Report - metro-electric.co/

Report Overview

Visited public
2025-06-07 05:36:17
Tags
URL
metro-electric.co/
Finishing URL
no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
IP / ASN
77.247.179.85
#43350 NForce Entertainment B.V.
Title
kelkoogroup.net

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
arveaoy.com	unknown	2023-01-06	2023-01-10	2025-05-31	3.0 kB	1.1 kB	3.126.48.135
api.yadore.com	591567	2014-09-12	2017-11-28	2025-06-06	580 B	174 kB	88.99.112.2
metro-electric.co	unknown	2024-07-24	2025-06-07	2025-06-07	1.9 kB	1.6 kB	216.245.197.42
lucia-lzi.com	unknown	2025-05-27	2025-06-05	2025-06-05	3.3 kB	4.3 kB	0.0.0.0
ct.captcha-delivery.com	42546	2019-12-23	2020-02-05	2025-06-01	422 B	14 kB	54.240.174.110
no-go.kelkoogroup.net	unknown	2017-08-18	2017-10-30	2025-06-05	6.4 kB	178 kB	95.211.116.26
static.captcha-delivery.com	38537	2019-12-23	2020-05-12	2025-06-05	3.6 kB	62 kB	54.240.174.108
geo.captcha-delivery.com	43337	2019-12-23	2020-03-18	2025-06-01	7.4 kB	1.2 MB	13.50.6.43
dd.prod.captcha-delivery.com	unknown	2019-12-23	2022-04-28	2025-06-01	1.1 kB	16 kB	54.240.174.72

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-06-07	medium	no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com	Code and strings of plugins from the Tetris framework loaded by Swid

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com	ScriptElement	158 kB	2025-06-07	2025-06-07
Pretty URL no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com IP 95.211.116.26 ASN #60781 LeaseWeb Netherlands B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash 07ddb52c2af26a4675ac523bd995b8b6 4a22800c260d2ae6d40c58252fc77f04bdb822e8 0a7c42f166a30ad4d86dfd733915088ed0e7d00676bd2dd9f19858e07bc5eadd Loading...

	no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com	ScriptElement	12 kB	2025-06-07	2025-06-07
Pretty URL no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com IP 95.211.116.26 ASN #60781 LeaseWeb Netherlands B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash 3a2c37234351ac779b5a3e0a9c152389 42342d19334cbc385331a39164cc58ff0ce6752c 4f62c1a545d8865968bad160b52537e38098fc91e0e93648977830d926195de4 Loading...

	no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com	ScriptElement	1.3 kB	2025-06-07	2025-06-07
Pretty URL no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com IP 95.211.116.26 ASN #60781 LeaseWeb Netherlands B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash e3df625115fcf744fddeba4d64241b4d 51742d34dda80488d5c4c6e90b89f37df328ebb6 653642f0758119ce7a987d2e610306cf417ad92791d2c01fc8b2c0c3bb32a826 Loading...

	no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false	ScriptElement	370 B	2025-06-07	2025-06-07
Pretty URL no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false IP 95.211.116.26 ASN #60781 LeaseWeb Netherlands B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash 7b40f4e2bbe315887ab172ad71a907c3 71c73e100614f2406e6b9172b355e4deca76db46 75d6cd7147aaa6e7eca4d90032768d639d11be6fa2db72cb7942c61091ee38e1 Loading...

	ct.captcha-delivery.com/i.js	ScriptElement	13 kB	2025-02-18	2025-06-14
Pretty URL ct.captcha-delivery.com/i.js IP 54.240.174.110 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-18 06:11 Last Seen2025-06-14 14:02 Times Seen904 Hash c289d6c8b0e743fd024d52618d546f20 cd29405db7518c6943bacc943ac35c3d314ac722 8d973ba5eafa4328ff1feaefd70cccd0472b8af0c006285ba63eed00977935cc Loading...

	geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd	ScriptElement	552 kB	2025-06-07	2025-06-07
Pretty URL geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd IP 13.50.6.43 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash a5bf139b0fba67c8d0b145f43130c73e c3cc1dd7cb3cf822e6ffc3110d2877efb3648962 a48f331d7fb54dd558d46b429752d40ae2cc1422e579a7bbf195873a4c1af77b Loading...

	lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381	ScriptElement	2.8 kB	2025-06-07	2025-06-07
Pretty URL lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-07 05:36 Last Seen2025-06-07 05:36 Times Seen1 Hash 4647fa4f329b83478527cb3d8ba7f37a 86088aa8f9402b7205e5f911a361e1dc8b3158a7 b876f7c2131c337b069a49a0c54d7653c37400b579f38509db35f5a8fd8bf846 Loading...

HTTP Transactions (27)

URL IP Response Size

arveaoy.com/double?t=2&d=eyJVUkwiOiJodHRwczovL2FwaS55YWRvcmUuY29tL3YyL2Q_dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmZhcm1hc2lldC5ub1x1MDAyNm1hcmtldD1ub1x1MDAyNnByb2plY3RJZD1TZGU0Nm9wUkhKRFhcdTAwMjZwbGFjZW1lbnRJZD02bUo2NUlCeDltbm4iLCJSZWRpcmVjdFdvcmRpbmciOiIgIiwiUmVkaXJlY3RUaXRsZSI6IlJlZGlyZWN0aW9uLi4uIiwiUmVkaXJlY3RMaW5rVGV4dCI6IiAiLCJJbnN0YWxsSWQiOjIwMDF9

