Overview

URLmonthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968/
IP 54.161.16.68 (United States)
ASN#14618 AMAZON-AES
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-12-01 00:07:33 UTC
StatusLoading report..
IDS alerts0
Blocklist alert6
urlquery alerts No alerts detected
Tags None

Domain Summary (36)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-11-30 17:13:24 UTC 34.117.237.239
fonts.gstatic.com (4) 0 2014-09-09 00:40:21 UTC 2022-11-30 22:48:06 UTC 216.58.207.227 Domain (gstatic.com) ranked at: 540
d2m2wsoho8qq12.cloudfront.net (1) 0 No data No data 143.204.42.159 Unknown ranking
ocsp.globalsign.com (1) 2075 2012-05-25 06:20:55 UTC 2022-11-30 17:14:19 UTC 104.18.21.226
ldsapi.tmginteractive.com (5) 85617 No data No data 209.151.244.116
ocsp.usertrust.com (1) 899 2012-05-21 15:43:18 UTC 2022-11-30 17:12:14 UTC 172.64.155.188
in.hotjar.com (1) 1746 2018-10-22 17:15:59 UTC 2022-11-30 17:13:12 UTC 54.76.221.57
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-11-30 17:19:42 UTC 34.160.144.191
cdnjs.cloudflare.com (2) 235 2020-10-20 10:17:36 UTC 2022-11-30 18:32:23 UTC 104.17.25.14
code.jquery.com (1) 634 2012-05-21 17:28:02 UTC 2022-11-30 17:12:59 UTC 69.16.175.42
r3.o.lencr.org (4) 344 2020-12-02 08:52:13 UTC 2022-11-30 17:12:16 UTC 23.36.77.32
tmgassets.azureedge.net (10) 0 No data No data 13.107.246.53 Domain (azureedge.net) ranked at: 2986
img-getpocket.cdn.mozilla.net (4) 1631 2017-09-01 03:40:57 UTC 2022-11-30 17:26:07 UTC 34.120.237.76
vars.hotjar.com (1) 1014 2020-11-05 10:13:14 UTC 2022-11-30 19:09:09 UTC 143.204.55.105
push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-11-30 17:12:17 UTC 54.148.70.121
www.google.com (1) 7 2015-07-09 17:04:24 UTC 2022-11-30 21:17:02 UTC 216.58.211.4
use.fontawesome.com (3) 942 2017-01-30 04:43:25 UTC 2022-11-30 17:14:11 UTC 172.64.132.15
script.hotjar.com (1) 887 2020-11-05 16:23:46 UTC 2022-11-30 22:41:28 UTC 143.204.55.40
create.leadid.com (5) 14598 No data No data 50.16.132.247
deviceid.trueleadid.com (1) 2097 No data No data 34.194.94.191
fonts.googleapis.com (1) 8877 2013-06-10 20:14:26 UTC 2022-11-30 21:05:51 UTC 142.250.74.74
monthlysweeps.us (14) 0 No data No data 54.161.16.68 Unknown ranking
ocsp.sca1b.amazontrust.com (5) 1015 2017-03-03 15:20:51 UTC 2019-03-27 04:05:54 UTC 143.204.42.88
ocsp.pki.goog (10) 175 2017-06-14 07:23:31 UTC 2022-11-30 17:12:14 UTC 142.250.74.131
www.gstatic.com (1) 0 2016-07-26 09:37:06 UTC 2022-11-30 22:12:22 UTC 142.250.74.35 Domain (gstatic.com) ranked at: 540
api.trustedform.com (4) 23021 No data No data 35.173.51.161
static.hotjar.com (1) 641 2014-11-01 05:14:27 UTC 2022-11-30 17:12:03 UTC 54.230.111.8
ocsp.digicert.com (9) 86 2012-05-21 07:02:23 UTC 2022-11-30 20:24:46 UTC 93.184.220.29
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-11-30 17:12:31 UTC 34.102.187.140
cdn.jsdelivr.net (2) 439 2012-09-30 00:15:09 UTC 2022-11-30 17:12:06 UTC 151.101.129.229
ads.pro-market.net (1) 47212 No data No data 23.36.76.115
www.google-analytics.com (1) 40 2013-07-28 22:04:32 UTC 2022-11-30 22:10:37 UTC 142.250.74.110
cdn.trustedform.com (2) 24659 No data No data 54.230.111.91
ocsp.sectigo.com (1) 487 2018-12-17 11:31:55 UTC 2022-11-30 21:13:57 UTC 104.18.32.68
create.lidstatic.com (1) 24133 No data No data 104.22.39.182
stackpath.bootstrapcdn.com (2) 2467 2018-04-05 04:41:29 UTC 2022-11-30 23:18:08 UTC 104.18.11.207

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-01 2 monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/1694 (...) Phishing
2022-12-01 2 monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/1694 (...) Phishing
2022-12-01 2 monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/1694 (...) Phishing
2022-12-01 2 monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/1694 (...) Phishing
2022-12-01 2 monthlysweeps.us/assets/js/datepicker.js Phishing
2022-12-01 2 monthlysweeps.us/go/api/zip/undefined?get_param=value Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 54.161.16.68
Date UQ / IDS / BL URL IP
2023-01-06 09:19:01 +0000 0 - 0 - 6 smoothreward.com/go/to/f388f2/key/2b81b678a4e (...) 54.161.16.68
2023-01-06 09:11:50 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/cdd777f9ae8 (...) 54.161.16.68
2023-01-06 09:11:22 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/9cd0dfd52a6 (...) 54.161.16.68
2023-01-06 09:11:17 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/9cd0dfd52a6 (...) 54.161.16.68
2023-01-06 09:11:16 +0000 0 - 0 - 6 monthlysweeps.us/go/to/59bdf0/key/5cbf043f03f (...) 54.161.16.68


Last 5 reports on ASN: AMAZON-AES
Date UQ / IDS / BL URL IP
2023-02-01 11:26:18 +0000 0 - 0 - 3 x8830.infura-ipfs.io/ipfs/QmQsc7gTQZjf8yaMe3G (...) 54.80.64.45
2023-02-01 11:24:34 +0000 0 - 0 - 1 100.24.245.45/mua/VALIDATEOTP/scis/j6UnVHZsit (...) 100.24.245.45
2023-02-01 11:24:25 +0000 0 - 0 - 1 3.219.101.5/mua/VALIDATEOTP/scis/j6UnVHZsitlY (...) 3.219.101.5
2023-02-01 11:24:23 +0000 0 - 0 - 1 52.206.55.41/mua/VALIDATEOTP/scis/j6UnVHZsitl (...) 52.206.55.41
2023-02-01 11:24:21 +0000 0 - 0 - 1 3.211.240.121/mua/VALIDATEOTP/scis/j6UnVHZsit (...) 3.211.240.121


Last 5 reports on domain: monthlysweeps.us
Date UQ / IDS / BL URL IP
2023-01-31 18:11:52 +0000 0 - 0 - 3 monthlysweeps.us/go/to/ss28jn/key/31528eecbdf (...) 3.212.250.95
2023-01-31 18:11:51 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/a0ebbc9dfc4 (...) 107.23.100.94
2023-01-31 18:11:46 +0000 0 - 0 - 4 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 3.212.250.95
2023-01-31 18:11:40 +0000 0 - 0 - 6 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 3.212.250.95
2023-01-31 18:11:39 +0000 0 - 0 - 4 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 107.23.100.94


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-31 18:11:46 +0000 0 - 0 - 4 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 3.212.250.95
2023-01-31 18:11:40 +0000 0 - 0 - 6 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 3.212.250.95
2023-01-31 18:11:39 +0000 0 - 0 - 4 monthlysweeps.us/go/to/59bdf0/key/43c47717b15 (...) 107.23.100.94
2023-01-30 18:06:57 +0000 0 - 0 - 5 monthlysweeps.us/go/to/59bdf0/key/0410fe1f832 (...) 3.212.250.95
2023-01-30 18:06:52 +0000 0 - 0 - 4 monthlysweeps.us/go/to/59bdf0/key/0410fe1f832 (...) 107.23.100.94

JavaScript

Executed Scripts (48)

