r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 507011ccb9124dcd57e84a90a0965cc4
1a6575d0ac979c7184490cc9836ac4812ad2afd1
01626c18e1e68507aa33ef7448dbc3311901ab6f29adc2f51d449409b0680dce
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "01626C18E1E68507AA33EF7448DBC3311901AB6F29ADC2F51D449409B0680DCE"
Last-Modified: Sun, 05 Feb 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6244
Expires: Tue, 07 Feb 2023 09:20:38 GMT
Date: Tue, 07 Feb 2023 07:36:34 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 565c1bbc5c1c40be1988b3bf6fd9dc1a
cfdba5bc597130461dd67bf6cda53183be592493
60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9289
Expires: Tue, 07 Feb 2023 10:11:23 GMT
Date: Tue, 07 Feb 2023 07:36:34 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 07 Feb 2023 07:36:30 GMT
content-type: application/json
age: 4
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16927
Expires: Tue, 07 Feb 2023 12:18:41 GMT
Date: Tue, 07 Feb 2023 07:36:34 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
File type PEM certificate\012- , ASCII text
Hash e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6
GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: ZdpH9f95r2gK8p521/sGRRWE9L9XEiJmIFZp86y1Eg/vRMFIBlJYinFDydO4QLCNV/dsh9zfGEU=
x-amz-request-id: NFGKWB1XBZ6KCQGS
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 07 Feb 2023 07:35:26 GMT
age: 68
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 07 Feb 2023 07:36:34 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Content-Type, Pragma, ETag, Retry-After, Backoff, Expires, Alert, Cache-Control, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 07 Feb 2023 06:51:19 GMT
age: 2715
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
omelhorhackdorobloxdowloadtoools.blogspot.com/?m=1
301 Moved Permanently 195 B URL HTTP/1.1 omelhorhackdorobloxdowloadtoools.blogspot.com/?m=1
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 7a2ff2d6e619b0eb3da87ccf796983a3
5cd92b765d4d442a4fcbf389dc021fe31b1f13ea
d006512158457a6d0a881ce23a47ea9835e4f64072036c63e3090fcf2038c2e8
Analyzer Verdict Alert fortinet Phishing
GET /?m=1 HTTP/1.1
Host: omelhorhackdorobloxdowloadtoools.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Location: https://omelhorhackdorobloxdowloadtoools.blogspot.com/?m=1
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Date: Tue, 07 Feb 2023 07:36:35 GMT
Expires: Tue, 07 Feb 2023 07:36:35 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
Content-Length: 195
Server: GSE
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b3c8c635ae4c79b1ee9fac94ff31b835
b14ee07e831161ae0ac1f775ef07ab9633534e7b
d3b5e095bd3356dc5e6790ee48d17a750c302e937228bd0b576a256a72358aa3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9b88bae61bca33aba8aa99f6128db8d9
a07b61fb2458917699613fcae68710941b595416
54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4223
Expires: Tue, 07 Feb 2023 08:46:58 GMT
Date: Tue, 07 Feb 2023 07:36:35 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: gwbAHbEfUUgLPI0fLvodMw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: PnBbkoQ6qok0U9uRN5jYrC01sQ8=
omelhorhackdorobloxdowloadtoools.blogspot.com/?m=1
200 OK 17 kB URL HTTP/2 omelhorhackdorobloxdowloadtoools.blogspot.com/?m=1
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (14233)
Hash b128e96516aa856823c69ad7717b8000
bd1d3c214b5cbd607327a8b616f6c9c2a6b5def8
c8af35f0b1fb644a9fc0e6ef0e6dd55e0e9d02dfd361a9e03b6b96d936eb45b0
Analyzer Verdict Alert fortinet Phishing
GET /?m=1 HTTP/1.1
Host: omelhorhackdorobloxdowloadtoools.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
expires: Tue, 07 Feb 2023 07:36:35 GMT
date: Tue, 07 Feb 2023 07:36:35 GMT
cache-control: private, max-age=0
last-modified: Thu, 02 Feb 2023 02:03:07 GMT
etag: W/"88d496f681b879edda6222169648701e56f25c5deca935ec5ce6931836102e52"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 16582
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b3c8c635ae4c79b1ee9fac94ff31b835
b14ee07e831161ae0ac1f775ef07ab9633534e7b
d3b5e095bd3356dc5e6790ee48d17a750c302e937228bd0b576a256a72358aa3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
3.bp.blogspot.com/-dH83a-EWxQI/WUwQjo12WjI/AAAAAAAAFPM/GUuzo9rqoeYJnryg9Slr3L37faXCVlD0wCK4BGAYYCw/s1600/logo_650c697d3a6002c8f63991bb43c0d6b4.png
200 OK 6.7 kB URL HTTP/2 3.bp.blogspot.com/-dH83a-EWxQI/WUwQjo12WjI/AAAAAAAAFPM/GUuzo9rqoeYJnryg9Slr3L37faXCVlD0wCK4BGAYYCw/s1600/logo_650c697d3a6002c8f63991bb43c0d6b4.png
IP
File type PNG image data, 200 x 41, 8-bit/color RGBA, non-interlaced\012- data
Hash 8b2271ebafdb2a99c69f429d440c555b
38ab355f4cad880637c156f6afe451a9df8cba60
180547af487d795d7fd737f992fb288eb9ec53b79404955a49dd36569e96a230
GET /-dH83a-EWxQI/WUwQjo12WjI/AAAAAAAAFPM/GUuzo9rqoeYJnryg9Slr3L37faXCVlD0wCK4BGAYYCw/s1600/logo_650c697d3a6002c8f63991bb43c0d6b4.png HTTP/1.1
Host: 3.bp.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="logo_650c697d3a6002c8f63991bb43c0d6b4.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 6658
x-xss-protection: 0
date: Tue, 07 Feb 2023 03:39:35 GMT
expires: Sat, 28 Jan 2023 06:25:47 GMT
cache-control: public, max-age=86400, no-transform
age: 14221
etag: "v14f4"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1d1aa4ad88ba34d800f450aa8b3c8e8d
3146a99bf109d80817ecde097dd2a9f15f44b0df
417352ca073e3ce602b656facbc706f9c2188f8c4d2a0bdc6dccf77bc27c0ea6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
status.thawte.com/
200 OK 471 B IP
Hash 5ab8d9121d8811a4845ea4d150a62cce
44133e07445e8335b7bb486710b971099a14d2cb
bb0de04387588bf4a4bb1b5eeca90306aa86724ec3116ad7da609bffbf5cf21a
POST / HTTP/1.1
Host: status.thawte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4012
Cache-Control: max-age=150524
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Etag: "63e198d4-1d7"
Expires: Thu, 09 Feb 2023 01:25:20 GMT
Last-Modified: Tue, 07 Feb 2023 00:18:28 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 278 B IP
Hash c6255f018d0f0524e0722e7df00c2e5c
fbc93c64057c228606a6a0196eba6456f107300b
9c7f7ad3a168169de8ba2ad88ebcf99fba9a4ca93ca8b1602807a5fad9c91ef6
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5073
Cache-Control: max-age=141190
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Etag: "63e17039-116"
Expires: Wed, 08 Feb 2023 22:49:46 GMT