3.126.48.135

200 OK

780 B

URL User Request GET
arveaoy.com/double?t=2&d=eyJVUkwiOiJodHRwczovL2FwaS55YWRvcmUuY29tL3YyL2Q_dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmZhcm1hc2lldC5ub1x1MDAyNm1hcmtldD1ub1x1MDAyNnByb2plY3RJZD1TZGU0Nm9wUkhKRFhcdTAwMjZwbGFjZW1lbnRJZD02bUo2NUlCeDltbm4iLCJSZWRpcmVjdFdvcmRpbmciOiIgIiwiUmVkaXJlY3RUaXRsZSI6IlJlZGlyZWN0aW9uLi4uIiwiUmVkaXJlY3RMaW5rVGV4dCI6IiAiLCJJbnN0YWxsSWQiOjIwMDF9
IP
3.126.48.135:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectarveaoy.com
Fingerprint18:24:ED:D6:E3:2E:3D:5B:DD:F8:09:47:D2:D7:9D:37:8D:B0:30:09
ValidityFri, 18 Apr 2025 00:17:54 GMT - Thu, 17 Jul 2025 00:17:53 GMT

File type
HTML document, ASCII text
Size
780 B (780 bytes)
Hash
dadad2f179580a82bfcee8e9ba722cba
facfca39a848f3360776d35e195ae23cf7a29524
52d3fa637ff7578b2b6c458fc651ce1390377fdb959fa54bf4103f7aede1881e

HTTP Headers

GET /double?t=2&d=eyJVUkwiOiJodHRwczovL2FwaS55YWRvcmUuY29tL3YyL2Q_dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmZhcm1hc2lldC5ub1x1MDAyNm1hcmtldD1ub1x1MDAyNnByb2plY3RJZD1TZGU0Nm9wUkhKRFhcdTAwMjZwbGFjZW1lbnRJZD02bUo2NUlCeDltbm4iLCJSZWRpcmVjdFdvcmRpbmciOiIgIiwiUmVkaXJlY3RUaXRsZSI6IlJlZGlyZWN0aW9uLi4uIiwiUmVkaXJlY3RMaW5rVGV4dCI6IiAiLCJJbnN0YWxsSWQiOjIwMDF9 HTTP/1.1
Host: arveaoy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: ClickDataNG=H4sIAAAAAAAA_7RU32_bNhD-V4wDAmyAIpMSpVgqjCI_kC1FkwxLu-5hLzR5cphQpEBSiu22__tASUmNba97MX33fTjex_tOX2FA55U1UANNSUoggbDvEGqSgO83n17_C2sGdAEl1A3XHhMQWonnGwk1lO2Hsri52FWtMZCA5AGhpmesys5YUawSELztuNqayGasoFUCyl_-dv5Wy9nAg7IjgZZFvkrA9RpjSBJwKJVDEW4xPFoJdZGAt70TI57nCWhupDLbmT5Hn52GGiAB2zToIpZlOc0T2DhuxONMHsGJ-hhC5-vlkncq3XNpHabCtsshW8r3vdPrET_Jz0-y65Ps-uXlJW24a7lXGFJj_-oJycqWu2cM69ewc_YJRbiR6weJrLTd779-uPpzxjQX2KKJ6D9eUFgfoCYpIUVUP6Dppyl0fG_78KPxy945NGIPNXx-uIIEeqeOlbgBud2PMsZxvQ9uUHI9zmDqAndByfXBsRVWjJSE5SWltCGbXAialUQKynK-KlZcFhJLzvNsw0S-WRXYSJE1ZS4rSktCKspY0dCyYrmoMsnYVD9KWY9KCCFTKnC3VXLd2F1wNpxi40-Hw3b71LYteZooXhy69YZLZXt_uukPB-4kJKC6cykdeg81VDStSMqylBbsGCqnofce3fkWTYAabu1Bac2XRUoWP31RRtoXv7j7tKAkJe8WX5Qp2bvFLv64oaY5S8nPi19QPNtlRighlNDFtXLY2N1yRCEOpUGHDmrQvVD8VB9UfOXofhyUwLe9sbHX-c7oRf_Hj32LhTbOvvix0HzFW4kLx42cxEyJWytRHyfueItTLKb74JJvNC6vHj7GF_Ed1HCh1W7xYHUf18uP3upNcNExd_ejkO3Uzd39t2_3XtvFZSTsI1OF_REA0X4OTbiMTppXy6mtMh-7o1Rw3Hgupm32UJte6wRE74Ntof46exteLQEJ4C6gM1yP35L_w4mQwECm7gYKNfy38yKazawcavi3_QY2w8V8zl4bzuZzNZ9VPL9__zsAAP__RzzzDl0FAAA=; ClickDataNgFall=H4sIAAAAAAAA_7RU32_bNhD-V4wDAmyAIpMSpVgqjCI_kC1FkwxLu-5hLzR5cphQpEBSiu22__tASUmNba97MX33fTjex_tOX2FA55U1UANNSUoggbDvEGqSgO83n17_C2sGdAEl1A3XHhMQWonnGwk1lO2Hsri52FWtMZCA5AGhpmesys5YUawSELztuNqayGasoFUCyl_-dv5Wy9nAg7IjgZZFvkrA9RpjSBJwKJVDEW4xPFoJdZGAt70TI57nCWhupDLbmT5Hn52GGiAB2zToIpZlOc0T2DhuxONMHsGJ-hhC5-vlkncq3XNpHabCtsshW8r3vdPrET_Jz0-y65Ps-uXlJW24a7lXGFJj_-oJycqWu2cM69ewc_YJRbiR6weJrLTd779-uPpzxjQX2KKJ6D9eUFgfoCYpIUVUP6Dppyl0fG_78KPxy945NGIPNXx-uIIEeqeOlbgBud2PMsZxvQ9uUHI9zmDqAndByfXBsRVWjJSE5SWltCGbXAialUQKynK-KlZcFhJLzvNsw0S-WRXYSJE1ZS4rSktCKspY0dCyYrmoMsnYVD9KWY9KCCFTKnC3VXLd2F1wNpxi40-Hw3b71LYteZooXhy69YZLZXt_uukPB-4kJKC6cykdeg81VDStSMqylBbsGCqnofce3fkWTYAabu1Bac2XRUoWP31RRtoXv7j7tKAkJe8WX5Qp2bvFLv64oaY5S8nPi19QPNtlRighlNDFtXLY2N1yRCEOpUGHDmrQvVD8VB9UfOXofhyUwLe9sbHX-c7oRf_Hj32LhTbOvvix0HzFW4kLx42cxEyJWytRHyfueItTLKb74JJvNC6vHj7GF_Ed1HCh1W7xYHUf18uP3upNcNExd_ejkO3Uzd39t2_3XtvFZSTsI1OF_REA0X4OTbiMTppXy6mtMh-7o1Rw3Hgupm32UJte6wRE74Ntof46exteLQEJ4C6gM1yP35L_w4mQwECm7gYKNfy38yKazawcavi3_QY2w8V8zl4bzuZzNZ9VPL9__zsAAP__RzzzDl0FAAA=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sat, 07 Jun 2025 05:35:59 GMT
content-type: text/html; charset=utf-8
content-length: 780
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
expires: Thu, 01 Jan 1970 00:00:00 UTC
pragma: no-cache
X-Firefox-Spdy: h2