Executed Evals (9)
#1 JavaScript::Eval (size: 39) - SHA256: bc114735fe8d3e02b9eceb0fdc400c18b45fea0bd615a0e52de3b991a1aa09d2
tmgShowingLiveViewOnly_1320340452 = true;
#2 JavaScript::Eval (size: 14) - SHA256: 0510de046e8325540849bad09f31eaaa3e9256fafd330c5d57327dc948812a33
/*@cc_on!@*/ !1
#3 JavaScript::Eval (size: 15576) - SHA256: d4be0587aacd19697ae508209e99aa30536e2b75393db507b1cd329131d8e19c
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var E = function(n) {
            return n
        },
        T = function(n, I) {
            if ((I = (n = null, e.trustedTypes), !I) || !I.createPolicy) return n;
            try {
                n = I.createPolicy("bg", {
                    createHTML: E,
                    createScript: E,
                    createScriptURL: E
                })
            } catch (L) {
                e.console && e.console.error(L.message)
            }
            return n
        },
        e = this || self;
    (0, eval)(function(n, I) {
        return (I = T()) && 1 === n.eval(I.createScript("1")) ? function(L) {
            return I.createScript(L)
        } : function(L) {
            return "" + L
        }
    }(e)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var y,nv=function(n,E,I,e){for(e=(I=a(E),0);0<n;n--)e=e<<8|z(E);Z(I,E,e)},c=function(n,E,I,e,X,L){if(n.N.length){(n.R=(n.R&&0(),true),n).rY=E;try{e=n.Z(),n.G=e,n.I=0,n.Y=e,L=Ia(E,n),X=n.Z()-n.Y,n.D+=X,X<(I?0:10)||0>=n.l--||(X=Math.floor(X),n.F.push(254>=X?X:254))}finally{n.R=false}return L}},iN=function(n,E,I){if((I=typeof n,"object")==I)if(n){if(n instanceof Array)return"array";if(n instanceof Object)return I;if((E=Object.prototype.toString.call(n),"[object Window]")==E)return"object";if("[object Array]"==E||"number"==typeof n.length&&"undefined"!=typeof n.splice&&"undefined"!=typeof n.propertyIsEnumerable&&!n.propertyIsEnumerable("splice"))return"array";if("[object Function]"==E||"undefined"!=typeof n.call&&"undefined"!=typeof n.propertyIsEnumerable&&!n.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==I&&"undefined"==typeof n.call)return"object";return I},m=function(n,E){n.N.splice(0,0,E)},Lv=function(n,E){return(n=n.create().shift(),E.S).create().length||E.v.create().length||(E.v=void 0,E.S=void 0),n},P=function(n,E,I,e,X,L){if(!E.U){if(3<(I=(0==((L=void 0,I&&I[0]===r)&&(n=I[1],L=I[2],I=void 0),X=Q(19,E),X).length&&(e=Q(117,E)>>3,X.push(n,e>>8&255,e&255),void 0!=L&&X.push(L&255)),n="",I&&(I.message&&(n+=I.message),I.stack&&(n+=":"+I.stack)),Q(504,E)),I)){E.L=(L=(n=(I-=(n=n.slice(0,(I|0)-3),n.length|0)+3,EK(n)),E.L),E);try{G(E,446,f(2,n.length).concat(n),9)}finally{E.L=L}}Z(504,E,I)}},b=function(n,E,I){n[Z(I,E,n),ev]=2796},Tl=function(n,E){(E.push(n[0]<<24|n[1]<<16|n[2]<<8|n[3]),E.push(n[4]<<24|n[5]<<16|n[6]<<8|n[7]),E).push(n[8]<<24|n[9]<<16|n[10]<<8|n[11])},gN=function(n,E,I,e){G(n,(I=(e=a(n),a(n)),I),f(E,Q(e,n)))},Xn=function(n,E){if(E=(n=q.trustedTypes,null),!n||!n.createPolicy)return E;try{E=n.createPolicy("bg",{createHTML:x0,createScript:x0,createScriptURL:x0})}catch(I){q.console&&q.console.error(I.message)}return E},aa=function(n,E,I,e){return(e=O[n.substring(0,3)+"_"])?e(n.substring(3),E,I):wN(E,n)},DU=function(n,E,I,e){try{e=n[((E|0)+2)%3],n[E]=(n[E]|0)-(n[((E|0)+1)%3]|0)-(e|0)^(1==E?e<<I:e>>>I)}catch(X){throw X;}},Q=function(n,E){if(void 0===(E=E.K[n],E))throw[r,30,n];if(E.value)return E.create();return E.create(1*n*n+-43*n+-56),E.prototype},ZU=function(n,E,I,e,X,L){for(e=(L=(I=((X=a((E=n[zl]||{},n)),E.TW=a(n),E).P=[],n.L==n)?(z(n)|0)-1:1,a(n)),0);e<I;e++)E.P.push(a(n));for(E.A=Q(X,n);I--;)E.P[I]=Q(E.P[I],n);return E.Kv=Q(L,n),E},Mi=function(n,E,I,e,X){G(n,(((e=Q((X=a((e=(I=E&4,E&=3,a(n)),n)),e),n),I)&&(e=EK(""+e)),E)&&G(n,X,f(2,e.length)),X),e)},EK=function(n,E,I,e,X){for(X=E=(n=n.replace(/\\r\\n/g,"\\n"),I=[],0);X<n.length;X++)e=n.charCodeAt(X),128>e?I[E++]=e:(2048>e?I[E++]=e>>6|192:(55296==(e&64512)&&X+1<n.length&&56320==(n.charCodeAt(X+1)&64512)?(e=65536+((e&1023)<<10)+(n.charCodeAt(++X)&1023),I[E++]=e>>18|240,I[E++]=e>>12&63|128):I[E++]=e>>12|224,I[E++]=e>>6&63|128),I[E++]=e&63|128);return I},O,a=function(n,E){if(n.S)return Lv(n.v,n);return(E=h(8,n,true),E&128)&&(E^=128,n=h(2,n,true),E=(E<<2)+(n|0)),E},A=function(n,E){E.T=((E.T?E.T+"~":"E:")+n.message+":"+n.stack).slice(0,2048)},mC=function(n,E,I,e,X){if((I=n[0],I)==N)E.l=25,E.u(n);else if(I==k){X=n[1];try{e=E.T||E.u(n)}catch(L){A(L,E),e=E.T}X(e)}else if(I==uN)E.u(n);else if(I==l)E.u(n);else if(I==WU){try{for(e=0;e<E.C.length;e++)try{X=E.C[e],X[0][X[1]](X[2])}catch(L){}}catch(L){}(0,n[1])(function(L,T){E.o(L,true,T)},(E.C=[],function(L){(m(E,(L=!E.N.length,[cU])),L)&&c(E,true,false)}))}else{if(I==H)return e=n[2],Z(264,E,n[6]),Z(98,E,e),E.u(n);I==cU?(E.F=[],E.K=null,E.X=[]):I==ev&&"loading"===q.document.readyState&&(E.h=function(L,T){function g(){T||(T=true,L())}q.document.addEventListener("DOMContentLoaded",(T=false,g),F),q.addEventListener("load",g,F)})}},F={passive:true,capture:true},wN=function(n,E){return n(function(I){I(E)}),[function(){return E}]},x0=function(n){return n},sK=function(n,E){Z(169,n,(n.mu.push(n.K.slice()),n.K[169]=void 0,E))},v=function(n,E,I,e,X,L,T,g,x){if(I.L=(T=(x=(g=(L=0<(E||I.I++,I).W&&I.R&&I.rY&&1>=I.B&&!I.S&&!I.h&&(!E||1<I.J-e)&&0==document.hidden,(X=4==I.I)||L)?I.Z():I.G,g)-I.G,x>>14),I.H&&(I.H^=T*(x<<2)),I.j+=T,T)||I.L,X||L)I.I=0,I.G=g;if(!L||g-I.Y<I.W-(n?255:E?5:2))return false;return I.h=((Z((n=Q(E?117:169,(I.J=e,I)),169),I,I.O),I).N.push([uN,n,E?e+1:e]),B),true},Ia=function(n,E,I,e){for(;E.N.length;){e=(E.h=null,E).N.pop();try{I=mC(e,E)}catch(X){A(X,E)}if(n&&E.h){n=E.h,n(function(){c(E,true,true)});break}}return I},Q6=function(n,E,I,e){return Q((Z(169,(rN(n,(e=Q(169,n),n.X&&e<n.O?(Z(169,n,n.O),sK(n,E)):Z(169,n,E),I)),n),e),98),n)},bN=function(n,E,I,e,X){for(e=(I.xv=((I.uV=((I.aN=I[k],I).zW=V6,tI),I).Lv=Y0({get:function(){return this.concat()}},I.g),J[I.g](I.Lv,{value:{value:{}}})),0),X=[];128>e;e++)X[e]=String.fromCharCode(e);c(I,true,(m(I,(m(I,(m(I,(Z(6,(b(function(L,T,g,x,w,D){v(false,true,L,T)||(w=ZU(L.L),T=w.P,D=w.A,g=T.length,x=w.Kv,w=w.TW,T=0==g?new x[D]:1==g?new x[D](T[0]):2==g?new x[D](T[0],T[1]):3==g?new x[D](T[0],T[1],T[2]):4==g?new x[D](T[0],T[1],T[2],T[3]):2(),Z(w,L,T))},(Z(446,I,R((b(function(L,T,g,x,w,D){if(!v(true,true,L,T)){if((D=(w=Q((T=(g=(D=a(L),T=a(L),a(L)),w=a(L),Q)(T,L),w),L),Q(D,L)),L=Q(g,L),"object")==iN(D)){for(x in g=[],D)g.push(x);D=g}for(x=0,g=D.length,L=0<L?L:1;x<g;x+=L)T(D.slice(x,(x|0)+(L|0)),w)}},I,((b(function(L){nv(4,L)},(b(function(L,T,g,x,w,D,M){for(x=(T=(g=Q((D=a(L),w=dN(L),M="",157),L),g.length),0);w--;)x=((x|0)+(dN(L)|0))%T,M+=X[g[x]];Z(D,L,M)},I,(Z(409,(I.cV=(Z(373,I,[160,(b(function(L,T,g,x){Z((x=Q((g=(T=a((g=(x=a(L),a(L)),L)),Q(g,L)),x),L),T),L,x[g])},(b(function(L,T,g,x,w){Z((w=(g=(g=a((x=(T=a(L),a(L)),L)),w=a(L),Q)(g,L),x=Q(x,L),Q(w,L)),T),L,PU(x,w,L,g))},I,(b(function(L,T,g,x,w){for(x=(w=(g=dN((T=a(L),L)),[]),0);x<g;x++)w.push(z(L));Z(T,L,w)},I,(b(function(L){gN(L,1)},(b(function(L,T,g,x){!v(false,true,L,T)&&(T=ZU(L),x=T.Kv,g=T.A,L.L==L||g==L.S0&&x==L)&&(Z(T.TW,L,g.apply(x,T.P)),L.G=L.Z())},(b(function(L,T,g,x){Z((g=Q((T=a((g=a(L),L)),x=Q(T,L),g),L),T),L,x+g)},(Z(19,I,(b(function(L,T,g){Z((g=(T=a(L),a(L)),T=Q(T,L),T=iN(T),g),L,T)},I,(b(function(L,T,g,x){Z((T=a((x=(g=a(L),a(L)),L)),T),L,Q(g,L)||Q(x,L))},I,(b(function(L,T){L=(T=a(L),Q)(T,L.L),L[0].removeEventListener(L[1],L[2],F)},(b(function(L,T,g){v(false,true,L,T)||(T=a(L),g=a(L),Z(g,L,function(x){return eval(x)}(Gl(Q(T,L.L)))))},I,(b(function(L){Mi(L,3)},I,(b(function(L,T,g){0!=(g=(g=(T=a(L),a(L)),Q)(g,L),Q(T,L))&&Z(169,L,g)},(Z(426,I,(b(function(L,T,g,x,w){x=(T=Q((g=(w=(T=(x=a(L),g=a(L),a)(L),a(L)),Q(g,L)),w=Q(w,L),T),L),Q)(x,L.L),0!==x&&(T=PU(T,1,L,w,x,g),x.addEventListener(g,T,F),Z(426,L,[x,g,T]))},(Z((b(function(L){gN(L,4)},(b(function(L,T,g,x){Z((x=(T=(x=a(L),a(L)),g=a(L),T=Q(T,L),Q(x,L)),g),L,x in T|0)},(Z(258,(Z(504,(Z(98,I,(b(function(){},I,(b(function(L,T,g,x){Z((T=z((x=a(L),L)),g=a(L),g),L,Q(x,L)>>>T)},I,(b(function(L,T,g){Z((g=(T=a(L),a(L)),g),L,""+Q(T,L))},I,(b(function(L,T){sK((T=Q(a(L),L),L.L),T)},I,(b(function(L,T,g,x,w,D,M,W,t,p,V,u){function U(Y,d){for(;g<Y;)u|=z(L)<<g,g+=8;return u>>=(d=u&(1<<(g-=Y,Y))-1,Y),d}for(w=(x=(g=(V=a(L),u=0),M=(U(3)|0)+1,U(5)),[]),D=T=0;D<x;D++)W=U(1),w.push(W),T+=W?0:1;for(p=(D=(T=((T|0)-1).toString(2).length,0),[]);D<x;D++)w[D]||(p[D]=U(T));for(T=0;T<x;T++)w[T]&&(p[T]=a(L));for(t=[];M--;)t.push(Q(a(L),L));b(function(Y,d,y6,C,S){for(C=(y6=[],S=[],0);C<x;C++){if(d=p[C],!w[C]){for(;d>=S.length;)S.push(a(Y));d=S[d]}y6.push(d)}(Y.S=fv(t.slice(),Y),Y).v=fv(y6,Y)},L,V)},I,(b(function(L,T,g,x){if(x=L.mu.pop()){for(g=z(L);0<g;g--)T=a(L),x[T]=L.K[T];L.K=(x[504]=(x[19]=L.K[19],L).K[504],x)}else Z(169,L,L.O)},(b(function(L){Mi(L,4)},I,(b(function(L,T,g,x){(x=(g=a((T=a(L),L)),a(L)),L.L==L)&&(g=Q(g,L),x=Q(x,L),Q(T,L)[g]=x,226==T&&(L.i=void 0,2==g&&(L.H=h(32,L,false),L.i=void 0)))},I,(b(function(L,T,g,x){T=(g=a((T=(x=a(L),a(L)),L)),x=Q(x,L),Q)(T,L),Z(g,L,+(x==T))},I,(Z(90,((Z(117,(((I.l=25,(I.T=void 0,(e=window.performance||{},(I.v=(I.XU=0,void 0),I.K=[],I).rY=(I.X=[],(I.O=0,I.W=0,I).N=[],I.H=(I.mu=[],I.R=false,void 0),I.B=0,false),I).S=void 0,I.F=[],I).j=(I.Y=0,I.V=void 0,I.G=0,I.D=0,1),I).pv=(I.J=8001,(I.I=void 0,I.h=(I.S0=function(L){this.L=L},null),I.L=(I.C=[],I),I).U=false,(I.i=void 0,e).timeOrigin||(e.timing||{}).navigationStart||0),Z)(169,I,0),I),0),I).Yv=0,I),[]),111)),292)),Z(184,I,353),170)),I),382),286)),390)),281)),7)),326)),{})),I),2048),I),[0,0,0]),I),44),I),84),207),I,q),I),396),0)),I),323),177)),442)),I),81),376)),433)),[])),I),14),I),222),I),347),287)),50)),I),123),0),0]),0),I),I),205)),I),432),I).vV=0,215)),4))),I),228),I),0),[ev])),[l,n])),[WU,E])),true))},R=function(n,E){for(E=[];n--;)E.push(255*Math.random()|0);return E},f=function(n,E,I,e){for(e=(I=(n|0)-1,[]);0<=I;I--)e[(n|0)-1-(I|0)]=E>>8*I&255;return e},Y0=function(n,E){return J[E](J.prototype,{splice:n,floor:n,pop:n,stack:n,document:n,call:n,length:n,prototype:n,parent:n,console:n,propertyIsEnumerable:n,replace:n})},Z=function(n,E,I){if(169==n||117==n)E.K[n]?E.K[n].concat(I):E.K[n]=fv(I,E);else{if(E.U&&226!=n)return;373==n||446==n||90==n||19==n||258==n?E.K[n]||(E.K[n]=pv(118,E,I,n)):E.K[n]=pv(81,E,I,n)}226==n&&(E.H=h(32,E,false),E.i=void 0)},qi=function(n,E,I,e){function X(){}return{invoke:(e=aa((I=void 0,n),function(L){X&&(E&&B(E),I=L,X(),X=void 0)},!!E)[0],function(L,T,g,x){function w(){I(function(D){B(function(){L(D)})},g)}if(!T)return T=e(g),L&&L(T),T;I?w():(x=X,X=function(){(x(),B)(w)})})}},OK=function(n,E,I){if(3==n.length){for(I=0;3>I;I++)E[I]+=n[I];for(I=[13,8,13,12,16,(n=0,5),3,10,15];9>n;n++)E[3](E,n%3,I[n])}},K=function(n,E,I){I=this;try{bN(E,n,this)}catch(e){A(e,this),n(function(X){X(I.T)})}},dN=function(n,E){return E=z(n),E&128&&(E=E&127|z(n)<<7),E},UK=function(n,E,I,e,X){for(X=(I=I[e=I[2]|0,3]|0,0);14>X;X++)n=n>>>8|n<<24,n+=E|0,n^=e+2298,I=I>>>8|I<<24,E=E<<3|E>>>29,I+=e|0,I^=X+2298,E^=n,e=e<<3|e>>>29,e^=I;return[E>>>24&255,E>>>16&255,E>>>8&255,E>>>0&255,n>>>24&255,n>>>16&255,n>>>8&255,n>>>0&255]},hI=function(n,E,I){return E.o(function(e){I=e},false,n),I},z=function(n){return n.S?Lv(n.v,n):h(8,n,true)},jv=function(n,E){return E[n]<<24|E[(n|0)+1]<<16|E[(n|0)+2]<<8|E[(n|0)+3]},rN=function(n,E,I,e,X,L){if(!n.T){n.B++;try{for(X=(L=0,n.O),e=void 0;--E;)try{if(I=void 0,n.S)e=Lv(n.S,n);else{if((L=Q(169,n),L)>=X)break;e=Q((Z(117,n,L),I=a(n),I),n)}v(false,false,(e&&e[cU]&2048?e(n,E):P(0,n,[r,21,I]),n),E)}catch(T){Q(184,n)?P(22,n,T):Z(184,n,T)}if(!E){if(n.gY){rN(n,(n.B--,168668240895));return}P(0,n,[r,33])}}catch(T){try{P(22,n,T)}catch(g){A(g,n)}}n.B--}},G=function(n,E,I,e,X,L){if(n.L==n)for(L=Q(E,n),446==E?(E=function(T,g,x,w){if((w=(x=L.length,(x|0)-4>>3),L.q7)!=w){g=[0,(w=(w<<3)-(L.q7=w,4),0),X[1],X[2]];try{L.O$=UK(jv((w|0)+4,L),jv(w,L),g)}catch(D){throw D;}}L.push(L.O$[x&7]^T)},X=Q(258,n)):E=function(T){L.push(T)},e&&E(e&255),n=0,e=I.length;n<e;n++)E(I[n])},fv=function(n,E,I){return((I=J[E.g](E.xv),I)[E.g]=function(){return n},I).concat=function(e){n=e},I},h=function(n,E,I,e,X,L,T,g,x,w,D,M,W,t){if((g=Q(169,E),g)>=E.O)throw[r,31];for(w=(e=(D=E.aN.length,n),0),x=g;0<e;)T=x>>3,t=x%8,W=8-(t|0),L=E.X[T],W=W<e?W:e,I&&(X=E,X.i!=x>>6&&(X.i=x>>6,M=Q(226,X),X.V=UK(X.i,X.H,[0,0,M[1],M[2]])),L^=E.V[T&D]),x+=W,w|=(L>>8-(t|0)-(W|0)&(1<<W)-1)<<(e|0)-(W|0),e-=W;return Z(169,E,(I=w,(g|0)+(n|0))),I},q=this||self,B=q.requestIdleCallback?function(n){requestIdleCallback(function(){n()},{timeout:4})}:q.setImmediate?function(n){setImmediate(n)}:function(n){setTimeout(n,0)},PU=function(n,E,I,e,X,L){function T(){if(I.L==I){if(I.K){var g=[H,n,e,void 0,X,L,arguments];if(2==E)var x=c(I,(m(I,g),false),false);else if(1==E){var w=!I.N.length;(m(I,g),w)&&c(I,false,false)}else x=mC(g,I);return x}X&&L&&X.removeEventListener(L,T,F)}}return T},pv=function(n,E,I,e,X,L,T,g){return((L=(T=n&(X=$0,I=[89,-43,5,1,4,91,I,75,51,-20],7),J[E.g](E.Lv)),L)[E.g]=function(x){T+=6+7*n,g=x,T&=7},L).concat=function(x){return(g=(x=(x=e%16+1,-40*e*e*g-x*g- -2240*g+I[T+51&7]*e*x+40*g*g+T+1*e*e*x- -1720*e*g+(X()|0)*x),void 0),x=I[x],I[(T+13&7)+(n&2)]=x,I)[T+(n&2)]=-43,x},L},zl=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),cU=((K.prototype.gY=false,K.prototype.dY=void 0,K).prototype.s="toString",K.prototype.BV=void 0,[]),H=[],l=[],k=[],ev=[],WU=[],r={},N=[],uN=[],$0=((y=(((Tl,function(){})(R),DU,function(){})(OK),K.prototype.g="create",K.prototype),y).bV=function(n,E,I){return n^((E=((E^=E<<13,E^=E>>17,E)^E<<5)&I)||(E=1),E)},void 0),J=(y.o=(y.HV=function(){return Math.floor(this.D+(this.Z()-this.Y))},((y.GW=function(n,E,I,e,X,L){for(X=(e=L=0,[]);L<n.length;L++)for(I=I<<E|n[L],e+=E;7<e;)e-=8,X.push(I>>e&255);return X},y).Z=(y.he=function(){return Math.floor(this.Z())},(window.performance||{}).now)?function(){return this.pv+window.performance.now()}:function(){return+new Date},y).PV=function(n,E,I,e,X){for(e=X=0;X<n.length;X++)e+=n.charCodeAt(X),e+=e<<10,e^=e>>6;return X=new Number((n=(e+=e<<3,e^=e>>11,e+(e<<15)>>>0),n&(1<<E)-1)),X[0]=(n>>>E)%I,X},function(n,E,I,e,X){if(I="array"===iN(I)?I:[I],this.T)n(this.T);else try{e=[],X=!this.N.length,m(this,[N,e,I]),m(this,[k,n,e]),E&&!X||c(this,E,true)}catch(L){A(L,this),n(this.T)}}),r).constructor;(K.prototype.u=function(n,E){return $0=function(){return n==E?-56:-98},E={},n={},function(I,e,X,L,T,g,x,w,D,M,W,t,p,V,u){n=(t=n,E);try{if(e=I[0],e==l){p=I[1];try{for(x=(u=(V=[],L=0,atob(p)),0);L<u.length;L++)T=u.charCodeAt(L),255<T&&(V[x++]=T&255,T>>=8),V[x++]=T;Z(226,this,(this.O=(this.X=V,this).X.length<<3,[0,0,0]))}catch(U){P(17,this,U);return}rN(this,8001)}else if(e==N)I[1].push(Q(373,this).length,Q(504,this),Q(446,this).length,Q(90,this).length),Z(98,this,I[2]),this.K[67]&&Q6(this,Q(67,this),8001);else{if(e==k){(w=(V=I[2],f(2,(Q(373,this).length|0)+2)),X=this.L,this).L=this;try{W=Q(19,this),0<W.length&&G(this,373,f(2,W.length).concat(W),10),G(this,373,f(1,this.j),109),G(this,373,f(1,this[k].length)),u=0,u+=Q(6,this)&2047,u-=(Q(373,this).length|0)+5,D=Q(446,this),4<D.length&&(u-=(D.length|0)+3),0<u&&G(this,373,f(2,u).concat(R(u)),15),4<D.length&&G(this,373,f(2,D.length).concat(D),156)}finally{this.L=X}if(g=((x=R(2).concat(Q(373,this)),x[1]=x[0]^6,x)[3]=x[1]^w[0],x[4]=x[1]^w[1],this).N7(x))g="!"+g;else for(u=0,g="";u<x.length;u++)M=x[u][this.s](16),1==M.length&&(M="0"+M),g+=M;return Q(((Z(504,this,((L=g,Q)(373,this).length=V.shift(),V.shift())),Q(446,this)).length=V.shift(),90),this).length=V.shift(),L}if(e==uN)Q6(this,I[1],I[2]);else if(e==H)return Q6(this,I[1],8001)}}finally{n=t}}}(),K.prototype.yC=0,K.prototype).N7=function(n,E,I,e){if(I=window.btoa){for(e="",E=0;E<n.length;E+=8192)e+=String.fromCharCode.apply(null,n.slice(E,E+8192));n=I(e).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else n=void 0;return n},K.prototype.Z4=0;var V6,tI=/./,AI=(K.prototype[WU]=[0,0,1,1,0,1,1],l.pop.bind(K.prototype[N])),Gl=function(n,E){return(E=Xn())&&1===n.eval(E.createScript("1"))?function(I){return E.createScript(I)}:function(I){return""+I}}(((V6=Y0({get:AI},(tI[K.prototype.s]=AI,K.prototype.g)),K).prototype.iV=void 0,q));(O=q.botguard||(q.botguard={}),40<O.m)||(O.m=41,O.bg=qi,O.a=aa),O.kDL_=function(n,E,I){return[(I=new K(E,n),function(e){return hI(e,I)})]};}).call(this);'));