Last-Modified: Mon, 06 Feb 2023 21:25:13 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
200 OK 278 B IP
Hash b3a97bd21b56076cae0ee94a2bc59db8
0ce595544ea0af58ca7b2d2a2fa51e110ae3571e
95b498d7dc3929bad71bbf136f13fe095ebf06e812c99b8e7cbcba6f0c5e5d96
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5342
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Last-Modified: Tue, 07 Feb 2023 06:07:35 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 278
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 6a24862b6ce51c945cd18a05ca4594cc
a8276e3db453c4a8f0d585dd6e77ec4a79dd44ba
3ebaa32aa407d3b21bff2f84adad62c2caf2f82439c99bf9fba2c4018688364a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.blogger.com/static/v1/widgets/3801814646-widgets.js
200 OK 57 kB URL HTTP/2 www.blogger.com/static/v1/widgets/3801814646-widgets.js
IP
File type ASCII text, with very long lines (2221)
Hash 4b866f80aa72c49d02f36338402a59e5
ca95baa3565ec41d9635387ac90b2add0e05a47d
aff6590600f8a33efdbaf01cc67e5a435e38ec8997b3c6b1f34a1ca8ff72fe7e
GET /static/v1/widgets/3801814646-widgets.js HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 56575
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 Feb 2023 02:58:16 GMT
expires: Tue, 06 Feb 2024 02:58:16 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 06 Feb 2023 00:50:58 GMT
content-type: text/javascript
age: 103100
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
i.ytimg.com/vi/mXecPfBxnVw/maxresdefault.jpg
200 OK 156 kB URL HTTP/2 i.ytimg.com/vi/mXecPfBxnVw/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 156 kB (155767 bytes)
Hash fb88afdf0d2debf8ff0e349186c05d82
e3e38feee0fcac41af59bb51091cc7d07b9cebf3
d36d75213d8aee0ba8bb5237d20e7d2b8851ebc3b50ce77b487a9404d4db5e51
GET /vi/mXecPfBxnVw/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/jpeg
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 155767
date: Tue, 07 Feb 2023 07:36:36 GMT
expires: Tue, 07 Feb 2023 09:36:36 GMT
cache-control: public, max-age=7200
etag: "1494161729"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
i.ytimg.com/vi/39NMIIs9zI8/maxresdefault.jpg
200 OK 220 kB URL HTTP/2 i.ytimg.com/vi/39NMIIs9zI8/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 220 kB (220234 bytes)
Hash c30c957f9688735d1fe066dbccad1aa3
98464a9a94fed798c38c5d4cfae48d7e606d7603
816a003051a66cbf87ed0dbbc34670d55d150b7d5ff81da4a1f953fae5011ed6
GET /vi/39NMIIs9zI8/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/jpeg
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 220234
date: Tue, 07 Feb 2023 07:36:36 GMT
expires: Tue, 07 Feb 2023 09:36:36 GMT
cache-control: public, max-age=7200
etag: "1552857897"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1d1aa4ad88ba34d800f450aa8b3c8e8d
3146a99bf109d80817ecde097dd2a9f15f44b0df
417352ca073e3ce602b656facbc706f9c2188f8c4d2a0bdc6dccf77bc27c0ea6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 6a24862b6ce51c945cd18a05ca4594cc
a8276e3db453c4a8f0d585dd6e77ec4a79dd44ba
3ebaa32aa407d3b21bff2f84adad62c2caf2f82439c99bf9fba2c4018688364a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/i9TqdYvzK88
200 OK 471 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/i9TqdYvzK88
IP
Hash 23aae940034b286b7ded9e28e3aed7cf
81f967a3de424ba8911a1d107422fc14bdfec13f
4a438b191aea29480d14b4fd58777eae3f2eee57a44201fba4d47cdf0b15b2b6
POST /s/gts1p5/i9TqdYvzK88 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
image.winudf.com/v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMF8xNTYxNjEyMjY5XzA0Mg/screen-0.jpg?fakeurl=1&type=.jpg
200 OK 75 kB URL HTTP/2 image.winudf.com/v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMF8xNTYxNjEyMjY5XzA0Mg/screen-0.jpg?fakeurl=1&type=.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, orientation=upper-left], progressive, precision 8, 1280x800, components 3\012- data
Hash 17737835983a646f761287633cb2d6ea
bbedc44fbafd6ffb7a6803ec1197bc923a384214
c52223c679cb2da569d206eb1d94a2d381e8671b5548b9246eb8df6fdbde7b24
GET /v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMF8xNTYxNjEyMjY5XzA0Mg/screen-0.jpg?fakeurl=1&type=.jpg HTTP/1.1
Host: image.winudf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/jpeg
content-length: 74964
cf-bgj: imgq:100,h2pri
cf-polished: origSize=78123, status=webp_bigger
etag: 3e192d77
strict-transport-security: max-age=15724800; includeSubDomains
x-cache: MISS
cache-control: max-age=31536000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PdBWtaozQx7te1k3AK2HAfuZZqwrnZdPCWDp789D%2BPYBIZYdHzMTcq7obcB5A%2FlOxOitP%2B8%2BR6voAV%2FR4Tn4b8rb2ftOL8n6OghgH0sHzVsRPdAUAgJELx8i7fa6WN5nxCE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
timing-allow-origin: *
server: cloudflare
cf-ray: 795a749a9d81b52d-OSL
X-Firefox-Spdy: h2
image.winudf.com/v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMV8xNTYxNjEyMjY5XzAxMg/screen-1.jpg?fakeurl=1&type=.jpg
200 OK 86 kB URL HTTP/2 image.winudf.com/v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMV8xNTYxNjEyMjY5XzAxMg/screen-1.jpg?fakeurl=1&type=.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, orientation=upper-left], progressive, precision 8, 1280x800, components 3\012- data
Hash b4ea5f8ac55f2f16c9bc1bf2bbd383cc
75749393d394dc11d69410707d22147b46019583
63ab1084eb7d459aacc6354974081db9ab5abf6c2e4c9b2ebce0fd46efc36010
GET /v2/image1/bmV0LmFuZHJvbW8uZGV2Nzg0MzMxLmFwcDk4NDUwNl9zY3JlZW5fMV8xNTYxNjEyMjY5XzAxMg/screen-1.jpg?fakeurl=1&type=.jpg HTTP/1.1
Host: image.winudf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/jpeg
content-length: 85768
cf-bgj: imgq:100,h2pri
cf-polished: origSize=87721, status=webp_bigger
etag: 51a0aa59
strict-transport-security: max-age=15724800; includeSubDomains
x-cache: MISS
cache-control: max-age=31536000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WVIuLHa54D%2BUX6BdlZs2tLNa%2BeovopGgkE67nhO4Y%2BsfldcIDHXJnhssNz3rmsc2eRFGVHktO9StJVXM8DcW2Tqbna10wW%2FeO3YkyCEWKkc6jducHk%2BMrWGoB9fXR4p%2Fhgs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
timing-allow-origin: *
server: cloudflare
cf-ray: 795a749a9d84b52d-OSL
X-Firefox-Spdy: h2
progameguides.com/wp-content/uploads/2020/02/featured-roblox-jailbreak-codes.jpg
200 OK 24 kB URL HTTP/2 progameguides.com/wp-content/uploads/2020/02/featured-roblox-jailbreak-codes.jpg