api.yadore.com/v2/d?url=https%3A%2F%2Fwww.farmasiet.no&market=no&projectId=Sde46opRHJDX&placementId=6mJ65IBx9mnn

88.99.112.2

302 Found

173 kB

URL User Request GET
api.yadore.com/v2/d?url=https%3A%2F%2Fwww.farmasiet.no&market=no&projectId=Sde46opRHJDX&placementId=6mJ65IBx9mnn
IP
88.99.112.2:443
ASN
#24940 Hetzner Online GmbH

Certificate
IssuerLet's Encrypt
Subjectyadore.com
Fingerprint12:0F:65:95:06:0F:A7:D7:31:79:00:DD:B4:E7:F2:42:47:B3:7F:42
ValidityWed, 09 Apr 2025 06:40:24 GMT - Tue, 08 Jul 2025 06:40:23 GMT

File type

Size
173 kB (173384 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /v2/d?url=https%3A%2F%2Fwww.farmasiet.no&market=no&projectId=Sde46opRHJDX&placementId=6mJ65IBx9mnn HTTP/1.1
Host: api.yadore.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, Accept, API-Key
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: *
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
date: Sat, 07 Jun 2025 05:35:59 GMT
location: https://no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
referrer-policy: no-referrer
server: nginx
x-powered-by: PHP/8.3.21
X-Firefox-Spdy: h2

no-go.kelkoogroup.net/favicon.ico

95.211.116.26

404 Not Found

1.1 kB

URL GET
no-go.kelkoogroup.net/favicon.ico
IP
95.211.116.26:443
ASN
#60781 LeaseWeb Netherlands B.V.

Requested by
https://no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
Certificate
IssuerDigiCert Inc
Subject*.kelkoogroup.net
FingerprintAB:7F:31:B1:66:46:76:99:39:20:8C:5B:A4:03:6B:DE:E6:6B:F4:17
ValidityThu, 26 Sep 2024 00:00:00 GMT - Fri, 10 Oct 2025 23:59:59 GMT

File type
HTML document, ASCII text
Size
1.1 kB (1144 bytes)
Hash
8560de521c4990c7c870121fc9643508
0cacf7a6b96cceeb6ceae74d5f14dc87406a6f39
73a434285c3a752bc8c44aebd50e10f1a766853cbc7184e78d5c934c7b52b620

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: no-go.kelkoogroup.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
DNT: 1
Connection: keep-alive
Cookie: datadome=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH; kelkooID=a4c6294-19748e3856e-1352ad
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Request-Time: PT0.000273283S
X-Robots-Tag: noindex,nofollow
Referrer-Policy: origin-when-cross-origin
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'
X-Permitted-Cross-Domain-Policies: master-only
Date: Sat, 07 Jun 2025 05:35:59 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 1144

static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css

54.240.174.108

200 OK

6.2 kB

URL GET
static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
ASCII text, with CRLF line terminators
Size
6.2 kB (6162 bytes)
Hash
1f113f0b6d6855568c684e354bb853d1
2a2fbd27d5408fa3e53c74f04b7790ab1aea9b2c
d49fce4d3745c6d9f755f6be625eb218238baec337cfdb30be0e87d8c0ff6653

HTTP Headers

GET /captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
last-modified: Thu, 11 Apr 2024 08:21:58 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-amz-version-id: null
server: AmazonS3
date: Sat, 07 Jun 2025 05:23:36 GMT
etag: W/"1f113f0b6d6855568c684e354bb853d1"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5mW_B6kcgKKZ81ofMKhtZelvUvIdnX1_Jt-TNVDYr8CVtUv0qcRA2g==
age: 748
X-Firefox-Spdy: h2

metro-electric.co/

216.245.197.42

200 OK

479 B

URL User Request GET
metro-electric.co/
IP
216.245.197.42:443
ASN
#46475 LIMESTONENETWORKS

Certificate
IssuerLet's Encrypt
Subjectmetro-electric.co
Fingerprint55:95:60:53:CA:0B:F7:E2:9B:22:8D:C9:83:9F:6A:84:54:87:8D:BE
ValidityWed, 14 May 2025 21:34:06 GMT - Tue, 12 Aug 2025 21:34:05 GMT

File type
HTML document, ASCII text, with very long lines (479), with no line terminators
Size
479 B (479 bytes)
Hash
f44fd00716601c5370494c9458deb6ab
ce0eb6fe0f89982bcb7ed60a02f20496c908b138
67bab0468e85fcfc28785a8cd051b757d9130efc0b2c4f6110e245d1eae4f771

HTTP Headers

GET / HTTP/1.1
Host: metro-electric.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
content-length: 479
content-type: text/html; charset=utf-8
date: Sat, 07 Jun 2025 05:35:55 GMT
server: Cowboy
set-cookie: sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35; path=/; domain=.metro-electric.co; expires=Thu, 25 Jun 2093 08:50:02 GMT; max-age=2147483647; secure; HttpOnly
X-Firefox-Spdy: h2

lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381

0.0.0.0

0 B

URL User Request GET
lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381 HTTP/1.1
Host: lucia-lzi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

lucia-lzi.com/zclkredirect?visitid=48e94060-4361-11f0-b3cc-1260dc143a85&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=Mesa%3B%20llvmpipe&timezone=UTC%2B00%3A00&timezoneName=UTC