}).call(this);
#4 JavaScript::Eval (size: 22) - SHA256: 662748d1507b16ab56d1bceff58b8302eb43f21ce0de70b24b21b8ef39aeff35
0,
function(L) {
    nv(2, L)
}
#5 JavaScript::Eval (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
#6 JavaScript::Eval (size: 18747) - SHA256: 0793e912ebb0ec6498bf42c00dc2190adbf9ccdbd517baf5d436b6a230e34832
(function() {
    var y, nv = function(n, E, I, e) {
            for (e = (I = a(E), 0); 0 < n; n--) e = e << 8 | z(E);
            Z(I, E, e)
        },
        c = function(n, E, I, e, X, L) {
            if (n.N.length) {
                (n.R = (n.R && 0(), true), n).rY = E;
                try {
                    e = n.Z(), n.G = e, n.I = 0, n.Y = e, L = Ia(E, n), X = n.Z() - n.Y, n.D += X, X < (I ? 0 : 10) || 0 >= n.l-- || (X = Math.floor(X), n.F.push(254 >= X ? X : 254))
                } finally {
                    n.R = false
                }
                return L
            }
        },
        iN = function(n, E, I) {
            if ((I = typeof n, "object") == I)
                if (n) {
                    if (n instanceof Array) return "array";
                    if (n instanceof Object) return I;
                    if ((E = Object.prototype.toString.call(n), "[object Window]") == E) return "object";
                    if ("[object Array]" == E || "number" == typeof n.length && "undefined" != typeof n.splice && "undefined" != typeof n.propertyIsEnumerable && !n.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == E || "undefined" != typeof n.call && "undefined" != typeof n.propertyIsEnumerable && !n.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == I && "undefined" == typeof n.call) return "object";
            return I
        },
        m = function(n, E) {
            n.N.splice(0, 0, E)
        },
        Lv = function(n, E) {
            return (n = n.create().shift(), E.S).create().length || E.v.create().length || (E.v = void 0, E.S = void 0), n
        },
        P = function(n, E, I, e, X, L) {
            if (!E.U) {
                if (3 < (I = (0 == ((L = void 0, I && I[0] === r) && (n = I[1], L = I[2], I = void 0), X = Q(19, E), X).length && (e = Q(117, E) >> 3, X.push(n, e >> 8 & 255, e & 255), void 0 != L && X.push(L & 255)), n = "", I && (I.message && (n += I.message), I.stack && (n += ":" + I.stack)), Q(504, E)), I)) {
                    E.L = (L = (n = (I -= (n = n.slice(0, (I | 0) - 3), n.length | 0) + 3, EK(n)), E.L), E);
                    try {
                        G(E, 446, f(2, n.length).concat(n), 9)
                    } finally {
                        E.L = L
                    }
                }
                Z(504, E, I)
            }
        },
        b = function(n, E, I) {
            n[Z(I, E, n), ev] = 2796
        },
        Tl = function(n, E) {
            (E.push(n[0] << 24 | n[1] << 16 | n[2] << 8 | n[3]), E.push(n[4] << 24 | n[5] << 16 | n[6] << 8 | n[7]), E).push(n[8] << 24 | n[9] << 16 | n[10] << 8 | n[11])
        },
        gN = function(n, E, I, e) {
            G(n, (I = (e = a(n), a(n)), I), f(E, Q(e, n)))
        },
        Xn = function(n, E) {
            if (E = (n = q.trustedTypes, null), !n || !n.createPolicy) return E;
            try {
                E = n.createPolicy("bg", {
                    createHTML: x0,
                    createScript: x0,
                    createScriptURL: x0
                })
            } catch (I) {
                q.console && q.console.error(I.message)
            }
            return E
        },
        aa = function(n, E, I, e) {
            return (e = O[n.substring(0, 3) + "_"]) ? e(n.substring(3), E, I) : wN(E, n)
        },
        DU = function(n, E, I, e) {
            try {
                e = n[((E | 0) + 2) % 3], n[E] = (n[E] | 0) - (n[((E | 0) + 1) % 3] | 0) - (e | 0) ^ (1 == E ? e << I : e >>> I)
            } catch (X) {
                throw X;
            }
        },
        Q = function(n, E) {
            if (void 0 === (E = E.K[n], E)) throw [r, 30, n];
            if (E.value) return E.create();
            return E.create(1 * n * n + -43 * n + -56), E.prototype
        },
        ZU = function(n, E, I, e, X, L) {
            for (e = (L = (I = ((X = a((E = n[zl] || {}, n)), E.TW = a(n), E).P = [], n.L == n) ? (z(n) | 0) - 1 : 1, a(n)), 0); e < I; e++) E.P.push(a(n));
            for (E.A = Q(X, n); I--;) E.P[I] = Q(E.P[I], n);
            return E.Kv = Q(L, n), E
        },
        Mi = function(n, E, I, e, X) {
            G(n, (((e = Q((X = a((e = (I = E & 4, E &= 3, a(n)), n)), e), n), I) && (e = EK("" + e)), E) && G(n, X, f(2, e.length)), X), e)
        },
        EK = function(n, E, I, e, X) {
            for (X = E = (n = n.replace(/\r\n/g, "\n"), I = [], 0); X < n.length; X++) e = n.charCodeAt(X), 128 > e ? I[E++] = e : (2048 > e ? I[E++] = e >> 6 | 192 : (55296 == (e & 64512) && X + 1 < n.length && 56320 == (n.charCodeAt(X + 1) & 64512) ? (e = 65536 + ((e & 1023) << 10) + (n.charCodeAt(++X) & 1023), I[E++] = e >> 18 | 240, I[E++] = e >> 12 & 63 | 128) : I[E++] = e >> 12 | 224, I[E++] = e >> 6 & 63 | 128), I[E++] = e & 63 | 128);
            return I
        },
        O, a = function(n, E) {
            if (n.S) return Lv(n.v, n);
            return (E = h(8, n, true), E & 128) && (E ^= 128, n = h(2, n, true), E = (E << 2) + (n | 0)), E
        },
        A = function(n, E) {
            E.T = ((E.T ? E.T + "~" : "E:") + n.message + ":" + n.stack).slice(0, 2048)
        },
        mC = function(n, E, I, e, X) {
            if ((I = n[0], I) == N) E.l = 25, E.u(n);
            else if (I == k) {
                X = n[1];
                try {
                    e = E.T || E.u(n)
                } catch (L) {
                    A(L, E), e = E.T
                }
                X(e)
            } else if (I == uN) E.u(n);
            else if (I == l) E.u(n);
            else if (I == WU) {
                try {
                    for (e = 0; e < E.C.length; e++) try {
                        X = E.C[e], X[0][X[1]](X[2])
                    } catch (L) {}
                } catch (L) {}(0, n[1])(function(L, T) {
                    E.o(L, true, T)
                }, (E.C = [], function(L) {
                    (m(E, (L = !E.N.length, [cU])), L) && c(E, true, false)
                }))
            } else {
                if (I == H) return e = n[2], Z(264, E, n[6]), Z(98, E, e), E.u(n);
                I == cU ? (E.F = [], E.K = null, E.X = []) : I == ev && "loading" === q.document.readyState && (E.h = function(L, T) {
                    function g() {
                        T || (T = true, L())
                    }
                    q.document.addEventListener("DOMContentLoaded", (T = false, g), F), q.addEventListener("load", g, F)
                })
            }
        },
        F = {
            passive: true,
            capture: true
        },
        wN = function(n, E) {
            return n(function(I) {
                I(E)
            }), [function() {
                return E
            }]
        },
        x0 = function(n) {
            return n
        },
        sK = function(n, E) {
            Z(169, n, (n.mu.push(n.K.slice()), n.K[169] = void 0, E))
        },
        v = function(n, E, I, e, X, L, T, g, x) {
            if (I.L = (T = (x = (g = (L = 0 < (E || I.I++, I).W && I.R && I.rY && 1 >= I.B && !I.S && !I.h && (!E || 1 < I.J - e) && 0 == document.hidden, (X = 4 == I.I) || L) ? I.Z() : I.G, g) - I.G, x >> 14), I.H && (I.H ^= T * (x << 2)), I.j += T, T) || I.L, X || L) I.I = 0, I.G = g;
            if (!L || g - I.Y < I.W - (n ? 255 : E ? 5 : 2)) return false;
            return I.h = ((Z((n = Q(E ? 117 : 169, (I.J = e, I)), 169), I, I.O), I).N.push([uN, n, E ? e + 1 : e]), B), true
        },
        Ia = function(n, E, I, e) {
            for (; E.N.length;) {
                e = (E.h = null, E).N.pop();
                try {
                    I = mC(e, E)
                } catch (X) {
                    A(X, E)
                }
                if (n && E.h) {
                    n = E.h, n(function() {
                        c(E, true, true)
                    });
                    break
                }
            }
            return I
        },
        Q6 = function(n, E, I, e) {
            return Q((Z(169, (rN(n, (e = Q(169, n), n.X && e < n.O ? (Z(169, n, n.O), sK(n, E)) : Z(169, n, E), I)), n), e), 98), n)
        },
        bN = function(n, E, I, e, X) {
            for (e = (I.xv = ((I.uV = ((I.aN = I[k], I).zW = V6, tI), I).Lv = Y0({get: function() {
                        return this.concat()
                    }
                }, I.g), J[I.g](I.Lv, {
                    value: {
                        value: {}
                    }
                })), 0), X = []; 128 > e; e++) X[e] = String.fromCharCode(e);
            c(I, true, (m(I, (m(I, (m(I, (Z(6, (b(function(L, T, g, x, w, D) {
                v(false, true, L, T) || (w = ZU(L.L), T = w.P, D = w.A, g = T.length, x = w.Kv, w = w.TW, T = 0 == g ? new x[D] : 1 == g ? new x[D](T[0]) : 2 == g ? new x[D](T[0], T[1]) : 3 == g ? new x[D](T[0], T[1], T[2]) : 4 == g ? new x[D](T[0], T[1], T[2], T[3]) : 2(), Z(w, L, T))
            }, (Z(446, I, R((b(function(L, T, g, x, w, D) {
                if (!v(true, true, L, T)) {
                    if ((D = (w = Q((T = (g = (D = a(L), T = a(L), a(L)), w = a(L), Q)(T, L), w), L), Q(D, L)), L = Q(g, L), "object") == iN(D)) {
                        for (x in g = [], D) g.push(x);
                        D = g
                    }
                    for (x = 0, g = D.length, L = 0 < L ? L : 1; x < g; x += L) T(D.slice(x, (x | 0) + (L | 0)), w)
                }
            }, I, ((b(function(L) {
                nv(4, L)
            }, (b(function(L, T, g, x, w, D, M) {
                for (x = (T = (g = Q((D = a(L), w = dN(L), M = "", 157), L), g.length), 0); w--;) x = ((x | 0) + (dN(L) | 0)) % T, M += X[g[x]];
                Z(D, L, M)
            }, I, (Z(409, (I.cV = (Z(373, I, [160, (b(function(L, T, g, x) {
                Z((x = Q((g = (T = a((g = (x = a(L), a(L)), L)), Q(g, L)), x), L), T), L, x[g])
            }, (b(function(L, T, g, x, w) {
                Z((w = (g = (g = a((x = (T = a(L), a(L)), L)), w = a(L), Q)(g, L), x = Q(x, L), Q(w, L)), T), L, PU(x, w, L, g))
            }, I, (b(function(L, T, g, x, w) {
                for (x = (w = (g = dN((T = a(L), L)), []), 0); x < g; x++) w.push(z(L));
                Z(T, L, w)
            }, I, (b(function(L) {
                gN(L, 1)
            }, (b(function(L, T, g, x) {
                !v(false, true, L, T) && (T = ZU(L), x = T.Kv, g = T.A, L.L == L || g == L.S0 && x == L) && (Z(T.TW, L, g.apply(x, T.P)), L.G = L.Z())
            }, (b(function(L, T, g, x) {
                Z((g = Q((T = a((g = a(L), L)), x = Q(T, L), g), L), T), L, x + g)
            }, (Z(19, I, (b(function(L, T, g) {
                Z((g = (T = a(L), a(L)), T = Q(T, L), T = iN(T), g), L, T)
            }, I, (b(function(L, T, g, x) {
                Z((T = a((x = (g = a(L), a(L)), L)), T), L, Q(g, L) || Q(x, L))
            }, I, (b(function(L, T) {
                L = (T = a(L), Q)(T, L.L), L[0].removeEventListener(L[1], L[2], F)
            }, (b(function(L, T, g) {
                v(false, true, L, T) || (T = a(L), g = a(L), Z(g, L, function(x) {
                    return eval(x)
                }(Gl(Q(T, L.L)))))
            }, I, (b(function(L) {
                Mi(L, 3)
            }, I, (b(function(L, T, g) {
                0 != (g = (g = (T = a(L), a(L)), Q)(g, L), Q(T, L)) && Z(169, L, g)
            }, (Z(426, I, (b(function(L, T, g, x, w) {
                x = (T = Q((g = (w = (T = (x = a(L), g = a(L), a)(L), a(L)), Q(g, L)), w = Q(w, L), T), L), Q)(x, L.L), 0 !== x && (T = PU(T, 1, L, w, x, g), x.addEventListener(g, T, F), Z(426, L, [x, g, T]))
            }, (Z((b(function(L) {
                gN(L, 4)
            }, (b(function(L, T, g, x) {
                Z((x = (T = (x = a(L), a(L)), g = a(L), T = Q(T, L), Q(x, L)), g), L, x in T | 0)
            }, (Z(258, (Z(504, (Z(98, I, (b(function() {}, I, (b(function(L, T, g, x) {
                Z((T = z((x = a(L), L)), g = a(L), g), L, Q(x, L) >>> T)
            }, I, (b(function(L, T, g) {
                Z((g = (T = a(L), a(L)), g), L, "" + Q(T, L))
            }, I, (b(function(L, T) {
                sK((T = Q(a(L), L), L.L), T)
            }, I, (b(function(L, T, g, x, w, D, M, W, t, p, V, u) {
                function U(Y, d) {
                    for (; g < Y;) u |= z(L) << g, g += 8;
                    return u >>= (d = u & (1 << (g -= Y, Y)) - 1, Y), d
                }
                for (w = (x = (g = (V = a(L), u = 0), M = (U(3) | 0) + 1, U(5)), []), D = T = 0; D < x; D++) W = U(1), w.push(W), T += W ? 0 : 1;
                for (p = (D = (T = ((T | 0) - 1).toString(2).length, 0), []); D < x; D++) w[D] || (p[D] = U(T));
                for (T = 0; T < x; T++) w[T] && (p[T] = a(L));
                for (t = []; M--;) t.push(Q(a(L), L));
                b(function(Y, d, y6, C, S) {
                    for (C = (y6 = [], S = [], 0); C < x; C++) {
                        if (d = p[C], !w[C]) {
                            for (; d >= S.length;) S.push(a(Y));
                            d = S[d]
                        }
                        y6.push(d)
                    }(Y.S = fv(t.slice(), Y), Y).v = fv(y6, Y)
                }, L, V)
