c1%22%7d%5d; _ga_R99CHBN90V=GS1.1.1670299165.2.0.1670299165.0.0.0; _ga=GA1.1.1084551185.1670292829; FPLC=Ib%2FgV5xs7flOBLIwWY1pqj0d6k%2Bme7Eil%2F5UnessM0KtnxLKe2mB6v1TYvPAS2cHFhI1pIC86jPwicEdh2JiY5%2BtXuHfM6eAWBblUw9qCZ6kI2bxzmzUFHVs5ua3kQ%3D%3D; FPID=FPID2.2.9rqLtyWlB6%2FNYZKtiNXkNk%2BNb%2BwjOog2FLVIK%2F%2FE3Ko%3D.1670292829; _gid=GA1.2.1275176805.1670292829; _hjSessionUser_380080=eyJpZCI6ImYzYjExMTAxLWFiMTUtNThkNS04MjUzLWE4ZTEwNjRiZDgxMiIsImNyZWF0ZWQiOjE2NzAyOTI4Mjg5MzAsImV4aXN0aW5nIjp0cnVlfQ==; leobtag=100665320_35A5004E45BB482282CD60BE357ACC8F; leonrpid=3748557; leonrbid=13362; leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; visid_incap_846569=WW+HQlMoTLGQy/pkEnv5UF+ljmMAAAAAQUIPAAAAAABOayIL4Wnoa2ouLeGikDCn; _hjSession_380080=eyJpZCI6ImJiMjc4ZWU3LTBkMTctNDk2ZS04MjZkLTBlNjA3YmY5MDBmYSIsImNyZWF0ZWQiOjE2NzAyOTkxNjUzNTAsImluU2FtcGxlIjpmYWxzZX0=; _hjAbsoluteSessionInProgress=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site

search
                                         107.154.248.168
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                        
server: nginx
date: Tue, 06 Dec 2022 03:59:28 GMT
content-encoding: gzip
set-cookie: leobtag=100665320_E73026BEFC39467E95AEF1AD94E37D12; Max-Age=3888000; Domain=.leovegas.com; Path=/; HttpOnly; Secure leonrpid=3748557; Max-Age=3888000; Domain=.leovegas.com; Path=/; HttpOnly; Secure leonrbid=13362; Max-Age=3888000; Domain=.leovegas.com; Path=/; HttpOnly; Secure leonrmeta=[{"value":"rk1","key":"rdk"},{"value":"livecasino","key":"lobby"}]; Max-Age=3888000; Domain=.leovegas.com; Path=/; HttpOnly; Secure nlbi_846569=+9VzR4zHuCd3CGeKTJV9qQAAAAA/ToplbzabFycO7qlwoG/l; path=/; Domain=.leovegas.com; Secure; SameSite=None incap_ses_722_846569=13i7HH+Rqx2rtsTsFxAFCiC+jmMAAAAAxOe6nAY4k2ycW8hFrHGiZw==; path=/; Domain=.leovegas.com; Secure; SameSite=None
strict-transport-security: max-age=63072000;
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: frame-ancestors 'self' *.leovegas.com *.casinomodule.com *.yggdrasilgaming.com *.evolutiongaming.com *.gameassists.co.uk *.gameassists.dk *.rgsgames.com *.wagerworks.com *.adform.com *.livetables.io *.regily.com *.casinoalternativen.com *.onlinecasinobonus24.xyz *.livetableshu.com
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cdn: Imperva
x-iinfo: 11-61242588-61242591 NNNY CT(1 10 0) RT(1670299168546 36) q(0 0 0 -1) r(1 1) U12
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /_geofetch HTTP/1.1 
Host: leo-promo-redirect-service.leo-prod-common.lvg-tech.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://promo.leovegas.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.190.191
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-allow-methods: OPTIONS, GET
access-control-max-age: 3600
date: Tue, 06 Dec 2022 03:59:28 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bundles/3a60bb6a829d13f7c019df18e77514f50ca92ed6.js HTTP/1.1 
Host: d33wubrfki0l68.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.42.80
HTTP/2 200 OK
content-type: application/javascript
                                        
accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=31556926
content-encoding: gzip
date: Fri, 02 Dec 2022 10:49:37 GMT
etag: 66f93c87163e873e252c560c1a9704ceaf34ec82-df
server: Netlify
x-nf-request-id: 01GK979FR7N73YRV2MWGMJCPAZ
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: e9RExJiqBeEvMkS6Whf6DHaeOyES-KtRLh-MrTtTOkHwltrLWoaBmA==
age: 320990
X-Firefox-Spdy: h2


--- Additional Info ---