0.0.0.0

0 B

URL User Request GET
lucia-lzi.com/zclkredirect?visitid=48e94060-4361-11f0-b3cc-1260dc143a85&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=Mesa%3B%20llvmpipe&timezone=UTC%2B00%3A00&timezoneName=UTC
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /zclkredirect?visitid=48e94060-4361-11f0-b3cc-1260dc143a85&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=Mesa%3B%20llvmpipe&timezone=UTC%2B00%3A00&timezoneName=UTC HTTP/1.1
Host: lucia-lzi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

54.84.89.155

302

0 B

URL User Request GET
lucia-lzi.com/zclkredirect?visitid=48e94060-4361-11f0-b3cc-1260dc143a85&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=Mesa%3B%20llvmpipe&timezone=UTC%2B00%3A00&timezoneName=UTC
IP
54.84.89.155:80
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /zclkredirect?visitid=48e94060-4361-11f0-b3cc-1260dc143a85&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=Mesa%3B%20llvmpipe&timezone=UTC%2B00%3A00&timezoneName=UTC HTTP/1.1
Host: lucia-lzi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 
Date: Sat, 07 Jun 2025 05:35:58 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type
Location: https://geotrkclknow.com/rot/CoXC1ug9UP3UrzbI?extid=zr48e94060436111f0b3cc1260dc143a858ad5de6aa32b4c3b85efdc2f63d91160091445f16943c92d44&cost=0.005000&targid=foxtrot-efs-vzggjmmm0j&sczp=badious-buzzard

no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com

95.211.116.26

200 OK

173 kB

URL User Request GET
no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
IP
95.211.116.26:443
ASN
#60781 LeaseWeb Netherlands B.V.

Certificate
IssuerDigiCert Inc
Subject*.kelkoogroup.net
FingerprintAB:7F:31:B1:66:46:76:99:39:20:8C:5B:A4:03:6B:DE:E6:6B:F4:17
ValidityThu, 26 Sep 2024 00:00:00 GMT - Fri, 10 Oct 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (30650)
Size
173 kB (173384 bytes)
Hash
4e582794464afc30b519fba15500fd2c
0c31639757159ea0881501c505b3abceb1e51979
dfaef9dc8488de84bbbeecaef5c6981d6a3ad3682bc20b97004b5301bf3b8ff2

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Code and strings of plugins from the Tetris framework loaded by Swid

HTTP Headers

GET /permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com HTTP/1.1
Host: no-go.kelkoogroup.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
leadId: 62AE01JX4E71BV0VSH8R8J8RD6ABGA
Pragma: no-cache
X-DD-B: 3
Charset: utf-8
clickId: 107698148_1749274559854_12352683
country: no
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=y1EKkzfNVBxgeB_okAZnWtpsrG8jfaLfNhZY8Xvf2qJlykUtd4kjbqf_GKuVfs9nHmlj_1C0Jid3fq7GrlySBofK6_dCWuyuDq~bIuv8U2Uf0TWY0ry_o0561_jA0_TO; Max-Age=31104000; Expires=Tue, 02 Jun 2026 05:35:59 GMT; SameSite=Lax; Path=/; Domain=.kelkoogroup.net; Secure
kelkooID=a4c6294-19748e3856e-1352ad; Max-Age=31536000; Expires=Sun, 07 Jun 2026 05:35:59 GMT; SameSite=None; Path=/; Domain=kelkoogroup.net; Secure; HTTPOnly
X-DataDome: protected
Request-Time: PT0.018134478S
X-Robots-Tag: noindex,nofollow
Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate
X-DataDome-CID: AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==
Referrer-Policy: origin-when-cross-origin
X-Frame-Options: ALLOWALL
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Date: Sat, 07 Jun 2025 05:35:59 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 173384

static.captcha-delivery.com/captcha/assets/tpl/device-check/index.css

54.240.174.108

200 OK

3.7 kB

URL GET
static.captcha-delivery.com/captcha/assets/tpl/device-check/index.css
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
ASCII text
Size
3.7 kB (3683 bytes)
Hash
d24f433ae1916185b0e4e20ed76cb64b
e0c8d4c58b7d0983f9b4042bea94c014cd5ec668
f40a7b02a8a2d420aa9d4cb5b0b26a92468828984fdc4b0d1202de4e24f59859

HTTP Headers

GET /captcha/assets/tpl/device-check/index.css HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
last-modified: Thu, 08 Feb 2024 08:41:29 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-amz-version-id: null
server: AmazonS3
date: Sat, 07 Jun 2025 02:45:49 GMT
etag: W/"d24f433ae1916185b0e4e20ed76cb64b"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: V77-uTAlU9vGGRSNT4a0VXcN4UMREf0Ge2ODehVmFVjyPWVEzCvMoA==
age: 14744
X-Firefox-Spdy: h2

lucia-lzi.com/favicon.ico

54.84.89.155

404

82 B

URL GET
lucia-lzi.com/favicon.ico
IP
54.84.89.155:80
ASN
#14618 AMAZON-AES

Requested by
http://lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381

File type
JSON text data
Size
82 B (82 bytes)
Hash
269c2af7e6878a0751f4c4fb6704a5da
60c14f84340db53871ca63651642ddc040518e8d
4960545cecf7257cd45b6f1fe1a833d5e23712f08532c52b1bbff25f84d37207

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lucia-lzi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 
Date: Sat, 07 Jun 2025 05:35:57 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive

no-go.kelkoogroup.net/assets/images/p.png?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2

95.211.116.26

200 OK

68 B

URL GET
no-go.kelkoogroup.net/assets/images/p.png?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2
IP
95.211.116.26:443
ASN
#60781 LeaseWeb Netherlands B.V.

