Overview

URL newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
IP185.128.34.116
ASNEurofiber Nederland BV
Location Netherlands
Report completed2022-09-23 08:38:31 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-23 2 newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf Phishing
2022-09-23 2 newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf Phishing
2022-09-23 2 newsmartphoneoffer.com/landing-layouts/s/scripts/script.min.js Phishing
2022-09-23 2 newsmartphoneoffer.com/js/app.js Phishing
2022-09-23 2 newsmartphoneoffer.com/fonts/Oswald-Heavy/Oswald-Heavy.woff2 Phishing
2022-09-23 2 newsmartphoneoffer.com/service-worker.js Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

No files detected



Passive DNS (24)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-23 04:02:41 UTC 143.204.55.35
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-22 04:34:04 UTC 34.117.237.239
mnemonic passive DNS djjcyqvteia9v.cloudfront.net (1) 0 2022-05-03 11:35:38 UTC 2022-09-21 10:22:30 UTC 143.204.42.218 Unknown ranking
mnemonic passive DNS ocsp.digicert.com (7) 86 2012-05-21 07:02:23 UTC 2022-09-23 04:04:38 UTC 93.184.220.29
mnemonic passive DNS maxcdn.bootstrapcdn.com (3) 724 2014-06-18 00:37:31 UTC 2022-09-22 16:36:24 UTC 104.18.11.207
mnemonic passive DNS productsgiveaway-uk-342.com (3) 0 2020-01-15 14:40:40 UTC 2022-09-21 10:22:30 UTC 185.128.34.117 Unknown ranking
mnemonic passive DNS stats.g.doubleclick.net (1) 96 2013-06-02 22:47:44 UTC 2022-09-22 04:31:51 UTC 142.251.1.154
mnemonic passive DNS newsmartphoneoffer.com (16) 753567 2021-06-29 13:52:35 UTC 2022-09-23 08:38:14 UTC 185.128.34.116
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-09-22 14:28:12 UTC 34.120.237.76
mnemonic passive DNS trk-consulatu.com (1) 24695 2021-06-01 15:55:41 UTC 2022-09-22 19:52:39 UTC 172.64.169.3
mnemonic passive DNS click.fstrk.net (1) 376932 2018-06-15 12:09:35 UTC 2022-09-21 10:22:12 UTC 35.190.210.193
mnemonic passive DNS cdn.cloudcnt.com (7) 0 2019-06-08 13:22:17 UTC 2022-09-21 10:22:12 UTC 54.230.111.98 Unknown ranking
mnemonic passive DNS fonts.gstatic.com (1) 0 2014-08-29 13:43:22 UTC 2022-09-23 04:33:31 UTC 142.250.74.163 Domain (gstatic.com) ranked at: 540
mnemonic passive DNS www.google-analytics.com (1) 40 2012-10-03 01:04:21 UTC 2022-09-23 05:31:45 UTC 142.250.74.174
mnemonic passive DNS www.googletagmanager.com (1) 75 2012-12-25 14:52:06 UTC 2022-09-23 04:33:31 UTC 142.250.74.72
mnemonic passive DNS ocsp.pki.goog (7) 175 2017-06-14 07:23:31 UTC 2022-09-23 04:02:50 UTC 142.250.74.3
mnemonic passive DNS fonts.googleapis.com (1) 8877 2014-07-21 13:19:55 UTC 2022-09-23 04:02:55 UTC 142.250.74.10
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-09-23 05:06:00 UTC 143.204.55.115
mnemonic passive DNS code.jquery.com (1) 634 2012-05-21 17:28:02 UTC 2022-09-22 04:34:12 UTC 69.16.175.10
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-23 05:02:25 UTC 54.148.228.45
mnemonic passive DNS ocsp.sca1b.amazontrust.com (4) 1015 2017-03-03 15:20:51 UTC 2019-03-27 04:05:54 UTC 143.204.42.88
mnemonic passive DNS event.trk-consulatu.com (4) 66859 2021-07-17 12:05:02 UTC 2022-09-22 19:52:40 UTC 172.64.169.3
mnemonic passive DNS fstrk.net (1) 300513 2019-10-01 12:43:17 UTC 2022-09-21 10:22:30 UTC 143.204.55.28
mnemonic passive DNS r3.o.lencr.org (6) 344 2020-12-02 08:52:13 UTC 2022-09-22 04:32:00 UTC 23.36.76.226


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 185.128.34.116

Date UQ / IDS / BL URL IP
2022-12-04 23:38:49 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/bksmr_uk_s 185.128.34.116
2022-11-28 18:17:06 +0000
0 - 0 - 8 votre-chercheur-de-prix.com/nl_be/ebike_benl_s_bc 185.128.34.116
2022-11-20 17:57:17 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/shn_uk_s 185.128.34.116
2022-11-09 11:44:36 +0000
0 - 0 - 6 win-be-prizesonline.com/nl_be/amz500_benl_s 185.128.34.116
2022-11-04 14:00:32 +0000
0 - 0 - 2 ganaproductos.com/netf-es-s 185.128.34.116