            }, I, (b(function(L, T, g, x) {
                if (x = L.mu.pop()) {
                    for (g = z(L); 0 < g; g--) T = a(L), x[T] = L.K[T];
                    L.K = (x[504] = (x[19] = L.K[19], L).K[504], x)
                } else Z(169, L, L.O)
            }, (b(function(L) {
                Mi(L, 4)
            }, I, (b(function(L, T, g, x) {
                (x = (g = a((T = a(L), L)), a(L)), L.L == L) && (g = Q(g, L), x = Q(x, L), Q(T, L)[g] = x, 226 == T && (L.i = void 0, 2 == g && (L.H = h(32, L, false), L.i = void 0)))
            }, I, (b(function(L, T, g, x) {
                T = (g = a((T = (x = a(L), a(L)), L)), x = Q(x, L), Q)(T, L), Z(g, L, +(x == T))
            }, I, (Z(90, ((Z(117, (((I.l = 25, (I.T = void 0, (e = window.performance || {}, (I.v = (I.XU = 0, void 0), I.K = [], I).rY = (I.X = [], (I.O = 0, I.W = 0, I).N = [], I.H = (I.mu = [], I.R = false, void 0), I.B = 0, false), I).S = void 0, I.F = [], I).j = (I.Y = 0, I.V = void 0, I.G = 0, I.D = 0, 1), I).pv = (I.J = 8001, (I.I = void 0, I.h = (I.S0 = function(L) {
                this.L = L
            }, null), I.L = (I.C = [], I), I).U = false, (I.i = void 0, e).timeOrigin || (e.timing || {}).navigationStart || 0), Z)(169, I, 0), I), 0), I).Yv = 0, I), []), 111)), 292)), Z(184, I, 353), 170)), I), 382), 286)), 390)), 281)), 7)), 326)), {})), I), 2048), I), [0, 0, 0]), I), 44), I), 84), 207), I, q), I), 396), 0)), I), 323), 177)), 442)), I), 81), 376)), 433)), [])), I), 14), I), 222), I), 347), 287)), 50)), I), 123), 0), 0]), 0), I), I), 205)), I), 432), I).vV = 0, 215)), 4))), I), 228), I), 0), [ev])), [l, n])), [WU, E])), true))
        },
        R = function(n, E) {
            for (E = []; n--;) E.push(255 * Math.random() | 0);
            return E
        },
        f = function(n, E, I, e) {
            for (e = (I = (n | 0) - 1, []); 0 <= I; I--) e[(n | 0) - 1 - (I | 0)] = E >> 8 * I & 255;
            return e
        },
        Y0 = function(n, E) {
            return J[E](J.prototype, {
                splice: n,
                floor: n,
                pop: n,
                stack: n,
                document: n,
                call: n,
                length: n,
                prototype: n,
                parent: n,
                console: n,
                propertyIsEnumerable: n,
                replace: n
            })
        },
        Z = function(n, E, I) {
            if (169 == n || 117 == n) E.K[n] ? E.K[n].concat(I) : E.K[n] = fv(I, E);
            else {
                if (E.U && 226 != n) return;
                373 == n || 446 == n || 90 == n || 19 == n || 258 == n ? E.K[n] || (E.K[n] = pv(118, E, I, n)) : E.K[n] = pv(81, E, I, n)
            }
            226 == n && (E.H = h(32, E, false), E.i = void 0)
        },
        qi = function(n, E, I, e) {
            function X() {}
            return {
                invoke: (e = aa((I = void 0, n), function(L) {
                    X && (E && B(E), I = L, X(), X = void 0)
                }, !!E)[0], function(L, T, g, x) {
                    function w() {
                        I(function(D) {
                            B(function() {
                                L(D)
                            })
                        }, g)
                    }
                    if (!T) return T = e(g), L && L(T), T;
                    I ? w() : (x = X, X = function() {
                        (x(), B)(w)
                    })
                })
            }
        },
        OK = function(n, E, I) {
            if (3 == n.length) {
                for (I = 0; 3 > I; I++) E[I] += n[I];
                for (I = [13, 8, 13, 12, 16, (n = 0, 5), 3, 10, 15]; 9 > n; n++) E[3](E, n % 3, I[n])
            }
        },
        K = function(n, E, I) {
            I = this;
            try {
                bN(E, n, this)
            } catch (e) {
                A(e, this), n(function(X) {
                    X(I.T)
                })
            }
        },
        dN = function(n, E) {
            return E = z(n), E & 128 && (E = E & 127 | z(n) << 7), E
        },
        UK = function(n, E, I, e, X) {
            for (X = (I = I[e = I[2] | 0, 3] | 0, 0); 14 > X; X++) n = n >>> 8 | n << 24, n += E | 0, n ^= e + 2298, I = I >>> 8 | I << 24, E = E << 3 | E >>> 29, I += e | 0, I ^= X + 2298, E ^= n, e = e << 3 | e >>> 29, e ^= I;
            return [E >>> 24 & 255, E >>> 16 & 255, E >>> 8 & 255, E >>> 0 & 255, n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n >>> 0 & 255]
        },
        hI = function(n, E, I) {
            return E.o(function(e) {
                I = e
            }, false, n), I
        },
        z = function(n) {
            return n.S ? Lv(n.v, n) : h(8, n, true)
        },
        jv = function(n, E) {
            return E[n] << 24 | E[(n | 0) + 1] << 16 | E[(n | 0) + 2] << 8 | E[(n | 0) + 3]
        },
        rN = function(n, E, I, e, X, L) {
            if (!n.T) {
                n.B++;
                try {
                    for (X = (L = 0, n.O), e = void 0; --E;) try {
                        if (I = void 0, n.S) e = Lv(n.S, n);
                        else {
                            if ((L = Q(169, n), L) >= X) break;
                            e = Q((Z(117, n, L), I = a(n), I), n)
                        }
                        v(false, false, (e && e[cU] & 2048 ? e(n, E) : P(0, n, [r, 21, I]), n), E)
                    } catch (T) {
                        Q(184, n) ? P(22, n, T) : Z(184, n, T)
                    }
                    if (!E) {
                        if (n.gY) {
                            rN(n, (n.B--, 168668240895));
                            return
                        }
                        P(0, n, [r, 33])
                    }
                } catch (T) {
                    try {
                        P(22, n, T)
                    } catch (g) {
                        A(g, n)
                    }
                }
                n.B--
            }
        },
        G = function(n, E, I, e, X, L) {
            if (n.L == n)
                for (L = Q(E, n), 446 == E ? (E = function(T, g, x, w) {
                        if ((w = (x = L.length, (x | 0) - 4 >> 3), L.q7) != w) {
                            g = [0, (w = (w << 3) - (L.q7 = w, 4), 0), X[1], X[2]];
                            try {
                                L.O$ = UK(jv((w | 0) + 4, L), jv(w, L), g)
                            } catch (D) {
                                throw D;
                            }
                        }
                        L.push(L.O$[x & 7] ^ T)
                    }, X = Q(258, n)) : E = function(T) {
                        L.push(T)
                    }, e && E(e & 255), n = 0, e = I.length; n < e; n++) E(I[n])
        },
        fv = function(n, E, I) {
            return ((I = J[E.g](E.xv), I)[E.g] = function() {
                return n
            }, I).concat = function(e) {
                n = e
            }, I
        },
        h = function(n, E, I, e, X, L, T, g, x, w, D, M, W, t) {
            if ((g = Q(169, E), g) >= E.O) throw [r, 31];
            for (w = (e = (D = E.aN.length, n), 0), x = g; 0 < e;) T = x >> 3, t = x % 8, W = 8 - (t | 0), L = E.X[T], W = W < e ? W : e, I && (X = E, X.i != x >> 6 && (X.i = x >> 6, M = Q(226, X), X.V = UK(X.i, X.H, [0, 0, M[1], M[2]])), L ^= E.V[T & D]), x += W, w |= (L >> 8 - (t | 0) - (W | 0) & (1 << W) - 1) << (e | 0) - (W | 0), e -= W;
            return Z(169, E, (I = w, (g | 0) + (n | 0))), I
        },
        q = this || self,
        B = q.requestIdleCallback ? function(n) {
            requestIdleCallback(function() {
                n()
            }, {
                timeout: 4
            })
        } : q.setImmediate ? function(n) {
            setImmediate(n)
        } : function(n) {
            setTimeout(n, 0)
        },
        PU = function(n, E, I, e, X, L) {
            function T() {
                if (I.L == I) {
                    if (I.K) {
                        var g = [H, n, e, void 0, X, L, arguments];
                        if (2 == E) var x = c(I, (m(I, g), false), false);
                        else if (1 == E) {
                            var w = !I.N.length;
                            (m(I, g), w) && c(I, false, false)
                        } else x = mC(g, I);
                        return x
                    }
                    X && L && X.removeEventListener(L, T, F)
                }
            }
            return T
        },
        pv = function(n, E, I, e, X, L, T, g) {
            return ((L = (T = n & (X = $0, I = [89, -43, 5, 1, 4, 91, I, 75, 51, -20], 7), J[E.g](E.Lv)), L)[E.g] = function(x) {
                T += 6 + 7 * n, g = x, T &= 7
            }, L).concat = function(x) {
                return (g = (x = (x = e % 16 + 1, -40 * e * e * g - x * g - -2240 * g + I[T + 51 & 7] * e * x + 40 * g * g + T + 1 * e * e * x - -1720 * e * g + (X() | 0) * x), void 0), x = I[x], I[(T + 13 & 7) + (n & 2)] = x, I)[T + (n & 2)] = -43, x
            }, L
        },
        zl = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        cU = ((K.prototype.gY = false, K.prototype.dY = void 0, K).prototype.s = "toString", K.prototype.BV = void 0, []),
        H = [],
        l = [],
        k = [],
        ev = [],
        WU = [],
        r = {},
        N = [],
        uN = [],
        $0 = ((y = (((Tl, function() {})(R), DU, function() {})(OK), K.prototype.g = "create", K.prototype), y).bV = function(n, E, I) {
            return n ^ ((E = ((E ^= E << 13, E ^= E >> 17, E) ^ E << 5) & I) || (E = 1), E)
        }, void 0),
        J = (y.o = (y.HV = function() {
            return Math.floor(this.D + (this.Z() - this.Y))
        }, ((y.GW = function(n, E, I, e, X, L) {
            for (X = (e = L = 0, []); L < n.length; L++)
                for (I = I << E | n[L], e += E; 7 < e;) e -= 8, X.push(I >> e & 255);
            return X
        }, y).Z = (y.he = function() {
            return Math.floor(this.Z())
        }, (window.performance || {}).now) ? function() {
            return this.pv + window.performance.now()
        } : function() {
            return +new Date
        }, y).PV = function(n, E, I, e, X) {
            for (e = X = 0; X < n.length; X++) e += n.charCodeAt(X), e += e << 10, e ^= e >> 6;
            return X = new Number((n = (e += e << 3, e ^= e >> 11, e + (e << 15) >>> 0), n & (1 << E) - 1)), X[0] = (n >>> E) % I, X
        }, function(n, E, I, e, X) {
            if (I = "array" === iN(I) ? I : [I], this.T) n(this.T);
            else try {
                e = [], X = !this.N.length, m(this, [N, e, I]), m(this, [k, n, e]), E && !X || c(this, E, true)
            } catch (L) {
                A(L, this), n(this.T)
            }
        }), r).constructor;
    (K.prototype.u = function(n, E) {
        return $0 = function() {
                return n == E ? -56 : -98
            }, E = {}, n = {},
            function(I, e, X, L, T, g, x, w, D, M, W, t, p, V, u) {
                n = (t = n, E);
                try {
                    if (e = I[0], e == l) {
                        p = I[1];
                        try {
                            for (x = (u = (V = [], L = 0, atob(p)), 0); L < u.length; L++) T = u.charCodeAt(L), 255 < T && (V[x++] = T & 255, T >>= 8), V[x++] = T;
                            Z(226, this, (this.O = (this.X = V, this).X.length << 3, [0, 0, 0]))
                        } catch (U) {
                            P(17, this, U);
                            return
                        }
                        rN(this, 8001)
                    } else if (e == N) I[1].push(Q(373, this).length, Q(504, this), Q(446, this).length, Q(90, this).length), Z(98, this, I[2]), this.K[67] && Q6(this, Q(67, this), 8001);
                    else {
                        if (e == k) {
                            (w = (V = I[2], f(2, (Q(373, this).length | 0) + 2)), X = this.L, this).L = this;
                            try {
                                W = Q(19, this), 0 < W.length && G(this, 373, f(2, W.length).concat(W), 10), G(this, 373, f(1, this.j), 109), G(this, 373, f(1, this[k].length)), u = 0, u += Q(6, this) & 2047, u -= (Q(373, this).length | 0) + 5, D = Q(446, this), 4 < D.length && (u -= (D.length | 0) + 3), 0 < u && G(this, 373, f(2, u).concat(R(u)), 15), 4 < D.length && G(this, 373, f(2, D.length).concat(D), 156)
                            } finally {
                                this.L = X
                            }
                            if (g = ((x = R(2).concat(Q(373, this)), x[1] = x[0] ^ 6, x)[3] = x[1] ^ w[0], x[4] = x[1] ^ w[1], this).N7(x)) g = "!" + g;
                            else
                                for (u = 0, g = ""; u < x.length; u++) M = x[u][this.s](16), 1 == M.length && (M = "0" + M), g += M;
                            return Q(((Z(504, this, ((L = g, Q)(373, this).length = V.shift(), V.shift())), Q(446, this)).length = V.shift(), 90), this).length = V.shift(), L
                        }
                        if (e == uN) Q6(this, I[1], I[2]);
                        else if (e == H) return Q6(this, I[1], 8001)
                    }
                } finally {
                    n = t
                }
            }
    }(), K.prototype.yC = 0, K.prototype).N7 = function(n, E, I, e) {
        if (I = window.btoa) {
            for (e = "", E = 0; E < n.length; E += 8192) e += String.fromCharCode.apply(null, n.slice(E, E + 8192));
            n = I(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
        } else n = void 0;
        return n
    }, K.prototype.Z4 = 0;
    var V6, tI = /./,
        AI = (K.prototype[WU] = [0, 0, 1, 1, 0, 1, 1], l.pop.bind(K.prototype[N])),
        Gl = function(n, E) {
            return (E = Xn()) && 1 === n.eval(E.createScript("1")) ? function(I) {
                return E.createScript(I)
            } : function(I) {
                return "" + I
            }
        }(((V6 = Y0({get: AI
        }, (tI[K.prototype.s] = AI, K.prototype.g)), K).prototype.iV = void 0, q));
    (O = q.botguard || (q.botguard = {}), 40 < O.m) || (O.m = 41, O.bg = qi, O.a = aa), O.kDL_ = function(n, E, I) {
        return [(I = new K(E, n), function(e) {
            return hI(e, I)
        })]
    };
}).call(this);
#7 JavaScript::Eval (size: 64) - SHA256: 9908576f4e1cce70106175d94488f9071022d3485f8a8ccf0655b399b318a7c4
0,
function(L, T, g) {
    (T = (g = a((T = a(L), L)), L).K[T] && Q(T, L), Z)(g, L, T)
}
#8 JavaScript::Eval (size: 27) - SHA256: 52b43864b9f1786d8c0d2d679562e90dc2a00c9d68ea80188a37d9b01d23dd47
lOptionDocumentNumber_10023
#9 JavaScript::Eval (size: 22) - SHA256: 355b9b382781cde432ccca7627a8fdecad5040be2910428d5fc5b4b57fed949b
0,
function(L) {
    nv(1, L)
}