Requested by
https://no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
Certificate
IssuerDigiCert Inc
Subject*.kelkoogroup.net
FingerprintAB:7F:31:B1:66:46:76:99:39:20:8C:5B:A4:03:6B:DE:E6:6B:F4:17
ValidityThu, 26 Sep 2024 00:00:00 GMT - Fri, 10 Oct 2025 23:59:59 GMT

File type
PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
Size
68 B (68 bytes)
Hash
91e42db1c66c0b276abf6234dc50b2eb
c1986af3c26609b8b7d8933f99c51c1a89e9ea6b
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

HTTP Headers

GET /assets/images/p.png?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2 HTTP/1.1
Host: no-go.kelkoogroup.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
DNT: 1
Connection: keep-alive
Cookie: datadome=y1EKkzfNVBxgeB_okAZnWtpsrG8jfaLfNhZY8Xvf2qJlykUtd4kjbqf_GKuVfs9nHmlj_1C0Jid3fq7GrlySBofK6_dCWuyuDq~bIuv8U2Uf0TWY0ry_o0561_jA0_TO; kelkooID=a4c6294-19748e3856e-1352ad
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
leadId: 62AE01JX4E71BV0VSH8R8J8RD6ABGA
clickId: 107698148_1749274559854_12352683
country: no
Request-Time: PT0.001738753S
X-Robots-Tag: noindex,nofollow
Cache-Control: private, must-revalidate
Referrer-Policy: origin-when-cross-origin
X-Frame-Options: ALLOWALL
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Date: Sat, 07 Jun 2025 05:35:59 GMT
Content-Type: image/png
Content-Length: 68

ct.captcha-delivery.com/i.js

54.240.174.110

200 OK

13 kB

URL GET
ct.captcha-delivery.com/i.js
IP
54.240.174.110:443
ASN
#16509 AMAZON-02

Requested by
https://no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
13 kB (12996 bytes)
Hash
c289d6c8b0e743fd024d52618d546f20
cd29405db7518c6943bacc943ac35c3d314ac722
8d973ba5eafa4328ff1feaefd70cccd0472b8af0c006285ba63eed00977935cc

HTTP Headers

GET /i.js HTTP/1.1
Host: ct.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://no-go.kelkoogroup.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript
content-length: 12996
last-modified: Mon, 17 Feb 2025 09:53:49 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Fri, 06 Jun 2025 12:46:16 GMT
etag: "c289d6c8b0e743fd024d52618d546f20"
x-cache: Hit from cloudfront
via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: hnf6nMMNNY_ZnZVz6ibWUakkQJAZkYNgAsbE0lYHN9h5ea_hOrapeg==
age: 60585
X-Firefox-Spdy: h2

lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381

54.84.89.155

200

3.1 kB

URL User Request GET
lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
IP
54.84.89.155:80
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text, with very long lines (408)
Size
3.1 kB (3086 bytes)
Hash
476f94e3d287f4f4584f3624804bec4f
972e162b8ec78f3d4403dbeb62f17320dab58af5
4fe3bd2099063bfcd879fc1df3c0f6feae3b7a7df52cecedba82ec3faea61770

HTTP Headers

GET /zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381 HTTP/1.1
Host: lucia-lzi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Date: Sat, 07 Jun 2025 05:35:57 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 3086
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type

geo.captcha-delivery.com/interstitial/

13.50.6.43

200 OK

1.8 kB

URL POST
geo.captcha-delivery.com/interstitial/
IP
13.50.6.43:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
FingerprintF2:9E:7E:72:25:57:E3:AF:B6:87:61:A0:0D:B1:85:B4:85:82:E6:96
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
JSON text data
Size
1.8 kB (1797 bytes)
Hash
36ecfbb4b23c5eb95a1e92dca132a009
d57add48649581e0ef8d79ac1ba3d10162a28450
529babca2058a7fada14d28ca220dc4e510cf1e4f812a88017d92a947247cca7

HTTP Headers

POST /interstitial/ HTTP/1.1
Host: geo.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 7731
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 07 Jun 2025 05:36:03 GMT
Content-Type: application/json;charset=utf-8
Content-Length: 1797
Connection: keep-alive

geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir

13.50.6.43

200 OK

649 kB

URL GET
geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
IP
13.50.6.43:443
ASN
#16509 AMAZON-02

Requested by
https://no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
FingerprintF2:9E:7E:72:25:57:E3:AF:B6:87:61:A0:0D:B1:85:B4:85:82:E6:96
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (40940)
Size
649 kB (648603 bytes)
Hash
5de92b00ef376e08b1be76e69e030f4f
509cd8c4b8d7d3d3d1006b4741519479c66f603f
a2293b08ddd303a96706ddfff9666964e04505236edc92933c90f87f5166d213

HTTP Headers

GET /captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir HTTP/1.1
Host: geo.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 07 Jun 2025 05:36:03 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Encoding: gzip

no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false

95.211.116.26

403 Forbidden

744 B

URL User Request GET
no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
IP
95.211.116.26:443
ASN
#60781 LeaseWeb Netherlands B.V.

Certificate
IssuerDigiCert Inc
Subject*.kelkoogroup.net
FingerprintAB:7F:31:B1:66:46:76:99:39:20:8C:5B:A4:03:6B:DE:E6:6B:F4:17
ValidityThu, 26 Sep 2024 00:00:00 GMT - Fri, 10 Oct 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (744), with no line terminators
Size
744 B (744 bytes)
Hash
0df10b6d42e06051757e97689fca0536
8c7d059feebc2a6091767008ebee19bf2715f56b
99ff56baa0580c3090fd6f5b0ad7d3e6c1128951c80527af5de9ecce2b9322c3