Last 5 reports on ASN: Eurofiber Nederland BV

Date UQ / IDS / BL URL IP
2022-12-04 23:38:49 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/bksmr_uk_s 185.128.34.116
2022-11-28 18:17:06 +0000
0 - 0 - 8 votre-chercheur-de-prix.com/nl_be/ebike_benl_s_bc 185.128.34.116
2022-11-20 17:57:17 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/shn_uk_s 185.128.34.116
2022-11-09 11:44:36 +0000
0 - 0 - 6 win-be-prizesonline.com/nl_be/amz500_benl_s 185.128.34.116
2022-11-04 14:00:32 +0000
0 - 0 - 2 ganaproductos.com/netf-es-s 185.128.34.116

Last 5 reports on domain: newsmartphoneoffer.com

Date UQ / IDS / BL URL IP
2022-12-04 23:38:49 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/bksmr_uk_s 185.128.34.116
2022-11-20 17:57:17 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/shn_uk_s 185.128.34.116
2022-10-23 10:59:16 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/cfrdg_uk_s 185.128.34.116
2022-10-09 22:46:34 +0000
0 - 0 - 7 newsmartphoneoffer.com/mrs_uk_s 185.128.34.116
2022-10-08 21:09:58 +0000
0 - 0 - 7 newsmartphoneoffer.com/en_uk/SS22_uk_s 185.128.34.116

Last 1 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-09-21 10:22:22 +0000
0 - 0 - 6 newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf 185.128.34.116


JavaScript

Executed Scripts (15)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (78)


Request Response
                                        
                                            GET /en_uk/iphn14_uk_s_gf HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         185.128.34.116
HTTP/1.1 302 Found
Content-Type: text/html
                                        
Connection: close
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Location: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Content-Length: 169


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   169
Md5:    3a924587a03eb36516ba715c384e5267
Sha1:   a05c222768c2b7049ea9d8a745c582438b748ea3
Sha256: 7b1c95f117802a1767416994cc254fdfd7d2a105b58f25de5f9bd3f4660718cc

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 23 Sep 2022 08:14:07 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: xEcMNEn_UevRyVuOUyLX7lXI2nVgr-i739ZmKYSPNSfQN5_nBrrV1w==
Age: 1453


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "35BAAAE7B3CE3110EBB2B075881CFAB55ECF3EAB57D834283FD18AC691B41FA2"
Last-Modified: Tue, 20 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4363
Expires: Fri, 23 Sep 2022 09:51:03 GMT
Date: Fri, 23 Sep 2022 08:38:20 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.35
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 23 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: -Avag7l1wMA4LetQo0PKOwid7dmNhHTAyfwPS_B2td0J_D3p0yrbcA==
age: 14586
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 23 Sep 2022 08:38:20 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C358A49FFBA024DE5C6597C7AC9C811F35B2119883A535A63B581DE261C70D95"
Last-Modified: Wed, 21 Sep 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16822
Expires: Fri, 23 Sep 2022 13:18:42 GMT
Date: Fri, 23 Sep 2022 08:38:20 GMT
Connection: keep-alive

                                        
                                            GET /en_uk/iphn14_uk_s_gf HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache, private
Date: Fri, 23 Sep 2022 08:38:20 GMT
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; expires=Fri, 23-Sep-2022 09:38:20 GMT; Max-Age=3600; path=/ cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D; expires=Fri, 23-Sep-2022 09:38:20 GMT; Max-Age=3600; path=/; httponly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (13754)
Size:   27371
Md5:    48ccbf8e75991cce5aa6b8962bf361d0
Sha1:   abca9eb4e7fd1f0235f9de4821eaa70a551e1b0a
Sha256: 38dd944cabcb503a074d6f2e801f25bb0ede348c7c68aafd9a6908bc2e15eafd

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /styles/main.min.css HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cab5-1c7d"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (7292)
Size:   1514
Md5:    7e976ab25ce0cdba109ccf316add43f2
Sha1:   451128b9768b2b3356afdbc7b92b9ec7b4a79dc8
Sha256: 2b9d6fe51d6f1b50e777301cba99b4646860726140c4945cbb17ac314c9ae87e
                                        
                                            GET /EHawkTalon.js HTTP/1.1 
Host: djjcyqvteia9v.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.42.218
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 44465
server: Apache
x-frame-options: SAMEORIGIN
last-modified: Wed, 29 Jul 2020 14:14:29 GMT
accept-ranges: bytes
date: Fri, 26 Aug 2022 05:54:53 GMT
expires: Sun, 25 Sep 2022 05:54:53 GMT
cache-control: max-age=2592000
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: sU3KL1ZRi1Gjx7eT4EZagICO9-drJK15sF6VitsRgfF9CWEnQHh_Gw==
age: 2429008
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (31985)
Size:   44465
Md5:    94e7b422e861ef1c968c81a21965c22d
Sha1:   148f6107b034ea6275f48c8512b5387d183779db
Sha256: 54234f4ebe24f0a0058c5a4301ba3356fa0e138d3adfa12cac7b144667da104d
                                        
                                            GET /landing-layouts/s/styles/main.min.css HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cab5-3c63d"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   23786
Md5:    710e9ae8e2c814e3ce27419c7e3e8e0f
Sha1:   8e582b98e687dcebd974048afdf374654adfe333
Sha256: 2c80a337b9a27a5a8b495d6fe6a090a1c0541a5b4edda13689d8e86cb585aaae
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5856
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 07:00:45 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 278

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5856
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 07:00:45 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 278