IP
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 816x250, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 6688429c8db07327c2f6d5b6e9f7526c
2515e5695fcdb1ec3fb4ee95fe36621f9b800a36
d2aa71649da5419301920bb90e3256f6a860dbef7830e18815e209582b5d0761
GET /wp-content/uploads/2020/02/featured-roblox-jailbreak-codes.jpg HTTP/1.1
Host: progameguides.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/webp
content-length: 23544
last-modified: Sun, 05 Feb 2023 05:23:50 GMT
expires: Thu, 09 Mar 2023 07:36:36 GMT
etag: "a8a2256653a933b6"
vary: Accept, Accept-Encoding
cache-control: public, max-age=2592000
x-rq: yyz1 80 130 443
x-cache: MISS
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 795a749b28a9b523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/i9TqdYvzK88
200 OK 471 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/i9TqdYvzK88
IP
Hash 23aae940034b286b7ded9e28e3aed7cf
81f967a3de424ba8911a1d107422fc14bdfec13f
4a438b191aea29480d14b4fd58777eae3f2eee57a44201fba4d47cdf0b15b2b6
POST /s/gts1p5/i9TqdYvzK88 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11278
Expires: Tue, 07 Feb 2023 10:44:34 GMT
Date: Tue, 07 Feb 2023 07:36:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12919
Expires: Tue, 07 Feb 2023 11:11:55 GMT
Date: Tue, 07 Feb 2023 07:36:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11278
Expires: Tue, 07 Feb 2023 10:44:34 GMT
Date: Tue, 07 Feb 2023 07:36:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12919
Expires: Tue, 07 Feb 2023 11:11:55 GMT
Date: Tue, 07 Feb 2023 07:36:36 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32cb7a16-13bc-4d42-8e17-7be2a40cfc82.jpeg
200 OK 6.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32cb7a16-13bc-4d42-8e17-7be2a40cfc82.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c3cd20c6639e2b0d996fbbd7df2d4f47
2e54c22fb83981e2690161cd521e4fc3998e9c16
9b2b1f3e062fca74341d09540e44d2a02ec451b8349440ed5917073e8fab988d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32cb7a16-13bc-4d42-8e17-7be2a40cfc82.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6316
x-amzn-requestid: 879578cc-a58a-4516-a7cd-68850553762b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fpc79ECLIAMFclw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63da0eb2-57141dcf1c5595110f5f572e;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 07:03:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ARr-i9j3ruIxZ123Ae2bEk_c2s_5Zs7fhrn4UXphw_jOYrtvq9OMVg==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 16:55:00 GMT
age: 52896
etag: "2e54c22fb83981e2690161cd521e4fc3998e9c16"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7926951f-dd16-4029-a877-933fa5d3c0f5.png
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7926951f-dd16-4029-a877-933fa5d3c0f5.png
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cf292b03a5db7eb8e0660a518f41233c
8fa486cdecffff8a663da2df88227ee784c298a2
cfc5efb92068bdeeda5c95f9851213b14afa76776486d0493cf4c05b30453cf0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7926951f-dd16-4029-a877-933fa5d3c0f5.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5634
x-amzn-requestid: 632886dc-5740-40ae-b91f-f0bc1578ac2e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fpdrbGvaoAMF_4g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63da0fe2-4e20757b045beab314bdf92e;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 07:08:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: xCFj9HPjTNZgRqRW4qwDUe2duq7q24zyMZSuIa6Nw7QjeouM11_ziw==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 15:41:08 GMT
age: 57328
etag: "8fa486cdecffff8a663da2df88227ee784c298a2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8ada2635-3335-4f49-9e7f-22d2ae016030.jpeg
200 OK 4.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8ada2635-3335-4f49-9e7f-22d2ae016030.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash eedb4de12585c70ddb5b8f94fe6a59e2
83c9437e71a0a03b3e8ff652155a85eafa76cdda
d4493a30f62e9ad224b3595ba3af8a322e2d4a3d9238a1847973f962bdcc0c82
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8ada2635-3335-4f49-9e7f-22d2ae016030.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4227
x-amzn-requestid: b45f2ab7-0102-4542-9514-54fb93a0e27f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f77sTH4jIAMFnsQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e1731b-4a24bcb1102e58543cd81343;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:37:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ovhdLaEGaDSC8X0F9VamLw0KyBPWkxfYg5pssOT8NOZP4IBtNk6Gfw==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:55:19 GMT
etag: "83c9437e71a0a03b3e8ff652155a85eafa76cdda"
content-type: image/jpeg
age: 34877
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09bdaec3-9afd-4cea-87ec-6adabc28a3e8.jpeg
200 OK 6.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09bdaec3-9afd-4cea-87ec-6adabc28a3e8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 88178e0f623494e30ece4da4eed04d60
7f016d87157a577e4ad4e4cf6c854a0489f8571a
e5658ac599ca37e797637a596ca9b65c80c1053b2ce5dacc667ae3b8b1ce54a3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09bdaec3-9afd-4cea-87ec-6adabc28a3e8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6384
x-amzn-requestid: 5f91a438-31d9-42ca-96b4-71344cc736c6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f77IcE2-oAMFbZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e17235-1ce1ebfa4e9ae6053434c48d;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:33:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: li__CyiikZFRNF7c8_9Kbi18VJ39UzJiNgP9z141MCUFVPnYAEXPCg==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 22:24:59 GMT
age: 33097
etag: "7f016d87157a577e4ad4e4cf6c854a0489f8571a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd09b3928-4257-4aee-9978-7c13c20b5a23.jpeg
200 OK 7.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd09b3928-4257-4aee-9978-7c13c20b5a23.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 92008e687831334af1cdbf4b8a57579f
e6ff750f12836637adf5b253d64c2102fdf3c180
39af3e630e0271b54139849c1b596efbdc69a23ce943e5330341d49f77798c7c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd09b3928-4257-4aee-9978-7c13c20b5a23.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7183