Executed Writes (2)
#1 JavaScript::Write (size: 830) - SHA256: 85954b639eb9e120fa7da150af54079cf6b41a32e52d8d00698054267d0f11b1
< script >
    var TrackTime = ['00:07:23.260', '00:07:23.260', '00:07:23.276'] < /script><style>.tmg-loading span{margin:0 auto;display:block;width:130px;font-size:large;font-variant:petite-caps;font-family:initial;text-align:center;}</style > < div id = 'tmgloading'
class = 'tmg-loading' > < span > Loading... < /span></div > < script > function TMG_CheckForClick() {
    try {
        var redirectTo = '#',
            tmpPlacement = '13488000';
        if ('#' != redirectTo) {
            var lurl = decodeURIComponent(redirectTo); - 1 != lurl.indexOf('http://') || -1 != lurl.indexOf('https://') ? window.location.href = lurl : eval(lurl)
        }
    } catch (r) {}
    return !0
} < /script><script src='https:/ / ldsapi.tmginteractive.com / GenericPlacementScriptDiv.aspx ? tmgrt = ancs & mainPlacement = 13488000 & hasLoadOptimation = 0 & hasMinAssets = 1 & placement = 13488000 & publisher = 139136 & affid = 1252169444874968 & subid = 1252169444874968 ' type='
text / javascript '></script>
#2 JavaScript::Write (size: 15016) - SHA256: 869f169a61383018d950ec1947548f727f0ec9a0da63f82d4010e58a29d0fde9
< style type = 'text/css' > .TMG - Creative - MoreInfo - Container {
        background - color: # fdecd7!important;
        border: 1 px solid # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar {
        background - color: # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar - Icon {
        color: # c4a176!important;
    }.TMG - Creative - MoreInfo - Container a {
        color: # dca926!important;
    }.TmgOffersArea {
        width: 370 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;padding:0px 0px 0px 0px;margin:0px 0px 0px 0px;}.TmgOfferTopSpace{width:370px!important;float:left!important;height:0px!important;}.TmgOfferHeaderImage{width:370px!important;float:left!important;display:none;border:0px solid # FFF!important;
    }.TmgOfferHeaderImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBlankTop {
        width: 370 px!important;float: left!important;margin: 5 px 0 px
    }.TmgOffers {
        width: 370 px!important;float: left!important;
    }.TmgOffer {
        width: 370 px!important;float: left!important;
    }.TmgFloat {
        float: left!important;
    }.TmgOfferVerbiage {
        width: 370 px!important;float: left!important;display: none;padding: 0 px 0 px 0 px 0 px!important;margin: 0 px 0 px 0 px 0 px!important;font - family: Arial,
        Helvetica,
        sans - serif!important;font - weight: normal!important;font - size: 12 px!important;color: #000!important;border-style:0px solid # FFF!important;text - align: left!important;
    }.TmgOfferFooterImage {
        width: 370 px!important;float: left!important;display: none;border: 0 px solid # FFF!important;height: 0 px!important;width: 0 px!important;
    }.TmgOfferFooterImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBottomSpace {
        width: 370 px!important;float: left!important;height: 0 px!important;
    }.tmgCampaignlogoArea {
        display: none;width: 130 px!important;vertical - align: top;float: left!important;background - repeat: no - repeat;
    }.tmgCampaignlogoArea img {
        border: 1 px solid #000000 !important;}.TmgCampaignControlArea{display:block;width:25px!important;vertical-align:top;}.TmgCheckBoxButton{margin:1px 3px!important;}.TmgRadioButton{margin:1px 3px!important;}.tmgControlText{font-family:Sans-Serif!important;font-size:14px!important;font-weight:normal!important;color:# 212529!important;font - variant: normal!important;vertical - align: top!important;vertical - align: middle;display: inline - block;padding: 0 px!important;padding: 0 px 0 px 5 px 1 px;margin - left: 0 px!important;margin - left: -1 px;
    }.TmgCampaignCreativeArea {
        float: left!important;width: 325 px!important;vertical - align: top;display: block;
    }.TmgCampaignCreativeText {
        width: 325 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;text-align:left!important;vertical-align:top!important;display:inline-block!important;overflow: hidden!important;}.TmgAdditionalFieldsArea{float:left!important;display:none;width:325px!important;font-family:Sans-Serif!important;font-variant:normal!important;color:# 212529!important;
    }.TmgBlankArea {
        float: left!important;width: 1 px!important;height: 1 px!important;padding: 0 px!important;margin: 0 px!important;
    }.TMG - Creative - MoreInfo - a - Collapse, .TMG - Creative - MoreInfo - a - Expand {
        cursor: pointer;color: #0000FF;text-decoration:underline;padding:0 5px;}.tmgFieldControlTheme{background-color:none;}.tmgFieldControlThemeRequired{background-color:# FF9999;
    }.TmgCampaignDisclaimer {
        font - size: 9 px!important;
        font - style: italic;
    }.tmgFieldOptionDirectionVertical {
        display: inline - table;
    }.TmgPoweredBy {
        float: left!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #9b9b9b!important;text-align:right!important;width:100%!important;}.TmgPoweredBy .initials-span{font-size:13px!important;}</style><script language= 'javascript'
        type = 'text/javascript' >
        var tmg_GlobalAssetsBaseURL = 'tmgassets.azureedge.net/amsus';
        var tmgPlacement = '13488000',
            tmgPublisher = '139136',
            tmgAffId = '1252169444874968',
            tmgSubId = '1252169444874968',
            tmgSSLKey = 's',
            tmgRedirectTo = '#',
            tmgMyURI = 'ldsapi.tmginteractive.com',
            tmgOfferPreCheck = false,
            tmgNumberOfOfferForPreCheck = 0,
            tmg_arrPreCheckCamps = [],
            tmgIsEmbeddedPlacement = true,
            tmgIsFieldDropOnButtonClick = false,
            tmgIsClientQueryStringPass = false,
            lUSER_PLATFORM = 0,
            lUSER_PLATFORM_SUB = 0,
            lUSER_IP_ADDRESS = '91.90.42.154',
            tmg_UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0',
            tmgHitUniqueKey = '1320340452',
            tmgTrustedFormFlag = false,
            tmgUniversalLeadidFlag = false,
            tmg_ptype = 'Embedded',
            tmg_psectype = 'EMBEDDED',
            tmg_hideCampOnClick = false,
            tmg_NumOfCampShowIntially = 0,
            tmg_ShowCampInBunchFunctionality = false,
            tmg_CampaignInABunch = 0,
            tmg_MainPlacement = '13488000',
            tmgAttachedInfo = 'Firefox;105.0;WinNT',
            tmgMoreInfoContext = '<i class=:SQ:fa fa-plus-circle:SQ: style=:SQ:color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgLessInfoContext = '<i class=:SQ:fa fa-minus-circle:SQ: style=:SQ:color:#A12227!important; font-size:16px!important;font-variant:normal !important;font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgSiteName = 'monthlysweeps.us',
            tmgShowingLiveViewOnly_1320340452 = false,
            UserActivityTrackingSequence = 0,
            tmg_PostLeadOnOpt = false,
            tmgTrustedFormEnabledCampaigns = [],
            gMonths = [],
            gDays = [],
            gYears = [],
            gCountry = [],
            usStates = [],
            caStates = [],
            auStates = []; < /script><script src='https:/ / tmgassets.azureedge.net / amsus / ldsapi / assets / script / standard.min.js ? version = 20220221 n ' type='
        text / javascript '></script><script src='
        https : //tmgassets.azureedge.net/amsus/ldsapi/assets/script/clientfp.min.js?version=20211103' type='text/javascript'></script><script src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common.min.js?version=20221130b' type='text/javascript'></script><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/browserdetect.min.js?version=120419' type='text/javascript'></script><link href='https://tmgassets.azureedge.net/amsus/ns/css/13488000.min.css?2330k30j20222330j11ckl30llk164jkk072300' rel='stylesheet' type='text/css' /><iframe security='restricted' id='tmgPost' height='1' width='1' style='display:none;'></iframe><img id='tmgCallPixelSrc' src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1' width='1' /><div id='TmgOffers' align='left' class='TmgOffersArea' style='display:none;'><div class='TmgOfferTopSpace'></div><div class='TmgOfferHeaderImage' title='&nbsp;'></div><div id='TmgOfferVerbiage13488000' class='TmgOfferVerbiage'></div><div class='TmgOfferBlankTop'></div><div id='tmgDisplayOfferContainer' class='TmgOffers'><div id='TMGOfferTD1' class='TmgOffer TmgOfferTheme' ></div><br class='tmg_ignore_br' style='clear:both;'/></div><div class='TmgOfferFooterImage' title=''></div><div class='TmgOfferBottomSpace'></div><div style='clear:both;'></div></div><div style='display:none;'><div id='TMGOfferTR$10023'><div class='TMGOfferDiv13488000'><div class='tmgOfferArea_CenterLeftLine'><div class='tmgOfferArea_CenterRightLine'><div class='tmgOfferArea_CenterTopLine'><div class='tmgOfferArea_TopLeftCorner'><div class='tmgOfferArea_TopRightCorner'><div class='tmgOfferArea_CenterBottomLine'><div class='tmgOfferArea_BottomLeftCorner'><div class='tmgOfferArea_BottomRightCorner'><div class='TmgBlankArea'></div><div id='TmgCampaignControl$10023' class='TmgFloat TmgCampaignControlTheme'><div align='left' valign='top' style='vertical-align:top!important;' class='TmgCampaignControlArea TmgCampaignControlAreaTheme'><input type='checkbox' id='tmgControl$10023$0' name='tmgControl$10023' class='TmgCheckBoxButton' onClick='javascript:TMG_CheckClick(this);' />&nbsp;</div></div><div id='TmgCampaignCreative$10023' class='TmgCampaignCreativeArea TmgCampaignCreativeAreaTheme'><span class='TmgCampaignCreativeText'><span id='TmgCampaignCreativeSection0' class='TmgCampaignCreativeSection0Theme'><label for='tmgControl$10023$0' style='cursor:pointer;display:inline;'>Get exclusive access to global deals and free apps for your smartphone! </label></span><span id='TmgCampaignCreativeSection1' class='TmgCampaignCreativeSection1Theme'> </span><br class='tmg_ignore_br' style='clear:left;'/><span class='TMG-Creative-MoreInfo-Span' id='CreativeMoreInfo$10023' style='display:none;'>&nbsp;<a href='https://ldsapi.tmginteractive.com/pp/' target='_blank'>Privacy Policy</a></span><a class='TMG-Creative-MoreInfo-a-Expand' id='TMGMoreInfoAnchor$10023' onclick='javascript:TMG_ClickForCreativeMoreInfo(this)'><i class='fa fa-plus-circle' style='color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;'></i></a></span></div><br class='tmg_ignore_br' style='clear:both;'/><div id='TmgAdditionalFields$10023' class='TmgAdditionalFieldsArea TmgAdditionalFieldsAreaTheme' style='padding-left:25px'><div><span style='font-size:11px!important;font-weight:normal!important;' name='TmgFieldValidationMsg' id='TmgFieldValidationMsg$10023'>Please complete the following fields:</span></div><div style='height:2px!important;'></div><div id='F_10023_FIRST_NAME_TABLE'><div><span id='F_10023_FIRST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>First Name</span></div><div><input Id='F_10023_FIRST_NAME' name='F_10023_FIRST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_FIRST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_LAST_NAME_TABLE'><div><span id='F_10023_LAST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Last Name</span></div><div><input Id='F_10023_LAST_NAME' name='F_10023_LAST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_LAST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_EMAIL_TABLE'><div><span id='F_10023_EMAIL$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Email</span></div><div><input Id='F_10023_EMAIL' name='F_10023_EMAIL' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_EMAIL'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><input name='F_10023_IP_ADDRESS' Id='F_10023_IP_ADDRESS' type='hidden' value='91.90.42.154'/><div style='height:2px!important;'></div><input name='F_10023_COUNTRY' Id='F_10023_COUNTRY' type='hidden' value=''/><div style='height:2px!important;'></div><input name='F_10023_USER_PLATFORM' Id='F_10023_USER_PLATFORM' type='hidden' value='0'/><div style='height:2px!important;'></div><div><span id='TmgSuccessMsg$10023' name='TmgSuccessMsg' style='font-size:11px!important;'>Once you have completed the required field(s) you will see a success message here.</span></div></div><div id='TmgSpacerTop$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='TmgOffer TmgCampaignSepratorTheme' id='TmgCampaignSepratorId$10023' style='display:none;width:370px;border-bottom: 1px solid #000000!important;'></div><div id='TmgSpacerBottom$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='tmg_ignore_br' style='clear:left;'></div></div></div></div></div></div></div></div></div></div></div></div><input name='hFieldAffId' Id='hFieldAffId' name='hFieldAffId' type='hidden' value='1252169444874968'/><input Id='hTMG_FetchingDataFromQuery' type='hidden' value='0'/><input Id='hTMG_MappedDateFormat' type='hidden' value='0'/><input name='hFieldSubId' Id='hFieldSubId' name='hFieldSubId' type='hidden' value='1252169444874968'/><script language='javascript' type='text/javascript'>var IsPrePingExecuteFromClientScript=false,lCampaigns_out_from_preping=[0],lMappedClientFields='ADDRESS,1,address,NAME--AffId,0,hFieldAffId,ID--CITY,0,city,ID--DATE_OF_BIRTH,2,month^day^year,ID--EMAIL,1,email-address,ID--FIRST_NAME,1,first_name,ID--GENDER,3,title,NAME--LAST_NAME,1,last_name,ID--PHONE,1,phone_number,ID--STATE,0,state,ID--SubId,0,hFieldSubId,ID--ZIP,1,postal_code,ID',lCPL_10023='0.00',lCPLEntryFor_10023='ADMIN',lOptionDocumentNumber_10023='10023/226/0/225',lCampaignFields_10023='F_10023_FIRST_NAME,F_10023_LAST_NAME,F_10023_EMAIL,F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFinalOrderOfCampaignInDisplay='',lTrueTargetedCampaigns='',lFalseTargetedCampaigns='',lNumberOfCampaignsToDisplay='1',lAllCampaigns='10023',lAvoidValidateForIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFieldsContainChildField='',lHiddenFieldIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lAnswerMandatoryFlag=false,lRadioButtonFieldIds='',lCheckBoxFieldIds='',lClientQueryString='',lPrePingCampaigns='',lNumberOfPrepingCampaign='0',lExecuteLines='',lMappedFor_GENDER='Mr~M,Ms~F',lPlacementImpressionOn='LOAD',lCampaignsImpressionOn='LOAD';</script><script language='javascript' type='text/javascript'>try{TMG_DisplayOffers();fn_MoreInfo_Absolute();}catch(ex){}</script><script language='javascript' type='text/javascript'>var oldonload=window.onload;if (typeof window.onload != 'function'){window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();}} else {window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();oldonload();}}</script><script>UserActivityTrackingSequence=1;</script><link href='https://tmgassets.azureedge.net/amsus/ns/assets/awesome-font/font-awesome.css?version=120419' rel='stylesheet' type='text/css' /><script src='https://tmgassets.azureedge.net/amsus/ns/js/13488000.min.js?2330k30j20222330j11ckl30llk164jkk072300' type='text/javascript'></script><style>.tmg-loading{display:none;text-align:center;}</style><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common-extentions.min.js?20221130b' type='text/javascript'></script><input Id='hConditionalStructureData' type='hidden' value=''/><script>try{ TrackTime.push('00:07:23.464','00:07:23.464','00:07:23.464','00:07:23.573','00:07:23.573','00:07:23.573','00:07:23.573','00:07:23.573','00:07:23.573');TrackTime.push(GetDateStringInFormat(new Date(),'hh:mm:ss.fff')) } catch(ex) { }</script>