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6444
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 06:50:57 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /jquery-3.3.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         69.16.175.10
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 23 Sep 2022 08:38:21 GMT
content-encoding: gzip
content-length: 30288
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-1538f"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1663922301.dop221.sk1.t,1663922301.cds237.sk1.hn,1663922301.cds072.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   30288
Md5:    d549b312f7a7d228b4ec229a6547dfdc
Sha1:   0766794582ad530ec0f8c2595f741086afffa312
Sha256: f6488b2915e0ceee723f4320492511d46c6ba1860d5975d085e6da8913f55f44
                                        
                                            GET /vendor/select2/select2.min.css HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Mon, 19 Sep 2022 20:05:51 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cb9f-3f88"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (16263)
Size:   2162
Md5:    bd3ea59ca12635e32402ec20cb196249
Sha1:   b1bfdaba4a00c2932245ff9eabea38016f9c9069
Sha256: b99f8f79de257275fdbf6a8e0eb4652b0d69429552234b1f444c08ae85000341
                                        
                                            GET /landing-layouts/s/scripts/script.min.js HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cab5-a0d8"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (343)
Size:   8114
Md5:    520d196e2e2943a9ae0a92e31a74edc5
Sha1:   d28ee656c956ef4997eb2102ce7cc52b56c5282f
Sha256: 23f22134f948270bf57cc144d9113cf46c02e27333095cde292491b8e9800a05

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5856
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 07:00:45 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1 
Host: maxcdn.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.18.11.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Fri, 23 Sep 2022 08:38:21 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: SE
cdn-edgestorageid: 722, 617
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 2021-03-10 20:26:20
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: 121d365db7a9aba3915641185d93b963
cdn-cache: HIT
cf-cache-status: HIT
age: 13233108
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 74f1f6adcb141bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (30837)
Size:   7448
Md5:    c2d412c969d95ca79fa082e2de32332a
Sha1:   e47f14b6e844288e7fe5d5737946d520c1fe7f90
Sha256: e0bc3b9e9d0288f596e0ff685795ed8640337e4407b6ea1d8866e1bc9edd6e95
                                        
                                            GET /gtag/js?id=UA-129693020-1 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.72
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 23 Sep 2022 08:38:21 GMT
expires: Fri, 23 Sep 2022 08:38:21 GMT
cache-control: private, max-age=900
last-modified: Fri, 23 Sep 2022 06:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 42225
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1720)
Size:   42225
Md5:    78dbacfc35dd568f50ec0bddc66c2fad
Sha1:   2ea431fbedd8504ec504f9ac9c3712e43625da25
Sha256: b0261e4a19e7850bce235284670144c5064d9de871f940d08413a55741cbd0a9
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /js/app.js HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Mon, 19 Sep 2022 20:05:51 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cb9f-edce7"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65473)
Size:   220735
Md5:    b5fc8042bc68dc89a684b431638321cd
Sha1:   bc3b6056b39c229edac736caaedea8dba3080c44
Sha256: 4efc72a6455341aae1e547abc155b3b15d56aa115d07dfbeaad1af9d2b6ad996

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /images/0c00e03e-3d13-4505-9829-a0dbbff595b8.png HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 6146
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Connection: keep-alive
ETag: "6328cab5-1802"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 240 x 120, 8-bit/color RGBA, non-interlaced\012- data
Size:   6146
Md5:    331f6ba1ae14bb60185d9d2626b3acd5
Sha1:   6b7a5e169052686e441d4909d4a98d60dc157db6
Sha256: d4769dc58bfeadce09cb4e7e6c0958d6602423d020b36ff0be54b60359689b90
                                        
                                            GET /landing-layouts/s/images/privacy_img.png HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 6553
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Connection: keep-alive
ETag: "6328cab5-1999"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 130 x 130, 8-bit colormap, non-interlaced\012- data
Size:   6553
Md5:    18d7bc31d40e63b3dd7c886c8bc1f5c2
Sha1:   419d4868455728ae20149170066c6b707de0df5a
Sha256: 13f9001dbfe4dfc8be808e3c382c47172604b1eb540db94e9221a13b7841272f
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=259200
Date: Fri, 23 Sep 2022 08:03:22 GMT
Expires: Fri, 23 Sep 2022 08:21:00 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: A0pLnmf7WGw73oi_Az1cliTcyye4ZQzZ6rIUuIar2C32d48pNstF6g==
Age: 2099


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /css?family=Montserrat:300,400,600|Open+Sans:300,500,600,700|Poppins:300,400,500,600,700,800,900 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.10
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 23 Sep 2022 08:38:21 GMT
date: Fri, 23 Sep 2022 08:38:21 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   1598
Md5:    b8005d1916eedcf8201ece30a95f0f3c
Sha1:   3efb07212f34d8aea2c19928a267183b6d105287
Sha256: d86d64f257ddc3618a27466cd267f79f05a151c4b41be5cebb3edb0295e6b9af
                                        
                                            GET /landings/14978/background-(28).jpg HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 72157
Last-Modified: Thu, 08 Sep 2022 10:34:29 GMT
Connection: keep-alive
ETag: "6319c535-119dd"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, components 3\012- data
Size:   72157
Md5:    43dece2887d205065e141d19bc991732
Sha1:   fd93b9ee6e21d1c722fa87602bb90a98c63e1502
Sha256: e7c4d93b66a306ad30cfddd6b061221faea4f64295dd3614dfa3242cfdf0b002
                                        