x-amzn-requestid: 02695a8d-2ab8-4d77-bfbe-f99418d8ef00
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f78YOGsyoAMF5wA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e17434-2614cef4059e7fd5009cb46d;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 21:42:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: qbUWAiTEzfmIOkYgKdBEYxEnRky5wA7ajMWumei7fXeIqLN9B-riBw==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:55:27 GMT
age: 34869
etag: "e6ff750f12836637adf5b253d64c2102fdf3c180"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e47a0b9-4a27-4f39-8f25-f88789a2408f.jpeg
200 OK 3.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e47a0b9-4a27-4f39-8f25-f88789a2408f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0594f78c4fdfed5dd2e0666312555f40
db903b9a3f387c1510170f8d16dd4d289f7df83f
8874083a529064657b18be58147ae7df5fe79c822c4bd2a023fdf3df7186a62e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e47a0b9-4a27-4f39-8f25-f88789a2408f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3712
x-amzn-requestid: 44c7e7bd-1a95-49b6-9b0a-f8aff3725ded
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ftbOtH-lIAMF0xw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dba591-2fb19c33646c3d327681e9f9;Sampled=0
x-amzn-remapped-date: Thu, 02 Feb 2023 11:59:13 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Z5r7rFH2nEro98p7U4_Lz8xIrX_bnU7ntAc46ytGzL8498buHzsCcg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 21:55:26 GMT
age: 34870
etag: "db903b9a3f387c1510170f8d16dd4d289f7df83f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/PIk-tcsd5xo
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/PIk-tcsd5xo
IP
Hash 133367c6a697103164fb499fff79f957
49536280bd0f2f9a01b31cf3a78a33916f0a759a
d3f1a3452ea1d8afdf3c664a4cd06a84b80ea491e90492c7997c3fdf42582946
POST /s/gts1p5/PIk-tcsd5xo HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:36 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bux.wellter.de/images/gamebaglogo.png
200 OK 3.3 kB URL HTTP/2 bux.wellter.de/images/gamebaglogo.png
IP
File type PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced\012- data
Hash e84f0caa809a15b2aaa9cb93bbe6669a
22a330ad580aaa6b2232307a87b981adc7fbf38f
1f98c982fd0c9b5e6af138a4cb160f509bda9fcc7fa0a9463fa6cf11513c151f
GET /images/gamebaglogo.png HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/png
content-length: 3340
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: "5d9ca488-d0c"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y5TbgyaK1Kb0NJ9KRus9%2BfWhsVdSBcIuz0WzRgn%2FPo7fUs1nF0HHNPIbBD3zDNLGTu07gRXF7Xb7qpJzhhuSOze6kVYYZGjHJPyTgcOleYDvcLjL1LmEtGTE8HBki%2FiE9A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe76b523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/ft-1.png
200 OK 3.3 kB URL HTTP/2 bux.wellter.de/images/ft-1.png
IP
File type PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced\012- data
Hash e84f0caa809a15b2aaa9cb93bbe6669a
22a330ad580aaa6b2232307a87b981adc7fbf38f
1f98c982fd0c9b5e6af138a4cb160f509bda9fcc7fa0a9463fa6cf11513c151f
GET /images/ft-1.png HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/png
content-length: 3340
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: "5d9ca488-d0c"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OZQ8HZOeaTWzb3I3Pn8ApDRzsKpC%2BdUCTxWnfJB8FvRx%2Bc%2BzsWG2J%2FFzaRSVu1AMc7Kd1zu3xYCCq1PqzSfQSXpGr8vN8FxDrRBmvuWTu9%2Bp%2Fck0OLr%2B0VCPT7Km2XVIrA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe7ab523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/header.png
200 OK 131 kB URL HTTP/2 bux.wellter.de/images/header.png
IP
File type PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced\012- data
Size 131 kB (131285 bytes)
Hash 35e93538f31d67876a2cb38bf94279d8
49bf97732e9bffb5371ad60d024901b09d83651b
95c1de9315834de2ff3608a2dc048a6aedc273e665f9b54eb956523a81fc91df
GET /images/header.png HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: image/png
content-length: 131285
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: "5d9ca488-200d5"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Z8C0qsC9qiVOXqrV6EtACJN%2B5rwdxww1DOg0Tr6z%2BoLJEcrsNRIXTV%2BS3P34t5N5%2B7mnb3uYI0znC4Tnn3Y7Mkk1jyQ2ZflC46UTmPHlRpqosLIu38MmSWakBGfcqO4sA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe79b523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.net/npm/js-base64@3.7.2/base64.min.js
200 OK 2.1 kB URL HTTP/2 cdn.jsdelivr.net/npm/js-base64@3.7.2/base64.min.js
IP
File type ASCII text, with very long lines (4802)
Hash 18914b05d782cca37716837edf14fa8a
c563d127cf718dd86389fdd007b4c51b6bb58dc3
4bded663a5f9ccaa1eb7c1692c1c7df756a7d0e037d19466979fb90c56fbefdf
GET /npm/js-base64@3.7.2/base64.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 3.7.2
x-jsd-version-type: version
etag: W/"1405-lMmxLE0z8/TnsipvbhQg5ckAA8Q"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 07 Feb 2023 07:36:36 GMT
age: 2868575
x-served-by: cache-fra-eddf8230097-FRA, cache-bma1670-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2068
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css
200 OK 1.5 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css
IP
File type ASCII text, with very long lines (3201), with no line terminators
Hash 8e09ceb5490863a66cd2e83ca3d7e524
35e3d074516ec70c508d748f7ae01827bc0c28ba
cccbb374fd4cb6dcbac9df64456b49cb11530e7bafdac6c6c7e67ff2ed350db9
GET /ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css; charset=utf-8
content-length: 1541
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec2-c81"
last-modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1598801
expires: Sun, 28 Jan 2024 07:36:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z4FS%2FT6BDHZZ4MOsRn7A5vrZHF7FvP3b34yWaAmrsdfrhAbW5AEYMwxlQmtpjAEGbFQApoXf4eGDefc95IVPSdinjD%2FPahH4K7qVaTOLVzILNEJmQ%2Bp2LTtcUa4VZeJ6Y8QxHSk0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 795a749f39abfac0-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/scripts.js
200 OK 1.6 kB URL HTTP/2 bux.wellter.de/images/scripts.js
IP
File type ASCII text, with no line terminators
Hash ea40dd9c071d48f0ec412c191648d733
7caa6524bfe595dda7782b58b187a1846f1ffdc9
78e4fa5dd3f61974d833bb4fe2b1d89766074511e61c3dcbdcd6a5baf0b83c17
Analyzer Verdict Alert fortinet Phishing