HTTP Transactions (106)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "94FB64C1C826ED7099283C0BEDB3CEA7AC7E1D9526794CB9FAD6E761F5989D32"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6282
Expires: Thu, 01 Dec 2022 01:52:03 GMT
Date: Thu, 01 Dec 2022 00:07:21 GMT
Connection: keep-alive

                                        
                                            GET /go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         54.161.16.68
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Thu, 01 Dec 2022 00:07:21 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968/


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A3EC545A8F9364AC9062EDDB41279E1465687A1B60F9C1DEC6B3A3DF8B033EB3"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6945
Expires: Thu, 01 Dec 2022 02:03:06 GMT
Date: Thu, 01 Dec 2022 00:07:21 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5124
Cache-Control: 'max-age=158059'
Date: Thu, 01 Dec 2022 00:07:21 GMT
Last-Modified: Wed, 30 Nov 2022 22:41:57 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: Imlohd5seimiN9nG29+i323zl7/cEUJu7pTOmNJNfXw47pKfHhUjMFotKw/ua9pFEuQFYCAm+9o=
x-amz-request-id: G6KN6WCT7ANZC9KY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 30 Nov 2022 23:46:03 GMT
age: 1278
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Type, Backoff, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 30 Nov 2022 23:18:04 GMT
cache-control: public,max-age=3600
age: 2957
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    30db107dcf4380cef05efea409c2e6a3
Sha1:   96e6a306fbc07299aba64e5c14e2bfca35872fa9
Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Thu, 01 Dec 2022 00:07:21 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=99257
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6386cfe8-1d7"
Expires: Fri, 02 Dec 2022 03:41:39 GMT
Last-Modified: Wed, 30 Nov 2022 03:37:12 GMT
Server: ECS (dcb/7EEA)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: ufcrjJ3NeLVGJNOjB3zifI46u753CWHZIFJe25uGQXQsHHTXr6Bd4g==
Age: 267

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 30 Nov 2022 23:08:56 GMT
cache-control: public,max-age=3600
age: 3506
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         54.161.16.68
HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 302
location: http://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
server: Apache/2.4.41 (Ubuntu)
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   302
Md5:    e7dda22f6ea1b44e1b9899980a273559
Sha1:   cd610aa30faf4f9db1f9bd54c8b0c7839529c9bc
Sha256: f9497e7f65465ef4cc473489159fcbdb9fe644aa7f07aa5252fedb6b60eb0e60

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         54.161.16.68
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Thu, 01 Dec 2022 00:07:22 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5122
Cache-Control: 'max-age=158059'
Date: Thu, 01 Dec 2022 00:07:22 GMT
Last-Modified: Wed, 30 Nov 2022 22:42:00 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 9948
server: Apache/2.4.41 (Ubuntu)
set-cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (939)
Size:   9948
Md5:    2255e83acb9646bd8b0947f0bf6826ed
Sha1:   f473cf6fd57978a34106c0abaa26542b6e162296
Sha256: df5c456827f443c59302f7375154c1bb80328df5a93f74ad3197741f76262b45

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 12896489
expires: Tue, 21 Nov 2023 00:07:22 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VTSiBd3fcN0QjdK8kdNsT6iq3j67r6tYpfNexbqkw19KBhnLEHjH21QY4KcPrNimKxiuMWJ6h2oKTKlSUuXbPQkUX5UubTXDWGQ80lfkgo7paYOU%2BT0egwG8tpQQIyLNX%2FBRwEEd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7727950f4a091c02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (20322)
Size:   6458
Md5:    df9fe6d48e380554eb0ec9687bed3246
Sha1:   207263d754220200c1916edfbda262f62223ecf5
Sha256: 91d57502b7260e6752c2b5f1636d77707929fa9f09da28589691e61816a448f9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5531
Cache-Control: max-age=116774
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6386ffc5-117"
Expires: Fri, 02 Dec 2022 08:33:36 GMT
Last-Modified: Wed, 30 Nov 2022 07:01:25 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Tt3E8hUYdEMTuc45+rPI2Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         54.148.70.121
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: UtKlTD8zoUp+eEOTCWQeVipP5LQ=

                                        
                                            GET /assets/css/datepicker.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 818
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:06 GMT
etag: "d07-5c80ac2c970f8-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3335), with no line terminators
Size:   818
Md5:    3240fc33175e0e388f26fbac8bf8cff3
Sha1:   cf1a645948c9ce996e1560b9569f56822c4f9ba8
Sha256: 9077f43ae19f62f65d930304d4f77d3ce23ec0d4ba41e1284dac8702fbc05f96
                                        
                                            GET /jquery.validation/1.15.0/jquery.validate.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.129.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"58a0-xaL/AT+jV8HSplcbXY5ljmcAgOo"
content-encoding: gzip
accept-ranges: bytes
date: Thu, 01 Dec 2022 00:07:22 GMT
age: 1353834
x-served-by: cache-fra-eddf8230115-FRA, cache-bma1658-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7320
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (22550)
Size:   7320
Md5:    17f3f2c0dd873827d21aec4b7c7da443
Sha1:   e10d2e3deff107d85726cb4f14eee82f96f2594e
Sha256: 5f0adea83e4171c32048eafe7032ef01093d96794c62b988fb9935041e35a998
                                        
                                            GET /assets/css/loading_icon_1.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 580
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:07 GMT
etag: "db0-5c80ac2ce37a0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   580
Md5:    b6b8913a6a3ad6881037667493551ec5
Sha1:   3daae516738f878875bb15766ca06a2ed9ee442b
Sha256: cc46b8ab8bf6a609d0c9336a46ef8b217c15fb2ecdef548c5c4d6ce6ebdb52cf
                                        
                                            GET /jquery-3.3.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         69.16.175.42
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-encoding: gzip
content-length: 30288
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
accept-ranges: bytes
server: nginx
etag: W/"28feccc0-1538f"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1669853242.dop229.sk1.t,1669853242.cds247.sk1.hn,1669853242.cds217.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   30288
Md5:    d549b312f7a7d228b4ec229a6547dfdc
Sha1:   0766794582ad530ec0f8c2595f741086afffa312
Sha256: f6488b2915e0ceee723f4320492511d46c6ba1860d5975d085e6da8913f55f44
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5531
Cache-Control: max-age=116774
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6386ffc5-117"
Expires: Fri, 02 Dec 2022 08:33:36 GMT
Last-Modified: Wed, 30 Nov 2022 07:01:25 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            GET /assets/css/sweeps.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 1639
server: Apache/2.4.41 (Ubuntu)
last-modified: Fri, 02 Sep 2022 17:56:19 GMT
etag: "172c-5e7b572772120-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   1639
Md5:    a5c77602d9ceb6c6450244ffb0baf0d1
Sha1:   0a8756bf9ec23f2957f9165941196551cc046cf7
Sha256: d1bdae39d462d3c7ccb9f86a413c69df0026d2c06558af9b691a0e98bf0cdd4e
                                        
                                            GET /assets/img/sweepstakes250/one.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 801
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:31 GMT
etag: "321-5429f55d7e9c0"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   801
Md5:    03744c9d39310c5d2af2cf2a23616580
Sha1:   603f0d70ddc7d77f6341dc0caf9e0740b33ae061
Sha256: afbc2f9fe529022b98f966b254c8d3173a40998fdd01ee3739df99a8a3169a0b
                                        
                                            GET /jquery.validation/1.15.0/additional-methods.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.129.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"4547-g4rGbD7KxrYTawSb3Q4U8vAilSw"
content-encoding: gzip
accept-ranges: bytes
date: Thu, 01 Dec 2022 00:07:22 GMT
age: 2565324
x-served-by: cache-fra-eddf8230100-FRA, cache-bma1658-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5199
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17590)
Size:   5199
Md5:    4c0e8d136f8e41d83cb99f52be04f280
Sha1:   eecf9c91f361ac05dfaa6b7167aea6f0d4ddf7cd
Sha256: 81659fd2d8cc8d38327f4450954654b19dbb8a95a2b1e402e47869f0ca9dddc6
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5112
Cache-Control: max-age=134685
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6387475f-117"
Expires: Fri, 02 Dec 2022 13:32:07 GMT
Last-Modified: Wed, 30 Nov 2022 12:06:55 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            GET /ads/scripts/site-141028.js HTTP/1.1 
Host: ads.pro-market.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.36.76.115
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Last-Modified: Tue, 23 Jul 2019 13:39:45 GMT
Server: nginx/1.0.15
Content-Encoding: gzip
Content-Length: 1101
Cache-Control: max-age=86400
Date: Thu, 01 Dec 2022 00:07:22 GMT
Connection: keep-alive
Vary: Accept-Encoding


--- Additional Info ---
Magic:  ASCII text, with very long lines (514), with CRLF line terminators
Size:   1101
Md5:    540b7c85a21cf48ee81735b2ffcc335f
Sha1:   e5eaedc157c73717aab322629e3f1ad8569bc0a1
Sha256: aa2916440a5dc9e91cc213dc3503845a97fe91cfd12fe8e6cd92032b675a4da9
                                        
                                            GET /ajax/libs/bootstrap-formhelpers/2.3.0/js/bootstrap-formhelpers.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 58913
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03d8e-46f6d"
last-modified: Mon, 04 May 2020 16:06:38 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 12896416
expires: Tue, 21 Nov 2023 00:07:22 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oZ168L5RXBwBc2fgYY0qMnDZA7J7D8BkBTVEnQurkYBXS7tFpqV91i9YVIO2HxuUYWtE0ly8bvb6GsFlRXnoiL9CRn0pTfBciIidwJd%2F2qB234AmQJlbYA4j2kGubwi%2FZXtleGKT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7727950fca471c02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65274)
Size:   58913
Md5:    a63b2977b01b6e2d2e2086c3f63a3c9a
Sha1:   560409f64e40f5078e1ba8d496657badd7a3a6ee
Sha256: 4a477bb786727bd8c49a1dbc25dd37dcce7f2ceece74576dffd8a3da739b034f
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5531
Cache-Control: max-age=116774
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6386ffc5-117"
Expires: Fri, 02 Dec 2022 08:33:36 GMT
Last-Modified: Wed, 30 Nov 2022 07:01:25 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "D8B89D773DF7752B81FE909B2AA6833B57A42C6A"
Expires: Thu, 01 Dec 2022 11:00:00 GMT
Last-Modified: Wed, 30 Nov 2022 23:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 3328
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 772795100870b4f1-OSL


--- Additional Info ---
Magic:  data
Size:   1462
Md5:    238b56baea78ff18a18959275bc7e6b2
Sha1:   f790d41f3ba1a1012a51e8d2a7454a2392db1235
Sha256: 88549ac7699e0d183f89e92d0f50f6166f1f48119aaf9a13d6c15db572d3fbf8
                                        
                                            GET /recaptcha/api.js?render=6LdnFqEUAAAAAFM5s_aRoZZO_zDhqoVv6uCdscQi HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         216.58.211.4
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
expires: Thu, 01 Dec 2022 00:07:22 GMT
date: Thu, 01 Dec 2022 00:07:22 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   583
Md5:    b411b4a1e7bb27e3166ad9f9a18b0b5b
Sha1:   89af18140b91a4b5bcfda5ba63a8892e68f80c93
Sha256: 061858ed950071974b09307c5d1250a7d2c1c2a0847dcef1e5378ef0afebcaa3
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/js/datepicker.js HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 5285
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:09 GMT
etag: "42ac-5c80ac2fab258-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (16878)
Size:   5285
Md5:    6c28af1b6fa9301701dfefc5dbfe5159
Sha1:   134cfa1c0a5a837f002034b8ea1a8c6243b96bac
Sha256: 4a47c7c7ccb099528d7387eadcc4989bbbc17d75981507635d015da4711bb932

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/img/sweepstakes250/two.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 915
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:30 GMT
etag: "393-5429f55c8a780"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   915
Md5:    a1914f8236d7704856f5c5762e86c109
Sha1:   ea40712fad474fab16b7e2f1505bcb42302cd6ec
Sha256: 6c21621aeb7ad165ee758074b65bbf2fa35498a74320a940c52a3208375ef26d
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:23 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Mon, 28 Nov 2022 14:10:15 GMT
Expires: Mon, 05 Dec 2022 14:10:14 GMT
Etag: "5fa5eb76f7b98dbf06b12319c1d61d1fb367947b"
Cache-Control: max-age=395570,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 77279511099e1c16-OSL

                                        
                                            GET /assets/img/campaign/1252_welcome.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
content-length: 231382
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 20:33:23 GMT
etag: "387d6-5d7afdc945ac0"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 550 x 350, 8-bit/color RGBA, non-interlaced\012- data
Size:   231382
Md5:    d4814b64f60ea2e3740d84049f449cbc
Sha1:   fab70cfba9864232b41e52589b0211244bd8e289
Sha256: e3830d486194e488c72bde6ce382fd739f767963b072c1044fe222f5969f8e96
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5113
Cache-Control: max-age=134685
Date: Thu, 01 Dec 2022 00:07:23 GMT
Etag: "6387475f-117"
Expires: Fri, 02 Dec 2022 13:32:08 GMT
Last-Modified: Wed, 30 Nov 2022 12:06:55 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /releases/v5.15.4/css/fontawesome.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Thu, 01 Dec 2022 00:07:23 GMT
x-amz-id-2: TOfFpmpCN7DW4h3Zy94BiYCeXRGeDZpu8kYRXR1O90mxFjJk+8mOMth/HJic5LxHa7LElatSi14=
x-amz-request-id: 3J0DBJ058XGCQ4JR
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"a227f005fa7ae066c1068ac4b963514c"
cache-control: max-age=31556926
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v2%2BIfrqT1vLfhPjT58O%2BBJP%2FoB6JsKIQ%2Fq4kLfPDyENucZQhI%2BULZVS1abSETRnq3WQsxYSQ5RPNdD0%2BpjLoiwDibDGa5htS6Tc3tQteyPSiSaSBmpaum6ZIiM%2B90JOKhKtoueop"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7727950ff870e684-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (57687)
Size:   30504
Md5:    579a826774248cf0c15ebe836e7e0d75
Sha1:   7e1e3a27aaeeef03e019b6a3f5fae17f99780537
Sha256: b76d754e1812b7853924956d9a4d358dc1d70549720c24127451d8243140fc16
                                        
                                            GET /generateplacementscript.aspx?placement=13488000&publisher=139136&affid=1252169444874968&subid=1252169444874968 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 109
Date: Thu, 01 Dec 2022 00:07:22 GMT
Content-Length: 703


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (852), with CRLF line terminators
Size:   703
Md5:    493534f396081e822a5956e59802b2aa
Sha1:   01236c972add4ea8b1366218d017d08c813694a6
Sha256: 129c153825a48b65e8a598484477d0f9e9d05b4b50ebf944605face47d16d44a
                                        
                                            GET /assets/img/campaign/1252_bg.jpg HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Thu, 01 Dec 2022 00:07:23 GMT
content-length: 234777
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 20:33:23 GMT
etag: "39519-5d7afdc927660"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3\012- data
Size:   234777
Md5:    664b071df631b9d8d0ad94ed7983585d
Sha1:   d85f8f5260f2dc118011010f83ba62be1a1f2193
Sha256: a3e2a9b0292a99decaf42fcf3cd4883b9c491083c3acb407eced850dc0c66e0e
                                        
                                            GET /s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23040
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 12:29:22 GMT
expires: Fri, 24 Nov 2023 12:29:22 GMT
cache-control: public, max-age=31536000
age: 560281
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23040, version 1.0\012- data
Size:   23040
Md5:    de69cf9e514df447d1b0bb16f49d2457
Sha1:   2ac78601179c3a63ba3f3f3081556b12ddcaf655
Sha256: c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
                                        
                                            GET /s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 29 Nov 2022 17:11:08 GMT
expires: Wed, 29 Nov 2023 17:11:08 GMT
cache-control: public, max-age=31536000
age: 111375
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23580, version 1.0\012- data
Size:   23580
Md5:    e1b3b5908c9cf23dfb2b9c52b9a023ab
Sha1:   fcd4136085f2a03481d9958cc6793a5ed98e714c
Sha256: 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /releases/v5.15.4/webfonts/fa-solid-900.woff2 HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: font/woff2
                                        
date: Thu, 01 Dec 2022 00:07:23 GMT
content-length: 78268
x-amz-id-2: lPhOIGbWq+FmPJzHRApXEGkNfpuIaEWhTM/o7uE2tBonibvXfHmDkgmCcQ53mMc/gRkg25K1DCc=
x-amz-request-id: 3J0AJWE8E2FYDTG0
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:47 GMT
etag: "d824df7eb2e268626a2dd9a6a741ac4e"
cache-control: max-age=31556926
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJQQaSWdI4buwvUBwxqJKLVH774x7%2FLXMDJkAUBjgyLhj1oZg1YBuZ5FPQf5XNdHpeNiGTj0J5x9gQU15T0fvQrDT0Rxhy6KQp7C9DD91gRmedDCKez17zb5yC7l4S7dM9pC1OhZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77279512a9e8e684-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 78268, version 331.-31196\012- data
Size:   78268
Md5:    d824df7eb2e268626a2dd9a6a741ac4e
Sha1:   0ccb2c814a7e4ca12c4778821633809cb0361eaa
Sha256: 9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
                                        
                                            GET /GenericPlacementScriptDiv.aspx?tmgrt=ancs&mainPlacement=13488000&hasLoadOptimation=0&hasMinAssets=1&placement=13488000&publisher=139136&affid=1252169444874968&subid=1252169444874968 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 109
Date: Thu, 01 Dec 2022 00:07:22 GMT
Content-Length: 4809


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (15047), with CRLF line terminators
Size:   4809
Md5:    92834df3eda92e2e43b75cabdca812f4
Sha1:   77644fe84f9135b23e31f1b1e3f3ea2cb7da594a
Sha256: 2f9484a050cead324c6efd7ddce6135e48d8ba636884f2dbefce7e064c816d85
                                        
                                            GET /amsus/ldsapi/assets/images/spacer.gif HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: image/gif
                                        
content-length: 43
content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 4d720c56-e01e-004d-35f4-039211000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAABFcmC60GoKQZbH78cWaWa6QU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
                                        
                                            GET /amsus/ns/assets/awesome-font/font-awesome.css?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: text/css
                                        
content-length: 520
content-md5: AExI7hLtZOIj2uUf/9qAyg==
last-modified: Fri, 21 May 2021 11:01:09 GMT
etag: 0x8D91C47BDA9A147
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 3d1ee99d-a01e-0068-5ff4-030aa2000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAABwxHVoNjngSpTEce7agq2uQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (520), with no line terminators
Size:   520
Md5:    004c48ee12ed64e223dae51fffda80ca
Sha1:   a3a70b71586d8573a400bd4a2a0eb9bf8ec39c17
Sha256: 735903b0b0ffc434c5dd315d19c20594526dd23bcc44480e69edfbe20f4fb117
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15835
Expires: Thu, 01 Dec 2022 04:31:18 GMT
Date: Thu, 01 Dec 2022 00:07:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15835
Expires: Thu, 01 Dec 2022 04:31:18 GMT
Date: Thu, 01 Dec 2022 00:07:23 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc551f651-39d0-4021-90ed-915a79168ea0.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4409
x-amzn-requestid: dc9ccdbf-a051-49ce-a535-c100b8ee6f12
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cbz81EHdoAMF6dQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387cd1e-0b06c368156b828e0c663081;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:37:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UsYYNMsulshDYcUC9N2Q3fnxjdZd5ki-0_LlXRchIsNSq0FruNhFqw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:48:09 GMT
age: 8354
etag: "1e78566f2e69268c5f753fb49112ab07aae3eccf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4409
Md5:    b8802d5080eb35e4052ef31cf7658650
Sha1:   1e78566f2e69268c5f753fb49112ab07aae3eccf
Sha256: 9c96906ee1dea353198c9069fa7e42b100e4fa766e5be8e4d8db036033961086
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c95c82f-93f9-4783-a6c2-2c737a51d52c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12655
x-amzn-requestid: beeeccd0-a494-4d0c-91e9-0d1e2ab37b6f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cb0YoFmMIAMFT4w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387cdd0-60f5e2286cf3965a42ab31b9;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:40:32 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: CiGOvF7Lmz8cICQcjUcE6QGokbAIAd3WClI4PK_aDSxo-yHVcPPA7w==
via: 1.1 49cdeca097624936e070b73619df7da8.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:45:29 GMT
age: 8514
etag: "06b395b4fbad5ad9c9fb6a4fb24c1eee607aa8ac"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   14193
Md5:    320b52e3d7510a9123ee4e65c5b7fa4e
Sha1:   62bce51ec7fe4bd045768e70a2ec35abd2d08653
Sha256: 54d47643f03838c1f4d86dfb4e9309b88ae2dec81e599ee43fce2f741f549a4c
                                        
                                            GET /amsus/ldsapi/assets/script/browserdetect.min.js?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: Shzc0tuaykHxXX+tfi+uUQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 95405f7c-901e-002f-1a9f-02d5c9000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAAD1Yntf6trOTq8x9hyG1lyGQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (2046), with no line terminators
Size:   5830
Md5:    cb4deef54f345ba56ace6815d42b812f
Sha1:   8539d756ce0a0831e91c002b5a6f470721c782c4
Sha256: 6f3408c820d7105fdb7b2f6d785e73e4dbc1f1cf52287509be2d1a6117b1e6da
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9768b9bd-d7a9-4426-a5b2-ea1a71860733.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 2150
x-amzn-requestid: 59ef9edf-d9c1-45d0-b084-adf8e2f0738d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cXQcKGPXoAMFbWA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6385fab4-693e8d7d5632d48722e31757;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 12:27:32 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: iO-jUNMNzAM6zHh1oEftgZcW18vxdgaFGpNe4a1WHU97pRMMuHIKaQ==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 17:51:49 GMT
age: 22534
etag: "9bc2e9039e9340b83ffcfb90e4e2c631a8723e60"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2150
Md5:    995eb3df7ec5507e3392fdb1ca6395b4
Sha1:   9bc2e9039e9340b83ffcfb90e4e2c631a8723e60
Sha256: 4c86fdcd3b338040ea8130ee6a1ed5c3bd66c4dd59fe461f81e5df88a379ebb3
                                        
                                            GET /amsus/ldsapi/assets/script/clientfp.min.js?version=20211103 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: E4ptMzZLxbawD4B7RV5YCQ==
last-modified: Wed, 03 Nov 2021 09:07:36 GMT
etag: 0x8D99EA961032FA1
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: a0fd86aa-c01e-0051-66a4-044a06000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAACha0YoetaDS4s+6137iIpLQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (3119)
Size:   25788
Md5:    6c472acd2323fbf72d9a4f3b71b964b9
Sha1:   74654a7dc5f162f0aac3a27a2ef4514134bec3f0
Sha256: e0d3e6f9d8253a811fb531be3b6552016c0316fa2a2c87c02e1ab36afd74a5c7
                                        
                                            GET /amsus/ns/js/13488000.min.js?2330k30j20222330j11ckl30llk164jkk072300 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: 9wgtvP0cVsloq3UaPunwsA==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4E2F58
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 24282651-401e-0062-7807-03132b000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAADqXCxoVHVJT5ViQM39nNorQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   4886
Md5:    be13c5901fc9fa1d0d2d8cb1cadca794
Sha1:   e40747c082b832eba52d919dfcbc1d88683ae3c3
Sha256: 11b56a527f288d467b8ed056e2852672d06152f70352a39551adc5d653c820f0
                                        
                                            POST /ManageImpressions/ReportViaJsPlacement.aspx?hKey=1320340452&affid=1252169444874968&subid=1252169444874968&Placement=13488000&Publisher=139136&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Thu, 01 Dec 2022 00:07:23 GMT
Content-Length: 663


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   663
Md5:    dc649cd664017d3bbdf39a6aa14af3b1
Sha1:   0085c620149547c14eb31a458202b7ad0f0b6573
Sha256: e23892252d4aefb1af5e3c5a1af41ba0240c2a958e3afa4a11dcb8b5cd980675
                                        
                                            POST /ManageImpressions/ReportViaJsCampaign.aspx?hKey=1320340452&affid=1252169444874968&subid=1252169444874968&Placement=13488000&Publisher=139136&CurrentCamps=10023.10023/226/0/225&PreviousCamps=&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Thu, 01 Dec 2022 00:07:24 GMT
Content-Length: 711


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (351), with CRLF line terminators
Size:   711
Md5:    35869f47b0f8427b240978d236e309b7
Sha1:   462f8247a64bed2cfbab9323a9697d995d7dead1
Sha256: 143a76f36626342bd6948f8e8462fd6147f6ea4d59e69047424911b8cbcca227
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:24 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 30 Nov 2022 10:10:21 GMT
Expires: Wed, 07 Dec 2022 10:10:20 GMT
Etag: "ae8340402ca7e72236e34197ac0864df6dc88eb2"
Cache-Control: max-age=602490,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 177
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7727951c5837b51d-OSL

                                        
                                            GET /amsus/ns/assets/awesome-font/fontawesome-webfont.woff?v=4.1.0 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://tmgassets.azureedge.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: font/woff
                                        
content-length: 83760
content-md5: /fSRzl/1stoCcIzQ6YZHGQ==
last-modified: Fri, 21 May 2021 11:01:16 GMT
etag: 0x8D91C47C18878E8
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 3d484154-401e-0004-4c4c-04a171000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET
x-azure-ref: 0PPCHYwAAAADwlgPBpOGpRL6ikOTixRgNQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:24 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 83760, version 1.0\012- data
Size:   83760
Md5:    fdf491ce5ff5b2da02708cd0e9864719
Sha1:   7f2f3c55c2de192387c351b995115f6b79e09173
Sha256: 66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 26
Cache-Control: max-age=158413
Date: Thu, 01 Dec 2022 00:07:24 GMT
Etag: "6387b7ef-118"
Expires: Fri, 02 Dec 2022 20:07:37 GMT
Last-Modified: Wed, 30 Nov 2022 20:07:11 GMT
Server: ECS (amb/6BB2)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /go/api/zip/undefined?get_param=value HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:25 GMT
content-length: 111
server: Apache/2.4.41 (Ubuntu)
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
set-cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p; path=/; HttpOnly; SameSite=Lax
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   111
Md5:    4072747d6757278fe77c6970474ad27d
Sha1:   7404af04b7ef1db62f26e0a08fe82ab5a184e901
Sha256: 7d911cc2e66702b54cfca359fb39a67a65259e9ed6706c4a78516d20a4670e6f

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=169805
Date: Thu, 01 Dec 2022 00:07:25 GMT
Etag: "6387d145-1d7"
Expires: Fri, 02 Dec 2022 23:17:30 GMT
Last-Modified: Wed, 30 Nov 2022 21:55:17 GMT
Server: ECS (bsa/EB1E)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 1InCd0nlLpHLluty4UzhdtLG_iJXsMFDgq_5Nvpe_JWUXOg-uobaYg==
Age: 4933

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 162976
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Nov 2022 19:09:57 GMT
expires: Tue, 28 Nov 2023 19:09:57 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 14 Nov 2022 03:01:59 GMT
age: 190648
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (730)
Size:   162976
Md5:    79d18cf4265108d7cecca1bf4ada6109
Sha1:   e51d0285a545381d4c39e9e0292a650ffeeecbb9
Sha256: 59ce7253f371df0833c3f72d4748ef812002b90a49413c56d0ca7c40bb5a0ab6
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.110
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Wed, 30 Nov 2022 22:41:08 GMT
expires: Thu, 01 Dec 2022 00:41:08 GMT
cache-control: public, max-age=7200
age: 5177
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   20039
Md5:    47e6f374ca946fddd5b59871b325736c
Sha1:   baa9282efc8785e84d247c3bff518eaa45f101c4
Sha256: 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
                                        
                                            GET /trustedform.js?provide_referrer=false&field=trusted_form&l=16698532435180.2023018668983969&invert_field_sensitivity=false HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         35.173.51.161
HTTP/2 301 Moved Permanently
content-type: text/html
                                        
server: awselb/2.0
date: Thu, 01 Dec 2022 00:07:25 GMT
content-length: 134
location: https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=trusted_form&l=16698532435180.2023018668983969&invert_field_sensitivity=false
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/59bdf0/key/93f9ac7f59e7c218e81ecdc90a9d483f/aid/16944/s1/4874968
Cookie: ci_session=ml9c06rvs0ua6orb6fumbq8nv73oiu6p
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
                                        
date: Thu, 01 Dec 2022 00:07:25 GMT
content-length: 5430
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:08 GMT
etag: "1536-5c80ac2e78fe8"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   5430
Md5:    b0a102991e7332643ae57365023c00c8
Sha1:   4ea4c55c982e08bda104d2e8e981594c067cef24
Sha256: 1dfc58ffbcb07c761f79eb6b46f50b3789bd21e41a0b4cb1aca82b1dd8020fcc
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=103774
Date: Thu, 01 Dec 2022 00:07:25 GMT
Etag: "6386d13c-1d7"
Expires: Fri, 02 Dec 2022 04:56:59 GMT
Last-Modified: Wed, 30 Nov 2022 03:42:52 GMT
Server: ECS (nyb/1D31)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: lMu1g2k33HqlBjhYSvo-IX7RBM_tcSu3SKzN4Rnd1JR3-BfN2oynzA==
Age: 4447

                                        
                                            POST /api/hitsnap.ashx HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 10688
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Cache-Control: private
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Thu, 01 Dec 2022 00:07:25 GMT
Content-Length: 21


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   21
Md5:    8736cdfe08480bca66cffeee06268705
Sha1:   81af0417f969f93848b1cf30fce1db93884facc1
Sha256: 838a7c62adda8d131d694ae13ba2c5b73579aeb0f327d9f23e23880943a8a289
                                        
                                            GET /modules.8066ef274cc529c933d8.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.40
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 68637
date: Wed, 30 Nov 2022 12:36:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "0b6db42a732a2de4485e2b0a05434f63"
last-modified: Wed, 30 Nov 2022 12:35:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 1T5ZkoBXgO6QDUrL6-dTU-GmH8cMuI0SsYlFU5w3lDFS_7AjR-tHwA==
age: 41480
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (48714)
Size:   68637
Md5:    0b6db42a732a2de4485e2b0a05434f63
Sha1:   66444f933838db2867531f93074398f64d88f564
Sha256: 00b5a5f52cd6034433eb7f56b4de77c78f305bbb2046d25ffcb55a821f71d1b4
                                        
                                            GET /box-5e66f98b4ee957db209dc6f63e3d59dd.html HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.55.105
HTTP/2 200 OK
content-type: text/html
                                        
content-length: 1035
date: Wed, 23 Nov 2022 13:10:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 8ddb6d7670d8c5a85c04a10525a71b90.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: FlV-oZ69WEuIrDn1I7p34B8U0nVWGaVW-p4ZEX1WrEGj-6xUJmbNtA==
age: 644240
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Size:   1035
Md5:    e0652b84b7b3b650769c759fc520c3f8
Sha1:   0b55d6e28613350c7f41b88f19e726e6751ad03b
Sha256: 94b4c240f83065223dcacdd3f8b69cb229d0616edc3e2041eef3e270d859fc3d
                                        
                                            GET /iframe.html?token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=3CCED9A6-4A67-D637-ACDC-CCF79B4A5210&lac=FCB958C1-1AC9-561E-1E7C-7EB79158EEC4 HTTP/1.1 
Host: d2m2wsoho8qq12.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.42.159
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Wed, 12 Oct 2022 20:15:04 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Wed, 30 Nov 2022 15:23:43 GMT
ETag: W/"63472048-dbb"
X-Cache: Hit from cloudfront
Via: 1.1 aa34a836095df9de9d246a53dd63f1d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: mp8ZWLy0W8md5fIucCB_Ab5BKJaMboBKCOfh5CNVz8WIAxc2uvxz1A==
Age: 31494


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   1449
Md5:    ef825b8a88a51cd76a51d08dfc1d4f99
Sha1:   5bf247bd91a4be0c3b76a70ec8e5e462de0e9f3b
Sha256: 2ac453ec379c3e7b0fa69b810ecf2d6771de3e7611a2599a20f8e8ce9a240af1
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=146629
Date: Thu, 01 Dec 2022 00:07:26 GMT
Etag: "638775de-1d7"
Expires: Fri, 02 Dec 2022 16:51:15 GMT
Last-Modified: Wed, 30 Nov 2022 15:25:18 GMT
Server: ECS (nyb/1D31)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: U6ZiBIlpl_vP7m-0uwPHbmYA3IYzcTKl0Yy57LpySiWUL-2WMAj3Sg==
Age: 5157

                                        
                                            GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 21:48:03 GMT
expires: Fri, 24 Nov 2023 21:48:03 GMT
cache-control: public, max-age=31536000
age: 526763
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Size:   15344
Md5:    5d4aeb4e5f5ef754e307d7ffaef688bd
Sha1:   06db651cdf354c64a7383ea9c77024ef4fb4cef8
Sha256: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
                                        
                                            GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.227
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 16:40:43 GMT
expires: Fri, 24 Nov 2023 16:40:43 GMT
cache-control: public, max-age=31536000
age: 545203
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Size:   15552
Md5:    285467176f7fe6bb6a9c6873b3dad2cc
Sha1:   ea04e4ff5142ddd69307c183def721a160e0a64e
Sha256: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
                                        
                                            POST /api/v2/client/sites/2865935/visit-data?sv=6 HTTP/1.1 
Host: in.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 130
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         54.76.221.57
HTTP/2 200 OK
content-type: application/json
                                        
date: Thu, 01 Dec 2022 00:07:26 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   206
Md5:    cecb2d44b4be3f8100e448dac1c9e401
Sha1:   9ada18d8b81fedccb26655bb33a7cbb634989a5b
Sha256: 56fb00db25df6ab77822337e9a345e2d08a3e298d9bcff171f24d8b41f4556ed
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /bootstrap.js?provide_referrer=false&field=trusted_form&l=16698532435180.2023018668983969&invert_field_sensitivity=false HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://monthlysweeps.us/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.91
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Thu, 01 Dec 2022 00:07:26 GMT
last-modified: Tue, 29 Nov 2022 19:24:00 GMT
x-amz-version-id: jCFTHa4_D.dnuiumCq7.wUY_tmObizl8
etag: W/"226cf2375a4ea1f8ea8315621d70424b"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 46MHb53kjPX3ZgzzrHov75SRHVvdHgX4AO3h_zdYlIIQF3ZEN584AA==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   3273
Md5:    7eb8acfe5a7047967a95111b84e1a652
Sha1:   2f94d95dcb96967da0cd4c9e2eabaa58890b52f9
Sha256: 701b5f93473e6344f5ddce3eea6672d76a4b02d883edf331c8c5d345dd4593d0
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 01 Dec 2022 00:07:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.88
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Thu, 01 Dec 2022 00:07:26 GMT
Last-Modified: Wed, 30 Nov 2022 23:09:37 GMT
Server: ECS (bsa/EB1E)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: CmvCwDDKDPQc3ynBYFRTGRUvnwMvKlHS3P1OAZDwgl0C6tp9FVL6sw==
Age: 3469

                                        
                                            POST /certs HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 645
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.173.51.161
HTTP/2 201 Created
content-type: application/json; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:27 GMT
content-length: 475
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (475), with no line terminators
Size:   475
Md5:    5841820a34665c5bded0fc7e7243a04f
Sha1:   bf60787a9302c9f472bcd879249ed42407200f8d
Sha256: 90f95dfcb0d8213dfefc94623759a8695510bce36b6e3395b53f8eea3412f576
                                        
                                            GET /trustedform-1.8.31.js HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         54.230.111.91
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Tue, 29 Nov 2022 19:24:00 GMT
x-amz-version-id: zyVp10qBIDUkm0kSLQCBEAAE6CiOCr9w
server: AmazonS3
content-encoding: gzip
date: Thu, 01 Dec 2022 00:06:59 GMT
etag: W/"642f630e75dc2888743ef1bcac8f0de0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: orQp08tu0svK_u7VmRIHGu3QFz1iCSjTtwD-OmwE5w-ZcnH69WniVA==
age: 30
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37653
Md5:    dc54edd373e6a9a9bf8e9667d23ef607
Sha1:   d7efff4077adb1eb18277f74e4bea701ceae215f
Sha256: f1c645e1befa0b144e73d321340a82f4edf95416ec221f9fefff09ccbd309d39
                                        
                                            POST /certs/819905bff0f43517e402bf0ab348a825a1eaf916/fingerprints HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 262
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         35.173.51.161
HTTP/2 204 No Content
                                        
date: Thu, 01 Dec 2022 00:07:27 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2

                                        
                                            POST /certs/819905bff0f43517e402bf0ab348a825a1eaf916/events HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 226
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         35.173.51.161
HTTP/2 204 No Content
                                        
date: Thu, 01 Dec 2022 00:07:30 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9459
x-amzn-requestid: c08f55b2-7ac6-4dec-b53c-fd3f4533f9c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cMpBiGoHIAMFR2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381bba3-69c2c2d05e55fd745caf1dce;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 07:09:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: w_Mb-0pBwp-pUyU2bdJ8MhrGHkk6VQgJmcGV9MfHwj_yGUMIYZkyrg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 10:53:00 GMT
age: 47670
etag: "2f9532d698b4c28df23e18bbb66399ec776d5b9f"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9459
Md5:    e1e6b6ba4f82221b41c3d9129008c76d
Sha1:   2f9532d698b4c28df23e18bbb66399ec776d5b9f
Sha256: 218c6f41a16e6087c611d4db5784a7cc1d027084d0bf2bd6dc3843ee5dfd560f
                                        
                                            GET /amsus/ldsapi/assets/script/standard.min.js?version=20220221n HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: YTnb0ehLGLRubF63e3IyDA==
last-modified: Mon, 21 Feb 2022 16:55:53 GMT
etag: 0x8D9F55B05E46BD0
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: e1c8e4be-201e-005b-5cc6-04538f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAAArjnNZwhTZR6IMsxackqeiQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common.min.js?version=20221130b HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: wAOmaVleQG4B9ItWlOcXug==
last-modified: Wed, 30 Nov 2022 16:53:21 GMT
etag: 0x8DAD2F3639BB96E
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 36c4247e-601e-005c-4110-05a50a000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAAAKIk2xYxn7RLzmGWKq9StzQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/SaveDom?msn=2&pid=f5e37245-0c5b-4437-aff4-f12569a61e78&token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&_=624295528 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 512
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:26 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rguserid=5182b8bb-99fd-4a1b-ae2a-b5280c221330; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /campaign/3cced9a6-4a67-d637-acdc-ccf79b4a5210.js?snippet_version=2 HTTP/1.1 
Host: create.lidstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.22.39.182
HTTP/2 200 OK
content-type: text/javascript
                                        
date: Thu, 01 Dec 2022 00:07:24 GMT
x-amz-id-2: JxVKDIpfEXNN8mHvjD3KE2sZrSK8aILbw6OCqrpOgmpb4AtcJoNHDWOFUB/aO5N7GKxjfIthE8I=
x-amz-request-id: R45MKB81Y6E236VE
x-amz-replication-status: COMPLETED
last-modified: Fri, 12 Nov 2021 00:55:16 GMT
etag: W/"97495a102c98049f30e62264b1eb50f5"
cache-control: max-age=1800
x-amz-version-id: StKcIVmHluaEF1AzrOc3qrEmwMpZOgwG
cf-cache-status: HIT
age: 926
vary: Accept-Encoding
server: cloudflare
cf-ray: 7727951ca9e0f152-ARN
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /iframe.html?token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=3CCED9A6-4A67-D637-ACDC-CCF79B4A5210&lac=FCB958C1-1AC9-561E-1E7C-7EB79158EEC4 HTTP/1.1 
Host: deviceid.trueleadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         34.194.94.191
HTTP/2 200 OK
content-type: text/html
                                        
date: Thu, 01 Dec 2022 00:07:26 GMT
server: nginx
last-modified: Thu, 22 Sep 2022 15:32:09 GMT
etag: W/"632c7ff9-1049"
expires: Fri, 02 Dec 2022 00:07:26 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: max-age=86400, public
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /2.11.9/SaveDeviceId.js?lac=FCB958C1-1AC9-561E-1E7C-7EB79158EEC4&lck=3CCED9A6-4A67-D637-ACDC-CCF79B4A5210&methods=48&token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&uuid=6f0cd6b1c7084e53b86e4160eaaa21e9 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/javascript;charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:27 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguserid=1581c4ca-e0e5-4984-bc1d-b3ccdb69297f; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=4&pid=f5e37245-0c5b-4437-aff4-f12569a61e78&token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&_=624295530 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 945
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:27 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguserid=ca88edf9-bfd9-46f4-9769-5c74ff10c64b; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5117
Cache-Control: max-age=134690
Date: Thu, 01 Dec 2022 00:07:22 GMT
Etag: "6387475f-117"
Expires: Fri, 02 Dec 2022 13:32:12 GMT
Last-Modified: Wed, 30 Nov 2022 12:06:55 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 279


--- Additional Info ---
                                        
                                            GET /releases/v5.15.4/css/solid.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Thu, 01 Dec 2022 00:07:23 GMT
x-amz-id-2: 8sKNCa1SFzf00F1Pk211B/6kjJNqK8qbjfviZze6C1+kwbJfk2tO6RECEQdTriN0tUJDfZlOWsY=
x-amz-request-id: 3J0BTW7CX12T77G3
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"685a6b10be9f3db25acf78c5e7ba7379"
cache-control: max-age=31556926
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EzesC5lV%2Bdw%2F%2BWabb3oNBJB0futUJ8MLoUmmZn57EcpDGbM6Qnx0vbWt2XkcUI8pqZDvneRYc%2F1K8voDFkTG0iwW2Neb1dKNCtNFZlFG8K2Yg4Sj1PgPVt0qhTFAK0YplAhXUG1z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 772795101880e684-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common-extentions.min.js?20221130b HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: G3v7pHqbSC0Gvp9zsfwXIA==
last-modified: Wed, 09 Jun 2021 12:26:50 GMT
etag: 0x8D92B41DB6898DE
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 6b9cc3a1-001e-0047-75d1-048b98000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0O/CHYwAAAAAUkA1aqX4+QpSvWLZqFA5NQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /c/hotjar-2865935.js?sv=6 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.8
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:06:52 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/fa183049e47c4f59f05d0c8979e34cc3
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: l8FrivToIjyXcIt0F53N2U7k5ztP3_EFW3FM3Rbf9PTrH3ju1jdyMw==
age: 33
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=5&pid=f5e37245-0c5b-4437-aff4-f12569a61e78&token=7D0A7FD5-15ED-E37A-9E97-7BAE354E5842&_=624295531 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 1064
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:27 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguserid=f9460ff0-6e89-42e1-ab3a-24e07303bef7; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sat, 31-Dec-2022 00:07:27 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/css/bootstrap.min.css HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.11.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: SE
cdn-edgestorageid: 723, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-04-23 06:51:23
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: fb769ef43d6803d303a68c7d7f774d4c
cdn-cache: HIT
cf-cache-status: HIT
age: 17960340
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7727950f6a4fb512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.11.207
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Thu, 01 Dec 2022 00:07:22 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
cdn-edgestorageid: 565, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:05 GMT
cdn-cachedat: 2021-06-08 18:02:12
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: a9c552a6ef500abddb12a9852509d4ed
cdn-status: 200
cdn-cache: HIT
cf-cache-status: HIT
age: 15299395
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7727950fca72b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /css?family=Lato:400,700|Oswald:400,600,700 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.74
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 01 Dec 2022 00:07:22 GMT
date: Thu, 01 Dec 2022 00:07:22 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ns/js/offers_extended_functions.min.js HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.246.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: JsdJsTroZxL3ol3Owm84Vg==
last-modified: Mon, 07 Mar 2022 22:37:07 GMT
etag: 0x8DA008B03257DBD
x-cache: TCP_HIT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d674a27b-901e-0049-6a4c-046793000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 0PPCHYwAAAABUKX57b1SLS6LfFkCd3w8zQU1TMDRFREdFMTgwOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Thu, 01 Dec 2022 00:07:24 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/GenerateToken?msn=1&pid=f5e37245-0c5b-4437-aff4-f12569a61e78&_=624295527 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 250
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Thu, 01 Dec 2022 00:07:26 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rguserid=8866dee4-d69f-4cfb-be3e-1db9ed465f7d; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sat, 31-Dec-2022 00:07:26 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---