                                            GET /landings/14979/iphn14.png HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 178407
Last-Modified: Thu, 08 Sep 2022 10:34:29 GMT
Connection: keep-alive
ETag: "6319c535-2b8e7"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 650 x 400, 8-bit/color RGBA, non-interlaced\012- data
Size:   178407
Md5:    833b8a60ef839d0a55018014aeb38c75
Sha1:   0fe58282351ab640530c408a1a21d63bb3af954f
Sha256: c18f8488fa2fb17f1715551dc35a4b51e9d6c214645c181ddb7934efa22dc389
                                        
                                            GET /fonts/Oswald-Heavy/Oswald-Heavy.woff2 HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: application/octet-stream
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 30928
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Connection: keep-alive
ETag: "6328cab5-78d0"
Expires: Fri, 30 Sep 2022 08:38:21 GMT
Cache-Control: max-age=604800
Access-Control-Allow-Origin: *
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Size:   30928
Md5:    e3c37af374909525ba2e3462bc05540f
Sha1:   127ea8601da9fb256c39c30b3b726f4e37e2df52
Sha256: 33405d243b1d6b59763f933848f7d90ac96b0f820f560ca5f4e37e5dd7bfd261

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /landings/14980/iphn14.png HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 178407
Last-Modified: Thu, 08 Sep 2022 10:34:29 GMT
Connection: keep-alive
ETag: "6319c535-2b8e7"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 650 x 400, 8-bit/color RGBA, non-interlaced\012- data
Size:   178407
Md5:    833b8a60ef839d0a55018014aeb38c75
Sha1:   0fe58282351ab640530c408a1a21d63bb3af954f
Sha256: c18f8488fa2fb17f1715551dc35a4b51e9d6c214645c181ddb7934efa22dc389
                                        
                                            GET /landings/14981/iphn14.png HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 178407
Last-Modified: Thu, 08 Sep 2022 10:34:29 GMT
Connection: keep-alive
ETag: "6319c535-2b8e7"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 650 x 400, 8-bit/color RGBA, non-interlaced\012- data
Size:   178407
Md5:    833b8a60ef839d0a55018014aeb38c75
Sha1:   0fe58282351ab640530c408a1a21d63bb3af954f
Sha256: c18f8488fa2fb17f1715551dc35a4b51e9d6c214645c181ddb7934efa22dc389
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.163
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 44856
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 20 Sep 2022 08:31:01 GMT
expires: Wed, 20 Sep 2023 08:31:01 GMT
cache-control: public, max-age=31536000
age: 259640
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 44856, version 1.0\012- data
Size:   44856
Md5:    565ce506190ad3af920b40baf1794cec
Sha1:   ad3cba5d06100e09449a864d3b5e58403b478b3d
Sha256: 8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /en_uk/images/icons/favicon.ico HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://newsmartphoneoffer.com/en_uk/iphn14_uk_s_gf
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         185.128.34.116
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache, private
date: Fri, 23 Sep 2022 08:38:21 GMT
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size:   2123
Md5:    e881f8e66a93d0960ba6fad410094769
Sha1:   7f1bd10fd60815735fad95387ecaed0cfaf3b287
Sha256: b43a9db67408b4398f147b571163d5b272af8c46eb4dca9f1bc2be44a6ded26d
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 19826
date: Fri, 23 Sep 2022 06:41:09 GMT
expires: Fri, 23 Sep 2022 08:41:09 GMT
cache-control: public, max-age=7200
age: 7032
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   19826
Md5:    cae538dcce82598fbe43c0bf443e62dd
Sha1:   cc68ac6be9c5e0087a0000e5735b83270ace30f5
Sha256: 954b9e9d9744e1319c51760780a35de2dec353afffac705c2cca6d836a5e056d
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3452
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 07:40:49 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BE7B49E87A09195CD7CD42767C20A1AFB6F94B9B379047B1B8AABAC04C0205CA"
Last-Modified: Wed, 21 Sep 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Fri, 23 Sep 2022 14:38:21 GMT
Date: Fri, 23 Sep 2022 08:38:21 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: AFPU4NYajdvTWOXV36zUmQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         54.148.228.45
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: AKKPc7q6ZcA/eVKvMkVzY4JaINA=

                                        
                                            GET /en_uk/tr_iphn14_uk_s_gf?affid=preview HTTP/1.1 
Host: productsgiveaway-uk-342.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         185.128.34.117
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: https://newsmartphoneoffer.com
Set-Cookie: advanced-frontend=1pfpcls8hi1vdpp53f72349dun; path=/; HttpOnly visitId=a66c720731038cfef9d4763f65b28872c084d17865f095d510f70ace792142a4a%3A2%3A%7Bi%3A0%3Bs%3A7%3A%22visitId%22%3Bi%3A1%3Bs%3A32%3A%2286cab8d285127f78d380e04585b2921d%22%3B%7D; expires=Sun, 23-Oct-2022 08:38:21 GMT; Max-Age=2592000; path=/; HttpOnly _csrf-frontend=c618abe44f9fcc13f81f5c3cf5675e8e62a2ca50f69761852579f77be158d14fa%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22QpgKFvg6xMOgXqc0YvS_0uEQRVGTKoar%22%3B%7D; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10300)
Size:   28418
Md5:    3edc1cb8945d1fbc47e1853ceae9713e
Sha1:   818f1f1ac99da932526b0dfbaab68c18a42f9632
Sha256: 1250ce1f740157403adf3cbd5c8b758d94c66812597f70e71b8eda274442ef44
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-129693020-1&cid=435426713.1663922301&jid=1995193224&gjid=969590609&_gid=1177185025.1663922301&_u=aGBAAUACQAAAAC~&z=123129745 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         142.251.1.154
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://newsmartphoneoffer.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 23 Sep 2022 08:38:21 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  very short file (no magic)
Size:   1
Md5:    c4ca4238a0b923820dcc509a6f75849b
Sha1:   356a192b7913b04c54574d18c28d46e6395428ab
Sha256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        
                                            GET /sponsor?externalId=86cab8d285127f78d380e04585b2921d HTTP/1.1 
Host: productsgiveaway-uk-342.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         185.128.34.117
HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: https://newsmartphoneoffer.com
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  JSON data\012- HTML document, ASCII text, with very long lines (29768), with no line terminators
Size:   4977
Md5:    34b1df388136efc94fb69f7d881394ba
Sha1:   7376dfaa3871776625b3c5d454feeca55753e985
Sha256: ba5566e479bbb8ce76b7dc16123a990dac643fb1c172d316090954ce376d884a
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2407
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 07:58:14 GMT
Server: ECS (amb/6BC4)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /images/placeholder.png HTTP/1.1 
Host: productsgiveaway-uk-342.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         185.128.34.117
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:21 GMT
Content-Length: 30255
Last-Modified: Thu, 22 Sep 2022 10:12:24 GMT
Connection: keep-alive
ETag: "632c3508-762f"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 2400 x 2400, 8-bit grayscale, non-interlaced\012- data
Size:   30255
Md5:    efecd9d40367ec0d16517eccd2131f51
Sha1:   f62fb8a662c331a24c8f6ad67bdd9c80501b3ea5
Sha256: 93453aeb09ee83e223ec77a93aab60cbcf79be3436401817b49bf11093e6adc1
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:21 GMT
Last-Modified: Fri, 23 Sep 2022 08:07:30 GMT
Server: ECS (bsa/EB1A)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 2sWmAyZB47LbvqP6q70i_DvWKWEEqao03IqpSqZyMipliGk-3XAxdQ==
Age: 1851

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 23 Sep 2022 08:38:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:22 GMT
Last-Modified: Fri, 23 Sep 2022 08:09:19 GMT
Server: ECS (dcb/7F16)
X-Cache: Miss from cloudfront
Via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 3JU82T1O8poF_kNaHLWWxKDNiDmFcHDeCJK1HZxbOsGVrsL2zCpOnw==
Age: 1743

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:22 GMT
Last-Modified: Fri, 23 Sep 2022 08:37:15 GMT
Server: ECS (dcb/7F81)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: sKDBca7889W--AGI6wYPkCbLeixiY6f5wX5PPmKpvSqWt0FYLsi0AQ==
Age: 67

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0C458737B45F65A984B32A818B6706E919700A4203DDD9906457FFC87547C7C5"
Last-Modified: Wed, 21 Sep 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17045
Expires: Fri, 23 Sep 2022 13:22:27 GMT
Date: Fri, 23 Sep 2022 08:38:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2408
Cache-Control: 'max-age=158059'
Date: Fri, 23 Sep 2022 08:38:22 GMT
Last-Modified: Fri, 23 Sep 2022 07:58:14 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /service-worker.js HTTP/1.1 
Host: newsmartphoneoffer.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImVmU203SWFnL0VoOHlyZ3pLWGlOR3c9PSIsInZhbHVlIjoiWTY0NVBEanJwM0lKUVlxdnIrSVV1MGZ5UTMrSlpXMmpvSlpLYnZ1K2tEKyt2MDhZUEZ6bHhBeXlMeXVjMUtDaHVKd2U4RzFQU0JpdExaY1o0M0h0bjZLcW8zeER4SkJxZ2c3WUY4MGV5eXJkT1dOZU9LZXRkcTErMjRsbUZ1dkkiLCJtYWMiOiIyNmEzMGRmY2JmZGYxYWFjNDY0MGNkMGE5ZDE3YjAyYzk1ZWQxZDc5ZDlkZGU4NzQ0ZWEwOTJlOTdkMjFmYWZmIiwidGFnIjoiIn0%3D; cors_session=eyJpdiI6IkxQaG1KNDdjZnNtVU04aDl4S0lFNXc9PSIsInZhbHVlIjoiQldxL1NHMTE4SGtrM1M2cUlBb3BOR3Y0OHB0ekVmb0JEMm82K2w2d2k1UXpQbFB6UWgrYndjeGFsZkxIYktEYmtqazl5ZnFkQmtSV0ZQZEdPUHpvU084WWgwR2pPRWtSMXpyNm1MbGJ1eWNQUklJWE9LTU9rVi94OUpDbnZhSHoiLCJtYWMiOiIzN2I1NmE1MjAzNDYwMDQ1NDFlMmMxOGIzMWZkMGNjYWM2Y2Q5ZTI2OTQ0ZmIyODQ4ZGEzMTg2ZGYwODhhZTQ0IiwidGFnIjoiIn0%3D; _ga=GA1.2.435426713.1663922301; _gid=GA1.2.1177185025.1663922301; _gat_gtag_UA_129693020_1=1
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         185.128.34.116
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                        
Server: nginx
Date: Fri, 23 Sep 2022 08:38:22 GMT
Last-Modified: Mon, 19 Sep 2022 20:01:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6328cab5-10c"
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Encoding: gzip


--- Additional Info ---
Magic:  Java source, ASCII text
Size:   170
Md5:    6dc9aad8c0a0f0f17a0dd110ab15af19
Sha1:   3f8b295142373a5170b66a6b77f276e9b3e3f9e1
Sha256: 20095487f19c6e5482093159c3f020846dd7f3878ee426b11772ef7cf5a03be5

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=147864
Date: Fri, 23 Sep 2022 08:38:22 GMT
Etag: "632d0f16-1d7"
Expires: Sun, 25 Sep 2022 01:42:46 GMT
Last-Modified: Fri, 23 Sep 2022 01:42:46 GMT
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: e9LdWD6fDa8kP2vhiOPOl4PwvyZVggCoeiyGmHngOTzPtaCAcVeXdA==

                                        
                                            OPTIONS /register/event_log/4og3r318g3 HTTP/1.1 
Host: event.trk-consulatu.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://newsmartphoneoffer.com/
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         172.64.169.3
HTTP/2 200 OK
                                        
date: Fri, 23 Sep 2022 08:38:22 GMT
content-length: 0
access-control-allow-headers: content-type
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: https://newsmartphoneoffer.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-allow-methods: POST
access-control-max-age: 1800
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0FIYlUCyp4uxU6YQszmmXuFMk7qLnHLAov8MYJsLDNdEd%2FnhegE5Qcik5OUvWonEUimqcD%2FGVYZDA2pbt9MY6YPP%2BP5p0FCFaOJnCtuMI%2FyMMc4Bt46PsGsunIvH0BW5oFlLjb6J4tD6WQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74f1f6b89db68892-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            OPTIONS /register/event_log/4og3r318g3 HTTP/1.1 
Host: event.trk-consulatu.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://newsmartphoneoffer.com/
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         172.64.169.3
HTTP/2 200 OK
                                        
date: Fri, 23 Sep 2022 08:38:22 GMT
content-length: 0
access-control-allow-headers: content-type
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: https://newsmartphoneoffer.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-allow-methods: POST
access-control-max-age: 1800
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=17lq7gfWXlXrNaq613Shu4OUGcGrc64bFF1w8q4jrJlUJ%2FOI7fFLHXJHvXvpmms7HB3TcioWdSpBHkeokb5t2Acv3wUkzlozICj2%2F%2FbNqPC4EMJyRBXA482974iqnM2RBm%2FrYGQUpXd%2B%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74f1f6b89dc18892-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4164
Expires: Fri, 23 Sep 2022 09:47:47 GMT
Date: Fri, 23 Sep 2022 08:38:23 GMT
Connection: keep-alive

                                        
                                            POST /register/event_log/4og3r318g3 HTTP/1.1 
Host: event.trk-consulatu.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/json
Origin: https://newsmartphoneoffer.com
Content-Length: 148
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         172.64.169.3
HTTP/2 200 OK
                                        
date: Fri, 23 Sep 2022 08:38:23 GMT
content-length: 0
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-pushplatformapp-params:
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-pushplatformapp-alert: pushPlatformApp.pushSubscription.deleted
x-frame-options: DENY
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: https://newsmartphoneoffer.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4y50Qgq6qpWxr3VC3A3MPm0RGBVgaKSgsvmXurcnB26COaJy8KyMCsycefhQrsAEsHmqy8VppEPsVnoCg%2Bk%2FzQw5pLjiNluw0zciS4gTNDcNn4NVUauABCKB6tVtp8kIJ4HrUI6aQtNSog%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74f1f6b94efe8892-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /content/image/605d9d6a66c60.png?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/PNG
                                        
server: nginx
date: Fri, 23 Sep 2022 03:55:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: DA93F12HsGoWEpbwu4E-Gn4mpW5TkoSRTC_b8xyq6treLOhZexxPmQ==
age: 16990
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 300 x 156, 8-bit/color RGBA, non-interlaced\012- data
Size:   18648
Md5:    3106905c930fa80346a5f52df4c0328b
Sha1:   55ef36c02c02c43a5bad482c9f597d0737d35d03
Sha256: c805bea807f5f702176ba3df70397871462599b77ad8b5b1b3cf26bec7c38035
                                        
                                            GET /content/image/622f468f2ddb6.png?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/PNG
                                        
server: nginx
date: Thu, 22 Sep 2022 05:38:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 8j4EWVPkkVo0s0iy9NZ7jsNuepveP0zUUure7wLuqM3xWVr3rNho1A==
age: 97191
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 300 x 59, 8-bit/color RGBA, non-interlaced\012- data
Size:   21708
Md5:    cb741fbc079ebfb53822f15df5b2937a
Sha1:   cb404d9b98339c62a1f96172dd1de004d45418fb
Sha256: 16747be46d7a02c8fac0900819bde0c41da080b9a3af5cddf16fbcb42b3dcd28
                                        
                                            POST /register/event_log/4og3r318g3 HTTP/1.1 
Host: event.trk-consulatu.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/json
Origin: https://newsmartphoneoffer.com
Content-Length: 109
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         172.64.169.3
HTTP/2 200 OK
                                        
date: Fri, 23 Sep 2022 08:38:23 GMT
content-length: 0
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-pushplatformapp-params:
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-pushplatformapp-alert: pushPlatformApp.pushSubscription.deleted
x-frame-options: DENY
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: https://newsmartphoneoffer.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yqhkJT6Jow%2BjBE2PhdwngeiuAtyTRztdGVmV%2Fl8CJ%2FDF%2BfI0GRSBCieu%2BAomahLnzXMFJtQanyVDQAujMJ2e54i5BdS7%2Bv4QeCkEA5FdcwBFNdnyeWCpM97BWqztwryd5MjsaApPvs9MNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74f1f6b96f248892-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4164
Expires: Fri, 23 Sep 2022 09:47:47 GMT
Date: Fri, 23 Sep 2022 08:38:23 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9bb1df1b-7300-4e0d-ad7a-6e90b6c03299.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12538
x-amzn-requestid: 2ae96766-6999-44ec-8084-a19d26b3e118
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YpOJOHYFIAMFXYw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6326c3d4-060b96fa5fc99e79711bde3f;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 07:08:04 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Thglq7Lwby4LEkD9ShUBLutHUBhdvl9ErgTSqorJw5ZOzD6Gr8hqNQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 02:03:05 GMT
age: 23718
etag: "76ac1f33cd006227162e12e7142e754562bec0c0"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12538
Md5:    e2bbb3856eeac20d0ee556c96144bf6c
Sha1:   76ac1f33cd006227162e12e7142e754562bec0c0
Sha256: 1e3f6551d401346b6d809d8feb9b36a9e0006f99f518d1130aa9bd630bfb6801
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac33f06-9198-44a5-b43b-9cbcc092cf52.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9481
x-amzn-requestid: d527d22a-6822-4b90-b9cb-034f58f73c24
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0IGl7oAMFSKg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4e7-13a676d9596cbd20663d2d8f;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: V8vtLV7n0bPpR5xQtqcH6WK7uBV4ObaMdy_9qN_TtISqAozEwPe0hA==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:12:22 GMT
age: 37561
etag: "4156c37b612d5fb99c6b061187a3cb0b314ae4a8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9481
Md5:    1eab8da8cc1495a0221efadddd1a0bcc
Sha1:   4156c37b612d5fb99c6b061187a3cb0b314ae4a8
Sha256: 2fc5dbd9216f775cd305de80d17db2e6c74abcb1e30bfa7065c4d763a7345026
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53fa68ad-0fdf-4958-b6f1-e38245c20380.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4947
x-amzn-requestid: 2d8325c6-7564-4fab-86ad-75bc44451ac8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YzHtOFNXoAMF5iQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632ab987-30ba7b1d6088630236d03486;Sampled=0
x-amzn-remapped-date: Wed, 21 Sep 2022 07:13:11 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 3NJdOO87M_on7FBlPCczqwUtjsq75kEXAxq9CcsiHDvuaUDCYhd9LQ==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:08:23 GMT
age: 37800
etag: "944c0453511761e101cb9e50ba8af7545e32e357"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4947
Md5:    d22173527a1bc9b264170aaa07491248
Sha1:   944c0453511761e101cb9e50ba8af7545e32e357
Sha256: c04b0975162a54e0afc5ae4a863f8e8393415d455e8f7ff3fc67a47868e09ec0
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb77ad616-c829-40b4-8b70-2be46252d64c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10279
x-amzn-requestid: 2ff2c324-51c5-484d-b049-3eacbdc1024a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yyj8THHdoAMF44g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632a804e-0f4da4ba2a84679b3fd297fc;Sampled=0
x-amzn-remapped-date: Wed, 21 Sep 2022 03:09:02 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 6uqNnpll2kgC_0_t5e9yp0AgFAvprQq_GF_jgwj2sX2TE9S1l023Aw==
via: 1.1 c21a0d27ceec21e266c9f962d0349438.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 03:58:47 GMT
age: 16776
etag: "60a83a1618ffae06e49ca3002bac1db9980dcfe8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10279
Md5:    8ea5f06ad31f0cedd2cb5c6df82f35f4
Sha1:   60a83a1618ffae06e49ca3002bac1db9980dcfe8
Sha256: 5f6a4cb92c016ef0f229b11d727e9680a15b10782b5bfe9e66ad9d100b458d8d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98db69a9-8416-4b0b-b1b4-1ed196b985e5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5340
x-amzn-requestid: b13bc974-e15d-43a4-a918-fbc35b09a36f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y19HljIAMFY8w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4f2-2cb226ba4bd7c7e74d9ab2db;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:42 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 8DCVWC4Ihr4R21i3ySyiWdUK0aGymTE22B842ZKolG-ZThiKSMX-uQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:04:45 GMT
age: 38018
etag: "0264e73c4cfff0bb255757c7e1c760a5ad3ece80"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5340
Md5:    3b318ea5c36d2b22b925f7dfe382df5f
Sha1:   0264e73c4cfff0bb255757c7e1c760a5ad3ece80
Sha256: 0c2f58ea4f5f32bb327f292e1b8fb5a4a60230bffc3abc440a624df27ec0d6bc
                                        
                                            GET /content/image/602bc70b48ff9.jpg?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/JPEG
                                        
server: nginx
date: Thu, 22 Sep 2022 02:43:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: ZWEgAoizWPoyvEgDAxK5KRwLcCzRmrDTHL8UPRg8d6Q1WBcygqz0Kw==
age: 107664
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=361, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=832], baseline, precision 8, 288x125, components 3\012- data
Size:   30382
Md5:    7597648a7f4c85640eb524947c13eb34
Sha1:   d233968620f9834dd51dab468c736b54a004b657
Sha256: 313128b31f19b40a5cb2b1e0c1443387117e922feb95c72c5338096ff43a57c7
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffccf6ade-04f7-4d15-943c-bde343725d94.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8029
x-amzn-requestid: 2fc5c63d-5cef-42f4-a6d2-b55f51c57af6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0tHjGoAMFcFw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4ea-73f2f78a2d1ca8fc666d2571;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 5ur411n5hU7eWb68iExZCUrhpCybRyTBHCi72ra8dS2kd3UhW8sb1A==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 21:59:00 GMT
age: 38369
etag: "1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8029
Md5:    02a682b4703bb9d6381c762726c05531
Sha1:   1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54
Sha256: fb672de67420a239fe5d7e2588f640150ed29883fe2a46ded160385e3265004c
                                        
                                            GET /content/image/5b4f416ee10b3.jpg?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/JPEG
                                        
server: nginx
date: Thu, 22 Sep 2022 03:29:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: lpF2VCyzZb84POx50MTjwA4_51Oav8L9abpwYKnQ7hp7dB1wuIF6hg==
age: 104910
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /content/image/5c1cfaf6a3c67.png?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/PNG
                                        
server: nginx
date: Fri, 23 Sep 2022 03:55:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5VDj4AEqwb25M1aC2gBgk2TtS4bgmXyo0MPqJtnZKmpg34TVFGypDg==
age: 16991
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /scripts/push/script/48epx4xd5x?url=newsmartphoneoffer.com HTTP/1.1 
Host: trk-consulatu.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         172.64.169.3
HTTP/2 200 OK
content-type: application/javascript;charset=UTF-8
                                        
date: Fri, 23 Sep 2022 08:38:22 GMT
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yt%2BXosW%2FqFvz4m5ROiFhFaWwk2vTMu%2FlyOa53OWzLfOaCys7DNONaMuL1by64JGLO0AE2gcp%2FTvG6WSdp%2FBEDetGhdSI3m%2BRwps1jABiiUMbQ2WWffKr4V0QHeT3qW9IA6tVkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74f1f6b399bad174-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /content/image/5b753b0f22993.jpg?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/JPEG
                                        
server: nginx
date: Wed, 21 Sep 2022 05:01:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: wHXz4UMAAiHaYE80mCcD57J4t7y7oHCzbsyV4DAAPrNv7vkrVEYC8Q==
age: 185784
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /a48564053b3c7b54800246348c7fa4a0/track?http_click_referer=&fingerprint=f37eb7409fe3a4f4f6cf7a3b68fb3a76&fs_affiliate=null&fs_partner=Green%20Flamingo&fs_product=iphn14_uk_s_gf&fs_sub_id=null&fs_transaction_id=86cab8d285127f78d380e04585b2921d&fs_secure_code=f186bb3a5621d1823bde510d192fdf1b&callback=jsonp1663922581097 HTTP/1.1 
Host: click.fstrk.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         35.190.210.193
HTTP/2 200 OK
content-type: text/plain; charset=utf-8
                                        
server: openresty/1.15.8.1
date: Fri, 23 Sep 2022 08:38:22 GMT
vary: Accept-Encoding
set-cookie: fs_cr=1663922302000; Path=/; Domain=fstrk.net
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /content/image/5d8dd415ec4fa.png?size=300 HTTP/1.1 
Host: cdn.cloudcnt.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.98
HTTP/2 200 OK
content-type: image/PNG
                                        
server: nginx
date: Thu, 22 Sep 2022 02:43:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: max-age=259200
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: Q_ltG8C02-X1Ho0mzfVD7wVF2ES0qf-cdp1gYWYYnpTkCJ-v16RMvw==
age: 107664
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /api/tracker/a48564053b3c7b54800246348c7fa4a0/landing.js HTTP/1.1 
Host: fstrk.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.28
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Wed, 15 Jun 2022 07:40:15 GMT
last-modified: Thu, 01 Apr 2021 12:27:02 GMT
etag: W/"9abf9e75ee4858e2302cc352a93a131f"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 34uL1ZCcpZLFCu8-BxQWhBKxrPqaDwamfEW7TCgCmpAUOSPMMRONzA==
age: 8643488
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 
Host: maxcdn.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.18.11.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Fri, 23 Sep 2022 08:38:21 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: SE
cdn-edgestorageid: 632, 617, 617
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-cachedat: 2021-04-23 06:29:02
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: 6a91d2c867066733b6d92a7a528c5c2e
cdn-cache: HIT
cf-cache-status: HIT
age: 12032638
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 74f1f6adcb171bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1 
Host: maxcdn.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://newsmartphoneoffer.com
Connection: keep-alive
Referer: https://newsmartphoneoffer.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         104.18.11.207
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 23 Sep 2022 08:38:21 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"5869c96cc8f19086aee625d670d741f9"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 05/12/2022 03:05:27
cdn-proxyver: 1.02
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 863
cdn-status: 200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-requestid: 8995e66ba49ec2453930854af59429fe
cdn-cache: HIT
cf-cache-status: HIT
age: 7896625
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 74f1f6adcbbbb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---