GET /images/scripts.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=225
etag: W/"5d9ca488-e1"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E97MrHd4igbhNtb1YWeMsbmyM%2FG4956N9sOaoCBkBbm74eCV%2B5%2B72cybkvfiWp5Xzu%2BkGHzz%2BSqktN5vyc1SzwN4sTz6Hf3HI5MwjsZV%2FqopqyifCVEFqoyIj8mMtI5wEw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ede9fb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/jquery.countto.js
200 OK 1.1 kB URL HTTP/2 bux.wellter.de/images/jquery.countto.js
IP
File type ASCII text, with very long lines (1043)
Hash e992ba59b20976517ecca9460fd518cb
9a5d518f4e156374bd11928ac201aeadc859305d
bd79a106dec7f00c140286e9ff46648955dce7a68e7a713840ab5b4df87f4e62
Analyzer Verdict Alert fortinet Phishing
GET /images/jquery.countto.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=3761
etag: W/"5d9ca488-eb1"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9w53Jk34ErRnyaCuEBmrF4x49LK19PWCJ3xqAWWTBeQca6v%2FCGctqUqK%2B3k7m6SODd%2FsSwyFpdAOYnM%2BJQ%2FPywY%2FNsyuRo0Vo6Amsg7kl6aQNU5Iy1FG1XjtUWlxI2vZXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ece87b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/jquery.magnific-popup.min.js
200 OK 846 kB URL HTTP/2 bux.wellter.de/images/jquery.magnific-popup.min.js
IP
File type ASCII text, with very long lines (21014)
Size 846 kB (846233 bytes)
Hash c87653c042d9aed93908dcda9cea676f
031803891ac495952650e0c6eb01fa06a64751b2
8a31d966bd54c13f9acf9430d74d2a5d8d048d95a13f4a99e5525c7906c4c628
Analyzer Verdict Alert fortinet Phishing
GET /images/jquery.magnific-popup.min.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-5297"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BPBHBki9gLjvPBS569o4PoawFW9YpKiv484zJKw8FwPMzu97%2BAFh%2FPwtCnx5Hl8ZIAR6YB%2F%2Ft8HmNkUjnMH1hXbpUBZeIwV9X%2Fu%2F5UXTq78rFmkbnt1X0zkgX42d8ZaMYg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ede99b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/PIk-tcsd5xo
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/PIk-tcsd5xo
IP
Hash 133367c6a697103164fb499fff79f957
49536280bd0f2f9a01b31cf3a78a33916f0a759a
d3f1a3452ea1d8afdf3c664a4cd06a84b80ea491e90492c7997c3fdf42582946
POST /s/gts1p5/PIk-tcsd5xo HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:37 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bux.wellter.de/images/sticky.js
200 OK 26 kB URL HTTP/2 bux.wellter.de/images/sticky.js
IP
File type ASCII text, with very long lines (16920)
Hash 539a4bc3f604ab7b6567d67c40155308
e565bddba9e8a6cdd3ce8d53abce62a24095fb69
dd6b22a7b90848d40455e5791c9c197123a3514d715cddf924a6c8885c47247b
Analyzer Verdict Alert fortinet Phishing
GET /images/sticky.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=20845
etag: W/"5d9ca488-516d"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MlzZfZwEHpgzcXNN23oewYhxpjYEdkEJLwIODRLD0xJ%2F1XAJS1b426a9yjl9XnbHFn%2FyF3xKDCFdwQTKbu068gJk65KAZ7XkzhD5kZnOnEYB3eQkM27mF%2BFs7RXWQBzgew%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ede9cb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/button-dot.png
200 OK 672 B URL HTTP/2 bux.wellter.de/images/button-dot.png
IP
File type PNG image data, 15 x 15, 8-bit colormap, non-interlaced\012- data
Hash 478aefab2e280b16b0372e607414d3c2
710f5aaa706ec23cbf45006d7c1d25be76b4fa64
a651e77df132fc0c4dbccb7c56f84923c28dcb159f4b7a112bde8bbc548632bc
GET /images/button-dot.png HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/images/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:37 GMT
content-type: image/png
content-length: 672
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: "5d9ca488-2a0"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4893
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eeKqeQHjFRkUPshh%2FwGu9AHcI7B%2F%2FSQdtS9YLwADe%2FjXILx5mvyGvWFtOhwON%2FL6U2VCE9POkBW3PO5%2Bb%2F0dBKBGE%2Fwqdx2lOYroHy0S2fGvxgw8a5RJNQ5cVTvk7IL46A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749f9f9eb523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/validator.min.js
200 OK 5.2 kB URL HTTP/2 bux.wellter.de/images/validator.min.js
IP
File type ASCII text, with very long lines (5862)
Hash 90e3deadcf4b4986ece1b0dd6665dabc
c55bac8fec1f4ed8f683cfd15cfd22219b6dbc42
1f5a36f444bded22094a64dd713c016571cf4e78bef169baac0ab4bf73fcfdbe
Analyzer Verdict Alert fortinet Phishing
GET /images/validator.min.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-17a7"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pa%2Boqvz8Yv9pMhq66UxoPcnCrEcasAY2HhKGTeOEkGbzOS8ecS9f%2FphsyCy2z7jS8gHS7knIZTAtt9yzWHABArpHGAJxFg%2FW2asraZ8oVgmFVBqFtG27TXtRdRew95hmjA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ece8db523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/form-scripts.js
200 OK 2.5 kB URL HTTP/2 bux.wellter.de/images/form-scripts.js
IP
File type ASCII text, with very long lines (516)
Hash 5e6c405178ebc3c28deedc763f64bdbf
0022d58eb6a33618e52af3e3ec34c0bedb7e0e27
2b0f99076c14450e51f8553cf3b24875d2e1e799e540f8f4541fcb82783ee55e
Analyzer Verdict Alert fortinet Phishing
GET /images/form-scripts.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=1469
etag: W/"5d9ca488-5bd"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbyFiDxgyzoGH1ic%2FefT9OK6MqXuFVbmclajt7kEspDJb4l26smiSP5Q%2BSXByWWQKBH9%2BXyyTx%2FdmyzhephvzXoMPucCIKJqebdPkAlfjl%2F4pa45miQo9KcGiV8SrzsYog%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ede98b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/pr-r.png
200 OK 27 kB URL HTTP/2 bux.wellter.de/images/pr-r.png
IP
File type PNG image data, 960 x 1080, 8-bit/color RGBA, non-interlaced\012- data
Hash 1339ccba9a248e9c3689c2f921283d91
7d393c9a3efa49a81afc9406700e94ae23e4bb95
082da94e7b1e7b7cf6054ecb33edffc2b36578727ef34c8a1ef6bddfaa6cfbbf
GET /images/pr-r.png HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/images/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:37 GMT
content-type: image/png
content-length: 27316
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: "5d9ca488-6ab4"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4893
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=maTjfBkbA7SFkeBAVe9DgQJeB2ttkdCvIxu%2FLGM25DAyTB1DH%2B3jS0wcrGNaj9%2BedI%2BvROJclaIASrnKfkBN3%2FT0xzvvO%2FkhOwo6IIXE7Ue%2Bt2OFZcLUqRljSXgtLf%2FBhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749f9f9cb523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/fancyselect.js
200 OK 57 kB URL HTTP/2 bux.wellter.de/images/fancyselect.js
IP
File type ASCII text, with very long lines (1254)
Hash a8e91c6c2b632beb1b48147af21fd0df
203142737967a2b0ca04973a0ab1d5087a5d1ce0
6e4e2679ea6d1bd5edf44c01e0b5b11d093b388ba3f07bc41f512281c7feaa51
Analyzer Verdict Alert fortinet Phishing
GET /images/fancyselect.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=6778
etag: W/"5d9ca488-1a7a"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=805Lus7YnTSLB4a%2FjMJEYnyRJu6rYU7yUixqhG1yb%2Bg8G0s%2BQxwDWF%2FystxrPXOGdPmiCK3yNBaty6saq31ttVJJGQEj3fcDrSFSkNCIdtX3AFY37ZNJwrbotAGQcQ5UaA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe82b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/jquery-3.2.1.js
200 OK 42 kB URL HTTP/2 bux.wellter.de/images/jquery-3.2.1.js
IP
File type ASCII text, with very long lines (1237)
Hash 9affc75ddc927efcd1bb955822b7ecf3
ef1f068f94474055fe98c2c330c5004d5f166cc9
fa66a16d2cb6c40af4b3e86efe8c1bc966b97cae39f2ab08fa4000aa12eda33f
Analyzer Verdict Alert fortinet Phishing
GET /images/jquery-3.2.1.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=268039
etag: W/"5d9ca488-41707"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mVaF7onndrGwqBHaCa5531BwhYpLKZESbZEXZVFaHqANCnKXN9CF0KC%2FBz6IYS39iQ0nlqC7zKRaao0vMEdiBELdE4qnX5YPvgndIGYNVs998oaeY9ci5jmb8dFJBjrlkw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe7bb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/main.js
200 OK 82 kB URL HTTP/2 bux.wellter.de/images/main.js
IP
File type ASCII text, with very long lines (24637)
Hash 09fe5090ee17473d8de93bdcc0119c5e
d6ef3faefc554117bb872f8872399b72f3d43c02
884e686b1e4fb0b0f1a057152d5a186984b504c94b6c60aec6d262bc6c06b3cf
Analyzer Verdict Alert fortinet Phishing
GET /images/main.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=38451
etag: W/"5d9ca488-9633"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CQEW5x5nK4xIGFOchgYb6pyxrNUBNL87Esg9ZMe6QZomTMrIWk7ZHkC6UESaLIbNTUuW6r%2FNt07JbWzK7S7bMwApFb08flZ4vu3gxp%2BVyudm3ngfPplTTXXKuOzM0UzBEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ede9db523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/animate.css
200 OK 4.4 kB URL HTTP/2 bux.wellter.de/images/animate.css
IP
File type ASCII text, with very long lines (53418)
Hash 31fa4127dd84ad4c5fd60b9c912160a4
2d88d7b611d2e625e9bd9ddeb1e4b21c469c7389
d1dffbcbe6324dadb674db806b34171f373a3659c398bc9199300819157b00f7
GET /images/animate.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=68796
etag: W/"5d9ca488-10cbc"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hmFUdsK6QX0cQeQYu0z1lGGd64OqPKKb44NXpZxTXye%2FgdO2EwY%2BsN0%2F2kkrmd1bsKUF520ouqDe6bJzk%2BQgWgcZ9Vg49MMcG9mJ48N5tnpqLPZDtSmmrZU1PUraDtu%2F5g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749eae63b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 0a8ea253ef61b5c330b3285f9a94e6ae
0cf9a1c66c83f505c7195774996b107c145f5884
8b6bca0cd9c9adcb16bba03349e8fcbfcd645719c82c95f0111095b731842402
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 0a8ea253ef61b5c330b3285f9a94e6ae
0cf9a1c66c83f505c7195774996b107c145f5884
8b6bca0cd9c9adcb16bba03349e8fcbfcd645719c82c95f0111095b731842402
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3aCWcynf_cDxXwCLxiixG1c.ttf
200 OK 18 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3aCWcynf_cDxXwCLxiixG1c.ttf
IP
File type TrueType Font data, 17 tables, 1st "GDEF", 7 names, Microsoft, language 0x409, type 1 string, Open SansRegular1.10;1ASC;OpenSans-RegularOpen Sans RegularVersion 1.10OpenSans-Regularhttp://ww\012- data
Hash 8c20320e2a77d984348f9e9aa7296b9d
0939a63b6a9982ab64f044dfc3a21dac2bca0499
0be48b762bdf588db02112492dfadcb3a098fad3ac5aa2ccc80568b799462c52
GET /s/opensans/v14/cJZKeOuBrn4kERxqtaUH3aCWcynf_cDxXwCLxiixG1c.ttf HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bux.wellter.de
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17789
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 Feb 2023 05:00:34 GMT
expires: Wed, 07 Feb 2024 05:00:34 GMT
cache-control: public, max-age=31536000
age: 9363
last-modified: Wed, 14 Jun 2017 16:46:31 GMT
content-type: font/ttf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash 518d4b693ac64e6388da8e8055ef42e6
a2ffec6c48f4f057a9758fcf7e3e9eee7976e2d0
3fa2a5b09b5924320e577147b9a0c768be8782e7cd853689d5026803e9bc3237
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6291
Cache-Control: max-age=161846
Content-Type: application/ocsp-response
Date: Tue, 07 Feb 2023 07:36:37 GMT
Etag: "63e1bc28-117"
Expires: Thu, 09 Feb 2023 04:34:03 GMT
Last-Modified: Tue, 07 Feb 2023 02:49:12 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 279
fonts.gstatic.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf
200 OK 19 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf
IP
File type TrueType Font data, 17 tables, 1st "GDEF", 7 names, Microsoft, language 0x409, type 1 string, Open SansBold1.10;1ASC;OpenSans-BoldOpen Sans BoldVersion 1.10OpenSans-Boldhttp://www.apache.org\012- data
Hash 5498784000b038638befe230ea392271
efef80115bdabd927501563197827a7ae837a19f
5848ca5f4af491c37907f2e4cb0e240166572edc90615a96d4702f2dce34800b
GET /s/opensans/v14/k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bux.wellter.de
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18604
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 Feb 2023 03:39:36 GMT
expires: Wed, 07 Feb 2024 03:39:36 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jun 2017 16:46:24 GMT
content-type: font/ttf
age: 14221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v14/DXI1ORHCpsQm3Vp6mXoaTYnF5uFdDttMLvmWuJdhhgs.ttf
200 OK 18 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v14/DXI1ORHCpsQm3Vp6mXoaTYnF5uFdDttMLvmWuJdhhgs.ttf
IP
File type TrueType Font data, 17 tables, 1st "GDEF", 7 names, Microsoft, language 0x409, type 1 string, Open Sans LightRegular1.10;1ASC;OpenSans-LightVersion 1.10OpenSans-Lighthttp://www.apache.org/li\012- data
Hash a69c5fa643b7208c4922909701e399ac
0560e8f641340a70d9c36b3d4106e42ac395f829
0a8b75177ccda56113a7a1bb9214c38276257846f9323226f74831f74ffc721f
GET /s/opensans/v14/DXI1ORHCpsQm3Vp6mXoaTYnF5uFdDttMLvmWuJdhhgs.ttf HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bux.wellter.de
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18391
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 Feb 2023 07:35:31 GMT
expires: Sat, 03 Feb 2024 07:35:31 GMT
cache-control: public, max-age=31536000
age: 345666
last-modified: Wed, 14 Jun 2017 16:45:42 GMT
content-type: font/ttf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
bux.wellter.de/images/bootstrap.min.css
200 OK 21 kB URL HTTP/2 bux.wellter.de/images/bootstrap.min.css
IP
File type ASCII text, with very long lines (65371)
Hash 663afaf5544b8ea6c5468900eafef0dc
cba29af55789b41b52cea29b7dfad02928ed2c55
af529f6a412b03962336651136b4854b660e8d75d55c111ff2d664b578178874
GET /images/bootstrap.min.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-1d990"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eIH945ReaN0ArZn942Fu0zLPByrqQTOs4V9NAB29cLBCpYrEepUxTpfrJ%2F8EndyRKUOSXp8IEEbD33ySsYY%2FWG5GJlQgXEGPhw5Tea%2BC2p9eCs53iPVzVl3dFhUZkzPh4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749eae5fb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 98089acb98ec0b3bf3e4b751487d1796
fe28a756381710ce40bf337358f66fb5f4acbeeb
41d62a039809f0a2d6b6b4862fa30e7cfcb188ef00c19cc41ddec01d45a27c11
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "41D62A039809F0A2D6B6B4862FA30E7CFCB188EF00C19CC41DDEC01D45A27C11"
Last-Modified: Sun, 05 Feb 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3443
Expires: Tue, 07 Feb 2023 08:34:00 GMT
Date: Tue, 07 Feb 2023 07:36:37 GMT
Connection: keep-alive
s10.histats.com/js15_as.js
200 OK 4.4 kB URL HTTP/2 s10.histats.com/js15_as.js
IP
File type HTML document, ASCII text, with very long lines (11440), with no line terminators
Hash ed192092c129db6123a3397855f42619
067e9b8e26cf6246eb84c6b9cf3da0c192ce7b3e
998fff486a7fb38b6ed445edc36c9b317b70950cd39efcf4012ca641312fcee1
GET /js15_as.js HTTP/1.1
Host: s10.histats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:31:45 GMT
etag: "-375139978"
last-modified: Thu, 16 Apr 2020 10:44:16 GMT
x-request-id: 41979420
content-type: text/javascript
content-encoding: br
x-cdn-pop: sbg
x-cdn-pop-ip: 137.74.120.0/27
x-cacheable: Matched cache
accept-ranges: bytes
content-length: 4364
X-Firefox-Spdy: h2
s4.histats.com/stats/0.php?4275781&@f16&@g1&@h1&@i1&@j1675755445987&@k0&@l1&@mRoblox%20Robux%20Generator%202022&@n0roblox-crn.js=rjohandigmailcom|template=Fastink.xml|rjohandigmailcom=omelhorhackdorobloxdowloadtoools.blogspot.com|omelhorhackdorobloxdowloadtoools.blogspot.com=direct|ref=direct|tags=roblox-crn.js&@ohttps%3A%2F%2Fomelhorhackdorobloxdowloadtoools.blogspot.com%2F&@q0&@r0&@s0&@ten-US&@u1280&@b1:68047932&@b3:1675755446&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fbux.wellter.de%2Findex.html%3Ftrack%3DWyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ&@w
200 OK 16 kB URL HTTP/1.1 s4.histats.com/stats/0.php?4275781&@f16&@g1&@h1&@i1&@j1675755445987&@k0&@l1&@mRoblox%20Robux%20Generator%202022&@n0roblox-crn.js=rjohandigmailcom|template=Fastink.xml|rjohandigmailcom=omelhorhackdorobloxdowloadtoools.blogspot.com|omelhorhackdorobloxdowloadtoools.blogspot.com=direct|ref=direct|tags=roblox-crn.js&@ohttps%3A%2F%2Fomelhorhackdorobloxdowloadtoools.blogspot.com%2F&@q0&@r0&@s0&@ten-US&@u1280&@b1:68047932&@b3:1675755446&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fbux.wellter.de%2Findex.html%3Ftrack%3DWyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ&@w
IP
File type Web Open Font Format (Version 2), TrueType, length 15948, version 1.197\012- data
Hash ea1f66bf31b03be8ed0361ee0e4a3535
1a1f01b7a759a5b0efbb7ff9d2a0418f755ce753
19aba075ee8181c833cb4568fb452d51aae56234cbd54148f557af1f17d8550e
GET /stats/0.php?4275781&@f16&@g1&@h1&@i1&@j1675755445987&@k0&@l1&@mRoblox%20Robux%20Generator%202022&@n0roblox-crn.js=rjohandigmailcom|template=Fastink.xml|rjohandigmailcom=omelhorhackdorobloxdowloadtoools.blogspot.com|omelhorhackdorobloxdowloadtoools.blogspot.com=direct|ref=direct|tags=roblox-crn.js&@ohttps%3A%2F%2Fomelhorhackdorobloxdowloadtoools.blogspot.com%2F&@q0&@r0&@s0&@ten-US&@u1280&@b1:68047932&@b3:1675755446&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fbux.wellter.de%2Findex.html%3Ftrack%3DWyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ&@w HTTP/1.1
Host: s4.histats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Tue, 07 Feb 2023 07:36:37 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 51
Connection: close
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F121b1de4-8f9a-42ce-aca5-9ff190235e9e.jpeg
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F121b1de4-8f9a-42ce-aca5-9ff190235e9e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 94a975a866d575be68f687fd81a36f5b
16f334adff0205badeb468d248f925504137782a
d550618f7c7e902ca0f4f57f8da3199b22063f242e0fa07f10fe6631b35e026b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F121b1de4-8f9a-42ce-aca5-9ff190235e9e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 5584
x-amzn-requestid: 130aa2ee-b175-4658-9c82-8f49944207dd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fpdejHeaIAMFYgQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63da0f90-4f9c757a30af548878052b0d;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 07:06:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 9URXL7tafn0kenWtzS1LRu2q0bgjM8ZC4NCS6L6MMPkvBqIHDOMugA==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 06 Feb 2023 22:15:10 GMT
age: 33693
etag: "16f334adff0205badeb468d248f925504137782a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
mtevor.com/cluster-v2/roblox-crn.js
200 OK 0 B URL HTTP/2 mtevor.com/cluster-v2/roblox-crn.js
IP
GET /cluster-v2/roblox-crn.js HTTP/1.1
Host: mtevor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-powered-by: PHP/5.6.40
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
content-encoding: br
vary: Accept-Encoding
date: Tue, 07 Feb 2023 07:36:36 GMT
server: LiteSpeed
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
i.ytimg.com/vi/KkMYCEIBe_s/mqdefault.jpg
200 OK 0 B URL HTTP/2 i.ytimg.com/vi/KkMYCEIBe_s/mqdefault.jpg
IP
GET /vi/KkMYCEIBe_s/mqdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/jpeg
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 21281
date: Tue, 07 Feb 2023 07:36:36 GMT
expires: Tue, 07 Feb 2023 09:36:36 GMT
cache-control: public, max-age=7200