HTTP Headers

GET /redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false HTTP/1.1
Host: no-go.kelkoogroup.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://no-go.kelkoogroup.net/permanentLinkGo?country=no&id=e4ef5dec-03eb-11eb-bf21-ba5ec25d7100&merchantUrl=https%3A%2F%2Fwww.farmasiet.no&custom1=66d7fa83baf54de9bf340b034475067051074b86a4c5e5a6c2c896c1fd0c87a0&publisherSubId=Sde46opRHJDX&publisherTrafficType=publishernetwork&originReferer=https%253A%252F%252Fwww.yadore.com
DNT: 1
Connection: keep-alive
Cookie: datadome=y1EKkzfNVBxgeB_okAZnWtpsrG8jfaLfNhZY8Xvf2qJlykUtd4kjbqf_GKuVfs9nHmlj_1C0Jid3fq7GrlySBofK6_dCWuyuDq~bIuv8U2Uf0TWY0ry_o0561_jA0_TO; kelkooID=a4c6294-19748e3856e-1352ad
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Pragma: no-cache
X-DD-B: 3
Charset: utf-8
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH; Max-Age=31104000; Expires=Tue, 02 Jun 2026 05:36:00 GMT; SameSite=Lax; Path=/; Domain=.kelkoogroup.net; Secure
X-DataDome: protected
Request-Time: PT0.020541085S
Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate
X-DataDome-CID: AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==
Referrer-Policy: origin-when-cross-origin
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Date: Sat, 07 Jun 2025 05:35:59 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 744

static.captcha-delivery.com/common/fonts/roboto/roboto.woff2

54.240.174.108

200 OK

16 kB

URL GET
static.captcha-delivery.com/common/fonts/roboto/roboto.woff2
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15688, version 1.0
Size
16 kB (15688 bytes)
Hash
aa23b7b4bcf2b8f0e876106bb3de69c6
106ac454ba4e503e0a1cd15e1275130918049182
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

HTTP Headers

GET /common/fonts/roboto/roboto.woff2 HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://static.captcha-delivery.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff2
content-length: 15688
access-control-allow-origin: https://geo.captcha-delivery.com
access-control-allow-methods: GET, HEAD
access-control-max-age: 3000
access-control-allow-credentials: true
last-modified: Fri, 06 May 2022 16:47:07 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Jun 2025 04:53:35 GMT
etag: "aa23b7b4bcf2b8f0e876106bb3de69c6"
vary: Origin
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: OYb9eQHGb0WX3p7ZOGMEgyjhtbdH5up-XLomshL_tZ5LcUPZMzvMfg==
age: 2724
X-Firefox-Spdy: h2

metro-electric.co/favicon.ico

216.245.197.42

404 Not Found

9 B

URL GET
metro-electric.co/favicon.ico
IP
216.245.197.42:443
ASN
#46475 LIMESTONENETWORKS

Requested by
https://metro-electric.co/
Certificate
IssuerLet's Encrypt
Subjectmetro-electric.co
Fingerprint55:95:60:53:CA:0B:F7:E2:9B:22:8D:C9:83:9F:6A:84:54:87:8D:BE
ValidityWed, 14 May 2025 21:34:06 GMT - Tue, 12 Aug 2025 21:34:05 GMT

File type
ASCII text, with no line terminators
Size
9 B (9 bytes)
Hash
d8f4a1993546cc4b850cde3599e27aec
094b763b4cfcc0b05e5d040581cd513c3ca08067
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: metro-electric.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metro-electric.co/
Cookie: sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
cache-control: max-age=0, private, must-revalidate
content-length: 9
date: Sat, 07 Jun 2025 05:35:56 GMT
server: Cowboy
X-Firefox-Spdy: h2

static.captcha-delivery.com/common/fonts/roboto/font-face.css

54.240.174.108

200 OK

519 B

URL GET
static.captcha-delivery.com/common/fonts/roboto/font-face.css
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
ASCII text
Size
519 B (519 bytes)
Hash
e4f77074c0ffbfab377011e19283eb13
9160259165ca1ef84209d4dd675c3ed367babff1
66599c34190f7a6a402b38664a30a9b564fc22510f51fa3c5f027fb91e7a0e51

HTTP Headers

GET /common/fonts/roboto/font-face.css HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
content-length: 519
last-modified: Fri, 19 Jul 2024 12:42:09 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Jun 2025 02:45:22 GMT
etag: "e4f77074c0ffbfab377011e19283eb13"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: mZ_v1mIX0r2f4XYdD9m_PYZTP-B0LKR-2bef1uN_CCTusiwYFJ4ReA==
age: 10541
X-Firefox-Spdy: h2

static.captcha-delivery.com/common/fonts/roboto/roboto.woff2

54.240.174.108

200 OK

16 kB

URL GET
static.captcha-delivery.com/common/fonts/roboto/roboto.woff2
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15688, version 1.0
Size
16 kB (15688 bytes)
Hash
aa23b7b4bcf2b8f0e876106bb3de69c6
106ac454ba4e503e0a1cd15e1275130918049182
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

HTTP Headers

GET /common/fonts/roboto/roboto.woff2 HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://static.captcha-delivery.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff2
content-length: 15688
access-control-allow-origin: https://geo.captcha-delivery.com
access-control-allow-methods: GET, HEAD
access-control-max-age: 3000
access-control-allow-credentials: true
last-modified: Fri, 06 May 2022 16:47:07 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Jun 2025 04:53:35 GMT
etag: "aa23b7b4bcf2b8f0e876106bb3de69c6"
vary: Origin
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: rBlbw4fpSAooCl0smHsHFdklDHLLzhFGgLyJmzFxmkjaFgVUm7v6qg==
age: 2715
X-Firefox-Spdy: h2

static.captcha-delivery.com/common/fonts/roboto/roboto.woff2

54.240.174.108

200 OK

16 kB

URL GET
static.captcha-delivery.com/common/fonts/roboto/roboto.woff2
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15688, version 1.0
Size
16 kB (15688 bytes)
Hash
aa23b7b4bcf2b8f0e876106bb3de69c6
106ac454ba4e503e0a1cd15e1275130918049182
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

HTTP Headers

GET /common/fonts/roboto/roboto.woff2 HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://static.captcha-delivery.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: font/woff2
content-length: 15688
access-control-allow-origin: https://geo.captcha-delivery.com
access-control-allow-methods: GET, HEAD
access-control-max-age: 3000
access-control-allow-credentials: true
last-modified: Fri, 06 May 2022 16:47:07 GMT
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Jun 2025 04:53:35 GMT
etag: "aa23b7b4bcf2b8f0e876106bb3de69c6"
vary: Origin
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: c0qSxgIrTpXxSkRE20OSYZ8NUFJ64bsjDwncIS89XNP25rUFA0i7og==
age: 2718
X-Firefox-Spdy: h2

geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd

13.50.6.43

200 OK

555 kB

URL GET
geo.captcha-delivery.com/interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd
IP
13.50.6.43:443
ASN
#16509 AMAZON-02