etag: "1520882850"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
bux.wellter.de/images/fancyselect.css
200 OK 0 B URL HTTP/2 bux.wellter.de/images/fancyselect.css
IP
GET /images/fancyselect.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=4253
etag: W/"5d9ca488-109d"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v8%2B2AMaP2um2HkKrDUz1hgq54f7H2kS%2B9pnTWYvdhRmey0HZR7eD5WrpNDtZVnSGf1t%2FMj%2F4qtvRljoeeq%2BvKMBXz1gAgJfu%2FrC1Pa1K6Gq1V0011zDqxI7bb%2B2AW21U3w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe6db523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
200 OK 0 B URL HTTP/2 bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
IP
Analyzer Verdict Alert fortinet Phishing
GET /index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://omelhorhackdorobloxdowloadtoools.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/html
last-modified: Mon, 27 Jun 2022 12:44:26 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=23Dhrg1Xf0YdNeE4sMH23ZbtjGe3fXQr2DSIf%2BYe3nI7SJhgXSYaTfyCfIkm1H3Q75qRhY4iT6VgQW1Gug23ldTL2pyuHZ0IRYb5pWrrgMvDP0zDYtYgXB2A9c9cTLRr8A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 795a749dcca0b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/css8a7c8a7c8a7c.css?family=Open+Sans:300,400,700
200 OK 0 B URL HTTP/2 bux.wellter.de/images/css8a7c8a7c8a7c.css?family=Open+Sans:300,400,700
IP
GET /images/css8a7c8a7c8a7c.css?family=Open+Sans:300,400,700 HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=773
etag: W/"5d9ca488-305"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0R%2FRs8luKJ1dnyXaYJvUMJbipi0kaE8HIe0%2F5WZ7%2F0F%2FpqKDn1ayeoRdDQxJMEHfG0EB20jBXzJkZ83FwGA%2Fj3u2yaDJSNFsMs%2F1ucNJ4zwhzUEQIuURRLBDzH8ORbhThw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749eae52b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/bebasneue_bold-webfont.html
200 OK 0 B URL HTTP/2 bux.wellter.de/bebasneue_bold-webfont.html
IP
Analyzer Verdict Alert fortinet Phishing
GET /bebasneue_bold-webfont.html HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://bux.wellter.de/images/style.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:37 GMT
content-type: text/html
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=88kO%2Fi8gmC6asAxwtqrC8jAI4eup1BJ8PdS14%2B4A1OdCYXi1EezxlU%2F66wUu9dlcl2lPhNxSZ3Wtz0oMz23TrWsL10nkG6bGTNnjVXyRlwrL%2FA%2BRM0RgWSJlll%2BrML8MoA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 795a749f9fa0b523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/style.css
200 OK 0 B URL HTTP/2 bux.wellter.de/images/style.css
IP
GET /images/style.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=50839
etag: W/"5d9ca488-c697"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vnrm0yaKDgShha4ey3A1lG0%2FL3ClJTCjrDrTbeOpCM%2FUyOtAzjyFs6zQsA6s%2FOFx2Vx4mRKUqb3icbaXhW6yRMhvVwVhFTpswbKveSR6Mkyo3ImLdi9altfg%2FRnKKzP7LA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe70b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/sweetalert2.min.js
200 OK 0 B URL HTTP/2 bux.wellter.de/images/sweetalert2.min.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /images/sweetalert2.min.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-4f51"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RiUH8AyoB5sx1CiW%2Fng0mBeYs8n76P2CzRnQnxnaNRzjjav0WG2DANvqm5SC4Ro09opExI7Q4KuQqmc2MOKS8qZvLzfIY%2F5TieQtfQ6buF6OByeRaerfdVQXbPlnvwJYPg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ece88b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/jquery-ui.min.js
200 OK 0 B URL HTTP/2 bux.wellter.de/images/jquery-ui.min.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /images/jquery-ui.min.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-30da8"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2HTzN1wA0H69ODdQShPGrsWe6kZqDrAR3%2Fhp1dIvQvGRB4cy1xba85DFQudna5ws5xqOZFITHA5nx27shD9RUxbzAGGosZHu%2FUDkbEoQzs2FakhGByY%2F571SukuZ80uFrA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe81b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/sweetalert2.min.css
200 OK 0 B URL HTTP/2 bux.wellter.de/images/sweetalert2.min.css
IP
GET /images/sweetalert2.min.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-36a4"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6MjJqy0XJf%2FhlOLWws7ra4ioUw8%2BZXKeVBRihENnivlPWfo%2BdBjZIpz3HDhDdzBJ7T4%2FE6r4TeMTzYkxIX8sBBDTWOVdF9IIlU7N1gJAY7tb8dfAcxjAK%2FDH3wHly7dNNg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ebe67b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/font-awesome.min.css
200 OK 0 B URL HTTP/2 bux.wellter.de/images/font-awesome.min.css
IP
GET /images/font-awesome.min.css HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: text/css
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
etag: W/"5d9ca488-6c3d"
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=33cVhfX97%2BaXV7VvJwhox4vc1PU828d7t1l4tIaYPELRrVPfd%2BZwAiLAQn4LS8%2FI7q6drVejfmtmuAq0dQ9E44za17Hg%2FXPXA8ksCcNy%2BdpbZ%2F0ZOQlrTZSidR59RQ7bKw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749eae57b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bux.wellter.de/images/com.js
200 OK 0 B URL HTTP/2 bux.wellter.de/images/com.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /images/com.js HTTP/1.1
Host: bux.wellter.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bux.wellter.de/index.html?track=WyJyb2Jsb3gtY3JuLmpzIiwicmpvaGFuZGlnbWFpbGNvbSIsInRlbXBsYXRlIiwiRmFzdGluay54bWwiLCJyam9oYW5kaWdtYWlsY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwib21lbGhvcmhhY2tkb3JvYmxveGRvd2xvYWR0b29vbHMuYmxvZ3Nwb3QuY29tIiwiZGlyZWN0IiwicmVmIiwiZGlyZWN0IiwidGFncyIsInJvYmxveC1jcm4uanMiXQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 07 Feb 2023 07:36:36 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=17963
etag: W/"5d9ca488-462b"
last-modified: Tue, 08 Oct 2019 15:00:24 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 4892
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7hn7VVluiBUFjr3kAj84yRqwdqCyGMpTw79zZD5OKHq866yB8dCk5EBUlVs54CtpZErDoipPRbCvzBZllRfUeNB2MT%2Fiby2%2FuLUU7F%2BlfVMhEaTDwWDlv82KL3tvCKgRVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 795a749ece96b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
172.217.21.161
188.114.98.234
149.56.240.131
95.101.11.115
93.184.220.29
104.18.22.39
46.105.201.240