Requested by
https://no-go.kelkoogroup.net/redirect?country=no&k=612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2&url=https%3A%2F%2Fpdt.tradedoubler.com%2Fclick%3Fa%3D332280%26p%3D302669%26epi%3D62AE01JX4E71BV0VSH8R8J8RD6ABGA%26url%3Dhttps%253A%252F%252Fwww.farmasiet.no&dc=false
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
FingerprintF2:9E:7E:72:25:57:E3:AF:B6:87:61:A0:0D:B1:85:B4:85:82:E6:96
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (61855)
Size
555 kB (555367 bytes)
Hash
d681eec426fe2b67069335199cc3b920
02268b149fba5f9935aea1e9165de18da20b5ad8
4f4f7f0d586c12648e5ca679b9dd643b0344c1426c82b6c549b769282ab71917

HTTP Headers

GET /interstitial/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg%3D%3D&hash=5954443B90DC91C1E924DE9BFBEAA5&cid=hE~EqvxUwJgsEvQlq_MQ3f~iw6PThEjmy1AYSrPWlhe6oAlYKsNm5FotOuFAAl6a3lLTQijzhJqsDMNPvP4so6FDxUQOKDUlTcsgcZaXlwh6dT6mrylmHW35Ug7WlGMH&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&s=35103&b=32286&dm=cd HTTP/1.1
Host: geo.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://no-go.kelkoogroup.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 07 Jun 2025 05:36:00 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

dd.prod.captcha-delivery.com/image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.jpg

54.240.174.72

200 OK

8.9 kB

URL GET
dd.prod.captcha-delivery.com/image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.jpg
IP
54.240.174.72:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subjectdd.prod.captcha-delivery.com
Fingerprint78:DE:FA:F7:3D:63:84:2A:F7:68:BE:5E:19:5C:02:C6:7A:A4:A2:DA
ValidityMon, 27 Jan 2025 00:00:00 GMT - Wed, 25 Feb 2026 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 280x155, components 3
Size
8.9 kB (8903 bytes)
Hash
30a73a61be758fc43ff3edab76c62e69
af8c95c565ea7324d7b74b3fc2c3c3c611559df7
0632998029e99b838e29e3856430bf9f2256768e61c4ae0c89441235142acec3

HTTP Headers

GET /image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.jpg HTTP/1.1
Host: dd.prod.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 8903
date: Sat, 07 Jun 2025 00:02:22 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3600
last-modified: Tue, 03 Jun 2025 05:08:35 GMT
x-amz-expiration: expiry-date="Wed, 11 Jun 2025 00:00:00 GMT", rule-id="auto-clean old captchas image (7 days)"
etag: "30a73a61be758fc43ff3edab76c62e69"
x-amz-server-side-encryption: AES256
x-amz-version-id: AVS9MtvcVKnfuX4G3BlEqDoJcqI48n_u
accept-ranges: bytes
server: AmazonS3
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-cache: Hit from cloudfront
via: 1.1 4c07121ca6e32bcda85cc9091b92050e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 50GLOuSHgtvbOhaNeBcFcCUgob0fUaD2A6_kWNr_3qSCeh_T6XDvUQ==
age: 20022
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

dd.prod.captcha-delivery.com/image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.frag.png

54.240.174.72

200 OK

5.1 kB

URL GET
dd.prod.captcha-delivery.com/image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.frag.png
IP
54.240.174.72:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subjectdd.prod.captcha-delivery.com
Fingerprint78:DE:FA:F7:3D:63:84:2A:F7:68:BE:5E:19:5C:02:C6:7A:A4:A2:DA
ValidityMon, 27 Jan 2025 00:00:00 GMT - Wed, 25 Feb 2026 23:59:59 GMT

File type
PNG image data, 63 x 155, 8-bit/color RGBA, non-interlaced
Size
5.1 kB (5063 bytes)
Hash
b0c91c4b04f28d185742a5ce94d5f0d4
f65a9ad3dc6d7f22cc294ce41144c50d2b870146
4a93e0bc343be6aab5ff4a2fa63da32b16a9489e2b408cce078d298b9aaaa819

HTTP Headers

GET /image/2025-06-07/2fcfebbb72609da5a9d75cb5977ad36c.frag.png HTTP/1.1
Host: dd.prod.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://geo.captcha-delivery.com
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5063
date: Sat, 07 Jun 2025 00:02:22 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3600
last-modified: Tue, 03 Jun 2025 05:08:35 GMT
x-amz-expiration: expiry-date="Wed, 11 Jun 2025 00:00:00 GMT", rule-id="auto-clean old captchas image (7 days)"
etag: "b0c91c4b04f28d185742a5ce94d5f0d4"
x-amz-server-side-encryption: AES256
x-amz-version-id: aTfEbiYRY3eO9xfJQXEyxlM7xPG192OZ
accept-ranges: bytes
server: AmazonS3
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-cache: Hit from cloudfront
via: 1.1 4c07121ca6e32bcda85cc9091b92050e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: itG2PT4unuaj7MjB7impSyua2WFLQRNIkIQ7pcLvZWOCAJ4zbYBGEw==
age: 20022
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

metro-electric.co/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0OTI4MTc1NSwiaWF0IjoxNzQ5Mjc0NTU1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTNhbnM2NWdtcXA3bXV0dmMyM2E0MHIiLCJuYmYiOjE3NDkyNzQ1NTUsInRzIjoxNzQ5Mjc0NTU1ODc0MzQ3fQ.q6zywi_W6p2zGcL63DfaM8qH6G8MWPlOLZLtsC_V7c8&sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35

216.245.197.42

302 Found

0 B

URL User Request GET
metro-electric.co/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0OTI4MTc1NSwiaWF0IjoxNzQ5Mjc0NTU1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTNhbnM2NWdtcXA3bXV0dmMyM2E0MHIiLCJuYmYiOjE3NDkyNzQ1NTUsInRzIjoxNzQ5Mjc0NTU1ODc0MzQ3fQ.q6zywi_W6p2zGcL63DfaM8qH6G8MWPlOLZLtsC_V7c8&sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35
IP
216.245.197.42:443
ASN
#46475 LIMESTONENETWORKS

Certificate
IssuerLet's Encrypt
Subjectmetro-electric.co
Fingerprint55:95:60:53:CA:0B:F7:E2:9B:22:8D:C9:83:9F:6A:84:54:87:8D:BE
ValidityWed, 14 May 2025 21:34:06 GMT - Tue, 12 Aug 2025 21:34:05 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0OTI4MTc1NSwiaWF0IjoxNzQ5Mjc0NTU1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTNhbnM2NWdtcXA3bXV0dmMyM2E0MHIiLCJuYmYiOjE3NDkyNzQ1NTUsInRzIjoxNzQ5Mjc0NTU1ODc0MzQ3fQ.q6zywi_W6p2zGcL63DfaM8qH6G8MWPlOLZLtsC_V7c8&sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35 HTTP/1.1
Host: metro-electric.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://metro-electric.co/
Cookie: sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
cache-control: max-age=0, private, must-revalidate
content-length: 11
date: Sat, 07 Jun 2025 05:35:56 GMT
location: http://lucia-lzi.com/zclkvisitor/48e94060-4361-11f0-b3cc-1260dc143a85/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=1f221ad0-16c2-11ef-994a-12832fc4c381
server: Cowboy
set-cookie: sid=48adf1ae-4361-11f0-b8bf-3d20d56bfb35; path=/; domain=.metro-electric.co; expires=Thu, 25 Jun 2093 08:50:03 GMT; max-age=2147483647; secure; HttpOnly
X-Firefox-Spdy: h2

static.captcha-delivery.com/common/fonts/roboto/font-face.css

54.240.174.108

200 OK

519 B

URL GET
static.captcha-delivery.com/common/fonts/roboto/font-face.css
IP
54.240.174.108:443
ASN
#16509 AMAZON-02

Requested by
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAP_drIrwMVbYAW1oqmg==&cid=hE~EqvxUwJgsEvQlq_MQ3jo8fGX6LVTeF5utJCNHEGKHvCufkK7cI2wS0Ha11aPN6sBEbzXLF8v0p7AkhN4iRjglieACMHj8K22C2Wh1PpwzZ94Ve9bZaIGQH8uHKZh_&referer=https%3A%2F%2Fno-go.kelkoogroup.net%2Fredirect%3Fcountry%3Dno%26k%3D612f7a9541cd6ea61eb554c0e4cff43751c4e6ff4b34703f59267ef246260421ffe940a20aebd8854c374c9166d3f94caa8844910c81593b5cf37a8b6c51689154f9f9be5469b66c3942661dfe69af22338ddffa8d969aa8d1c9fd51504567f88485c757ef5da6e8911b0dc6897b3aefc0772d6a4fe690ae7051ae5dc5fa7c7921ff15b3fe37661c720b888ce6299ff9ca6d57a78c187abd05da45050e359295b56453e50af93c43a41969623d5839ee342dde8c2c09254b361698ad5f2db702596887410e011cacdaad5c692bfb1d068b6b61065401631031cd507599bfa884e6b816a4857ea1c9d59843c9d6884566a194b9af512cf82659f5fede2e2e6c7f9226a97dd0f9911107a19d0b5a7cdfa6c153a62228ea98d53221c1be89e8209379febf100ea48e7c363b230bc1d6cef096d33f1c05c6bbe4eae79330c4479104b673bdaf048355b4f4848412bc415cb47fc3c9c882f0dd828dd6b9d64cc6bf70ab2a2afd361f2b8594549eea0f3a66485c952e30b746c94d5b4a992d50160e5e5337980238d8411c78491d555a48560e1e69fb7cb97e88d6b5d2951a61cac1b0ba06b578aecadb74fbb16cb0d86343ff72c42ce888e8ce77d78772f654a3c3f2%26url%3Dhttps%253A%252F%252Fpdt.tradedoubler.com%252Fclick%253Fa%253D332280%2526p%253D302669%2526epi%253D62AE01JX4E71BV0VSH8R8J8RD6ABGA%2526url%253Dhttps%25253A%25252F%25252Fwww.farmasiet.no%26dc%3Dfalse&hash=5954443B90DC91C1E924DE9BFBEAA5&t=fe&s=35103&e=0ac80733626047dca5c360aa621d9ab93bd34b791980b2fddff1862344db5d31&ir=36%2C20%2C676&dm=dc_ir
Certificate
IssuerAmazon
Subject*.captcha-delivery.com
Fingerprint08:34:DB:37:CB:02:09:ED:82:0C:B3:27:9F:BA:AF:45:DA:77:DD:3D
ValidityThu, 13 Feb 2025 00:00:00 GMT - Sat, 14 Mar 2026 23:59:59 GMT

File type
ASCII text
Size
519 B (519 bytes)
Hash
e4f77074c0ffbfab377011e19283eb13
9160259165ca1ef84209d4dd675c3ed367babff1
66599c34190f7a6a402b38664a30a9b564fc22510f51fa3c5f027fb91e7a0e51

HTTP Headers

GET /common/fonts/roboto/font-face.css HTTP/1.1
Host: static.captcha-delivery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://geo.captcha-delivery.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
content-length: 519
last-modified: Fri, 19 Jul 2024 12:42:09 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Jun 2025 02:45:22 GMT
etag: "e4f77074c0ffbfab377011e19283eb13"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 8iA57-LVtNhrqODKKxkHIG2NaV4QDYNLJL8E2Q4lzJ3LnVubRYv8Rw==
age: 10544
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (27)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP