Overview

URLtimehunter.co/dum/ubdqqsumiaeau
IP 162.241.61.69 (United States)
ASN#46606 UNIFIEDLAYER-AS-1
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-25 23:05:33 UTC
StatusLoading report..
IDS alerts0
Blocklist alert16
urlquery alerts No alerts detected
Tags None

Domain Summary (29)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
sc.lfeeder.com (1) 17815 2020-09-08T08:51:01Z 2023-03-29T11:42:43Z 380 16931 143.204.55.127
vc.hotjar.io (1) 2334 2019-04-16T12:33:25Z 2023-03-29T09:20:58Z 418 368 54.230.111.8
widget.intercom.io (1) 2417 2020-07-20T14:16:46Z 2023-03-29T14:38:39Z 367 3973 54.230.111.86
script.hotjar.com (1) 887 2020-11-05T17:23:46Z 2023-03-29T08:27:03Z 382 69778 54.230.111.79
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-29T05:09:31Z 333 391 34.117.237.239
fonts.googleapis.com (2) 8877 2013-06-10T22:14:26Z 2023-03-29T10:13:53Z 846 2342 142.250.74.74
www.google-analytics.com (1) 40 2012-10-03T03:04:21Z 2023-03-29T06:01:47Z 370 20615 216.58.207.206
www.google.com (1) 7 2015-05-10T13:11:19Z 2023-03-29T05:55:56Z 420 1083 142.250.74.164
tr.lfeeder.com (1) 16332 2020-11-03T17:29:50Z 2023-03-29T12:51:31Z 1140 396 54.230.111.96
static.hotjar.com (1) 641 2014-11-01T06:14:27Z 2023-03-29T05:25:56Z 375 624 54.230.111.8
r3.o.lencr.org (7) 344 2020-12-02T09:52:13Z 2023-03-29T05:09:11Z 2366 6205 23.36.77.32
timehunter.co (33) 0 2016-11-26T22:58:32Z 2023-03-21T23:45:40Z 14850 531941 162.241.61.69
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-29T05:09:32Z 606 127 52.39.172.78
fonts.gstatic.com (5) 0 2014-09-09T02:40:21Z 2023-03-29T11:19:48Z 2452 107673 142.250.74.35
stats.g.doubleclick.net (1) 96 2013-06-10T22:21:11Z 2023-03-29T09:08:31Z 600 589 173.194.221.154
www.googletagmanager.com (2) 75 2013-05-22T04:07:37Z 2023-03-29T05:44:04Z 776 47302 142.250.74.168
in.hotjar.com (1) 1746 2018-10-22T19:15:59Z 2023-03-29T05:25:59Z 480 287 54.72.116.255
js.intercomcdn.com (2) 2440 2020-02-19T12:43:00Z 2023-03-29T11:44:26Z 739 320927 54.230.111.118
api-iam.intercom.io (1) 2892 2018-08-02T22:07:54Z 2023-03-29T11:44:27Z 469 3051 18.234.2.45
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-29T05:09:31Z 413 5881 34.160.144.191
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-29T05:09:12Z 3246 53402 34.120.237.76
ocsp.e2m02.amazontrust.com (1) 0 2022-12-07T11:11:00Z 2023-03-29T09:11:46Z 350 755 54.230.80.227
www.gstatic.com (3) 0 2016-07-26T11:37:06Z 2023-03-29T09:13:03Z 1360 195363 142.250.74.35
ocsp.r2m01.amazontrust.com (1) 0 2022-10-12T22:43:53Z 2023-03-29T09:11:41Z 350 946 54.230.80.227
nexus-websocket-a.intercom.io (1) 2137 2015-06-26T12:17:57Z 2023-03-29T12:41:51Z 731 281 35.174.127.31
leadbooster-chat.pipedrive.com (1) 103561 2019-04-24T15:27:31Z 2023-03-28T14:04:14Z 380 1489 104.18.188.228
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-29T05:09:03Z 782 2374 35.241.9.150
ocsp.pki.goog (12) 175 2018-07-01T08:43:07Z 2023-03-29T05:09:04Z 4116 8393 216.58.211.3
ocsp.r2m02.amazontrust.com (1) 0 2022-10-12T16:01:39Z 2023-03-29T09:11:13Z 350 1006 54.230.80.227

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-03-25 medium timehunter.co/dum/ubdqqsumiaeau Malware
2023-03-25 medium timehunter.co/dum/ubdqqsumiaeau Malware
2023-03-25 medium timehunter.co/wp-includes/css/classic-themes.min.css?ver=1 Malware
2023-03-25 medium timehunter.co/wp-content/themes/sydney/css/bootstrap/bootstrap.min.css?ver=1 Malware
2023-03-25 medium timehunter.co/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 Malware
2023-03-25 medium timehunter.co/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ve (...) Malware
2023-03-25 medium timehunter.co/wp-content/uploads/so-css/so-css-sydney.css?ver=1672499783 Malware
2023-03-25 medium timehunter.co/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 Malware
2023-03-25 medium timehunter.co/wp-content/themes/sydney/js/skip-link-focus-fix.js?ver=20130115 Malware
2023-03-25 medium timehunter.co/wp-content/plugins/wpcf7-redirect/build/js/wpcf7r-fe.js?ver=1.1 Malware
2023-03-25 medium timehunter.co/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 Malware
2023-03-25 medium timehunter.co/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 Malware
2023-03-25 medium timehunter.co/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ve (...) Malware
2023-03-25 medium timehunter.co/wp-content/themes/sydney/fonts/fontawesome-webfont.woff2?v=4.7.0 Malware
2023-03-25 medium timehunter.co/wp-content/themes/sydney/js/scripts.js?ver=6.1.1 Malware
2023-03-25 medium timehunter.co/wp-content/themes/sydney/style.css?ver=20180710 Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 162.241.61.69
Date UQ / IDS / BL URL IP
2023-03-25 23:05:33 UTC 0 - 0 - 16 timehunter.co/dum/ubdqqsumiaeau 162.241.61.69
2023-02-07 20:49:45 UTC 0 - 0 - 1 www.nomydonuts.com 162.241.61.69
2023-02-06 12:40:52 UTC 0 - 3 - 1 nomydonuts.com/OV6/admin/login.php?invalid 162.241.61.69
2023-02-06 06:13:00 UTC 0 - 3 - 2 nomydonuts.com/OV6/admin/ 162.241.61.69
2022-11-26 04:55:14 UTC 0 - 0 - 4 energyfit-la.cl/ 162.241.61.69


Last 5 reports on ASN: UNIFIEDLAYER-AS-1
Date UQ / IDS / BL URL IP
2023-06-09 22:14:37 UTC 4 - 0 - 0 friendflorida.org/tyyy/zn202/2920/sf_rand_str (...) 192.185.93.105
2023-06-09 22:12:34 UTC 8 - 0 - 0 intlpsb.org/new/auth/sf_rand_string_lowercase (...) 69.49.245.172
2023-06-09 22:00:28 UTC 4 - 0 - 0 friendflorida.org/tyyy/zn202/2920/sf_rand_str (...) 192.185.93.105
2023-06-09 21:58:46 UTC 0 - 0 - 2 jacksonvillehairclinic.com/ 192.185.92.184
2023-06-09 21:54:27 UTC 5 - 0 - 1 acegaminglounge.com/css/folder/sf_rand_string (...) 108.179.234.131


Last 5 reports on domain: timehunter.co
Date UQ / IDS / BL URL IP
2023-03-25 23:05:33 UTC 0 - 0 - 16 timehunter.co/dum/ubdqqsumiaeau 162.241.61.69
2022-11-18 08:16:26 UTC 0 - 0 - 22 timehunter.co/ 162.241.61.69
2022-10-30 20:34:22 UTC 0 - 0 - 6 timehunter.co/dum/gtaeidntrfsuue 162.241.61.69
2022-10-30 20:33:49 UTC 0 - 0 - 6 timehunter.co/dum/etsilomoaqsu 162.241.61.69
2022-10-30 20:33:39 UTC 0 - 0 - 6 timehunter.co/dum/urruterasnpamea 162.241.61.69


Last 1 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-11-26 11:42:18 UTC 0 - 0 - 1 0mi68c.cn/ 104.143.9.111

JavaScript

Executed Scripts (32)

Executed Evals (5)
#1 JavaScript::Eval (size: 15533) - SHA256: c52e8eeb3f4cc2adcf9979cd0eed3a2f5d46d1640c49962a39e655e19dec4faa
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var f = function(c, E) {
            if (E = (c = null, Y.trustedTypes), !E || !E.createPolicy) return c;
            try {
                c = E.createPolicy("bg", {
                    createHTML: a,
                    createScript: a,
                    createScriptURL: a
                })
            } catch (v) {
                Y.console && Y.console.error(v.message)
            }
            return c
        },
        a = function(c) {
            return c
        },
        Y = this || self;
    (0, eval)(function(c, E) {
        return (E = f()) && 1 === c.eval(E.createScript("1")) ? function(v) {
            return E.createScript(v)
        } : function(v) {
            return "" + v
        }
    }(Y)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var cX=function(c,E,v,a,F){((v=r((c&=(F=c&4,3),v=p(E),a=p(E),v),E),F)&&(v=sn(""+v)),c&&D(E,k(v.length,2),a),D)(E,v,a)},iA=function(c,E,v,a){try{a=c[((E|0)+2)%3],c[E]=(c[E]|0)-(c[((E|0)+1)%3]|0)-(a|0)^(1==E?a<<v:a>>>v)}catch(F){throw F;}},vX=function(c,E,v,a,F,Y){for(a=(Y=(E=(v=p((F=c[En]||{},c)),F.av=p(c),F.Y=[],c.g)==c?(d(c)|0)-1:1,p)(c),0);a<E;a++)F.Y.push(p(c));for((F.Z=r(v,c),F).tQ=r(Y,c);E--;)F.Y[E]=r(F.Y[E],c);return F},Fs=function(c,E,v,a,F){if((a=E[0],a)==X)c.N=25,c.s(E);else if(a==M){v=E[1];try{F=c.P||c.s(E)}catch(Y){T(Y,c),F=c.P}v(F)}else if(a==Yh)c.s(E);else if(a==h)c.s(E);else if(a==ay){try{for(F=0;F<c.i.length;F++)try{v=c.i[F],v[0][v[1]](v[2])}catch(Y){}}catch(Y){}(0,E[1])(function(Y,f){c.S(Y,true,f)},(c.i=[],function(Y){(Y=!c.O.length,I)([fo],c),Y&&l(false,c,true)}))}else{if(a==C)return F=E[2],V(16,c,E[6]),V(267,c,F),c.s(E);a==fo?(c.j=[],c.T=null,c.G=[]):a==Lo&&"loading"===K.document.readyState&&(c.L=function(Y,f){function L(){f||(f=true,Y())}K.document.addEventListener((f=false,"DOMContentLoaded"),L,u),K.addEventListener("load",L,u)})}},Un=function(c,E,v){return((v=b[c.R](c.v8),v)[c.R]=function(){return E},v).concat=function(a){E=a},v},r=function(c,E){if(void 0===(E=E.T[c],E))throw[z,30,c];if(E.value)return E.create();return(E.create(1*c*c+-13*c+53),E).prototype},SF=function(c,E){return(E=E.create().shift(),c.H.create().length||c.I.create().length)||(c.H=void 0,c.I=void 0),E},r3=function(c,E){return b[E](b.prototype,{floor:c,splice:c,stack:c,parent:c,console:c,pop:c,length:c,document:c,replace:c,propertyIsEnumerable:c,prototype:c,call:c})},K=this||self,d=function(c){return c.H?SF(c,c.I):w(8,c,true)},HX=function(c,E){return E(function(v){v(c)}),[function(){return c}]},Dy=function(c,E,v,a){return(a=W[c.substring(0,3)+"_"])?a(c.substring(3),E,v):HX(c,E)},g3=function(c,E,v,a){for(a=(v=p(E),0);0<c;c--)a=a<<8|d(E);V(v,E,a)},kh=function(c,E){return(E=d(c),E&128)&&(E=E&127|d(c)<<7),E},Ry=function(c,E,v,a,F){for(a=0,F=v[2]|0,v=v[3]|0;14>a;a++)c=c>>>8|c<<24,c+=E|0,E=E<<3|E>>>29,v=v>>>8|v<<24,v+=F|0,v^=a+708,c^=F+708,F=F<<3|F>>>29,F^=v,E^=c;return[E>>>24&255,E>>>16&255,E>>>8&255,E>>>0&255,c>>>24&255,c>>>16&255,c>>>8&255,c>>>0&255]},d3=function(c,E,v){return c.S(function(a){v=a},false,E),v},k=function(c,E,v,a){for(a=(v=(E|0)-1,[]);0<=v;v--)a[(E|0)-1-(v|0)]=c>>8*v&255;return a},I=function(c,E){E.O.splice(0,0,c)},P=function(c,E,v){v=this;try{jF(E,c,this)}catch(a){T(a,this),E(function(F){F(v.P)})}},mz=function(c,E){if((E=(c=K.trustedTypes,null),!c)||!c.createPolicy)return E;try{E=c.createPolicy("bg",{createHTML:On,createScript:On,createScriptURL:On})}catch(v){K.console&&K.console.error(v.message)}return E},oy=function(c,E){(c.Th.push(c.T.slice()),c.T[335]=void 0,V)(335,c,E)},MW=function(c,E,v,a,F,Y,f,L){return((f=b[a=[-8,-13,42,76,(L=Xs,Y=v&7,25),27,a,-68,58,-21],c.R](c.ge),f)[c.R]=function(U){Y+=6+7*v,Y&=(F=U,7)},f).concat=function(U){return((U=(F=(U=-3286*F+a[(U=E%16+1,Y)+27&7]*E*U+(L()|0)*U+Y+1*E*E*U+62*F*F- -806*E*F-62*E*E*F-U*F,void 0),a)[U],a)[(Y+13&7)+(v&2)]=U,a)[Y+(v&2)]=-13,U},f},Ty=function(c,E){return c[E]<<24|c[(E|0)+1]<<16|c[(E|0)+2]<<8|c[(E|0)+3]},W,Q=function(c,E,v,a,F,Y){if(!v.h){if(3<(c=r((E=(0==(Y=((a=void 0,c)&&c[0]===z&&(E=c[1],a=c[2],c=void 0),r(74,v)),Y.length)&&(F=r(371,v)>>3,Y.push(E,F>>8&255,F&255),void 0!=a&&Y.push(a&255)),""),c&&(c.message&&(E+=c.message),c.stack&&(E+=":"+c.stack)),480),v),c)){E=sn((c-=(E=E.slice(0,(c|0)-3),(E.length|0)+3),E)),a=v.g,v.g=v;try{D(v,k(E.length,2).concat(E),197,9)}finally{v.g=a}}V(480,v,c)}},no=function(c,E,v,a){function F(){}return{invoke:(a=Dy(c,function(Y){F&&(E&&N(E),v=Y,F(),F=void 0)},(v=void 0,!!E))[0],function(Y,f,L,U){function S(){v(function(H){N(function(){Y(H)})},L)}if(!f)return f=a(L),Y&&Y(f),f;v?S():(U=F,F=function(){(U(),N)(S)})})}},w=function(c,E,v,a,F,Y,f,L,U,S,H,g,O,R){if((H=r(335,E),H)>=E.A)throw[z,31];for(F=(g=(L=H,c),E).de.length,O=0;0<g;)a=L>>3,S=L%8,Y=E.j[a],R=8-(S|0),R=R<g?R:g,v&&(U=E,U.X!=L>>6&&(U.X=L>>6,f=r(123,U),U.V=Ry(U.X,U.J,[0,0,f[1],f[2]])),Y^=E.V[a&F]),L+=R,O|=(Y>>8-(S|0)-(R|0)&(1<<R)-1)<<(g|0)-(R|0),g-=R;return V(335,E,(v=O,(H|0)+(c|0))),v},AN=function(c,E,v,a){return V(335,c,(hN(((a=r(335,c),c.j&&a<c.A)?(V(335,c,c.A),oy(c,v)):V(335,c,v),E),c),a)),r(267,c)},Iy=function(c,E){E.push(c[0]<<24|c[1]<<16|c[2]<<8|c[3]),E.push(c[4]<<24|c[5]<<16|c[6]<<8|c[7]),E.push(c[8]<<24|c[9]<<16|c[10]<<8|c[11])},N=K.requestIdleCallback?function(c){requestIdleCallback(function(){c()},{timeout:4})}:K.setImmediate?function(c){setImmediate(c)}:function(c){setTimeout(c,0)},lA=function(c,E,v,a,F,Y){function f(){if(a.g==a){if(a.T){var L=[C,c,E,void 0,F,Y,arguments];if(2==v)var U=l(false,a,(I(L,a),false));else if(1==v){var S=!a.O.length;(I(L,a),S)&&l(false,a,false)}else U=Fs(a,L);return U}F&&Y&&F.removeEventListener(Y,f,u)}}return f},V=function(c,E,v){if(335==c||371==c)E.T[c]?E.T[c].concat(v):E.T[c]=Un(E,v);else{if(E.h&&123!=c)return;77==c||197==c||285==c||74==c||96==c?E.T[c]||(E.T[c]=MW(E,c,126,v)):E.T[c]=MW(E,c,17,v)}123==c&&(E.J=w(32,E,false),E.X=void 0)},BX=function(c,E,v,a){for(;E.O.length;){a=(E.L=null,E.O).pop();try{v=Fs(E,a)}catch(F){T(F,E)}if(c&&E.L){(c=E.L,c)(function(){l(true,E,true)});break}}return v},e,sn=function(c,E,v,a,F){for(a=(E=(v=(c=c.replace(/\\r\\n/g,"\\n"),0),[]),0);a<c.length;a++)F=c.charCodeAt(a),128>F?E[v++]=F:(2048>F?E[v++]=F>>6|192:(55296==(F&64512)&&a+1<c.length&&56320==(c.charCodeAt(a+1)&64512)?(F=65536+((F&1023)<<10)+(c.charCodeAt(++a)&1023),E[v++]=F>>18|240,E[v++]=F>>12&63|128):E[v++]=F>>12|224,E[v++]=F>>6&63|128),E[v++]=F&63|128);return E},On=function(c){return c},$h=function(c,E,v){if(3==c.length){for(v=0;3>v;v++)E[v]+=c[v];for(c=[13,8,13,12,16,5,3,10,15],v=0;9>v;v++)E[3](E,v%3,c[v])}},y=function(c,E,v,a,F,Y,f,L,U){if(c.g=((F=(Y=(f=(L=(a||c.o++,0)<c.C&&c.u&&c.kY&&1>=c.W&&!c.H&&!c.L&&(!a||1<c.K-E)&&0==document.hidden,(U=4==c.o)||L)?c.v():c.U,f-c.U),Y>>14),c).J&&(c.J^=F*(Y<<2)),F||c.g),c.F+=F,U||L)c.o=0,c.U=f;if(!L||f-c.D<c.C-(v?255:a?5:2))return false;return!(c.L=(V(335,(v=r(a?371:335,(c.K=E,c)),c),c.A),c.O.push([Yh,v,a?E+1:E]),N),0)},Z=function(c,E,v){v[V(E,c,v),Lo]=2796},p=function(c,E){if(c.H)return SF(c,c.I);return E=w(8,c,true),E&128&&(E^=128,c=w(2,c,true),E=(E<<2)+(c|0)),E},jF=function(c,E,v,a,F){for(a=(F=((v.ge=r3({get:function(){return this.concat()}},(v.de=(v.sg=(v.Iv=Vh,Co),v[M]),v.R)),v).v8=b[v.R](v.ge,{value:{value:{}}}),0),[]);375>F;F++)a[F]=String.fromCharCode(F);l((I((I((Z(v,(V(77,v,[160,(V(480,(V((V(267,(Z(v,(Z(v,(V((Z(v,(Z(v,268,(Z(v,(Z((Z(v,241,(Z(v,299,(Z(v,(Z(v,(V(74,v,(Z(v,(Z(v,(Z(v,(Z(v,502,(V(198,(Z(v,377,(Z(v,(Z(v,((V(125,v,(Z(v,(Z(v,(V(130,v,(V(197,v,(Z(v,397,(Z(v,300,(Z(v,((V((V(96,(Z(v,(Z(v,(Z(v,188,(V(371,(V(335,v,((v.jW=(v.o=void 0,v.P=void 0,v.I=void 0,v.fP=function(Y){this.g=Y},v.D=0,v.i=[],v.u=!(v.kY=false,v.T=(v.F=(v.J=void 0,1),[]),1),v.N=25,v.X=void 0,v.O=[],v.W=0,v.h=false,v.B=(v.j=[],v.L=null,v.C=0,v.G=(v.Th=[],[]),v.H=(v.g=v,void 0),F=(v.U=0,window.performance||{}),v.A=0,0),0),v.V=(v.K=8001,void 0),v).X8=F.timeOrigin||(F.timing||{}).navigationStart||0,0)),v),0),function(Y,f,L,U,S,H,g,O,R,A,x,m){function t(n,B){for(;A<n;)g|=d(Y)<<A,A+=8;return B=g&(1<<n)-(A-=n,1),g>>=n,B}for(H=U=(m=(L=((A=(R=p(Y),g=0),t(3))|0)+1,t(5)),O=[],0);U<m;U++)S=t(1),O.push(S),H+=S?0:1;for(f=(U=((H|0)-1).toString(2).length,[]),H=0;H<m;H++)O[H]||(f[H]=t(U));for(U=0;U<m;U++)O[U]&&(f[U]=p(Y));for(x=[];L--;)x.push(r(p(Y),Y));Z(Y,R,function(n,B,po,J,G){for(B=(J=(po=[],[]),0);B<m;B++){if(!O[G=f[B],B]){for(;G>=J.length;)J.push(p(n));G=J[G]}po.push(G)}n.I=Un(n,(n.H=Un(n,x.slice()),po))})})),432),function(Y){cX(3,Y)}),429),function(Y,f,L){y(Y,f,false,true)||(f=p(Y),L=p(Y),V(L,Y,function(U){return eval(U)}(Ko(r(f,Y.g)))))}),v),[0,0,0]),336),v,K),v).zh=0,441),function(Y){xh(Y,1)}),function(Y){cX(4,Y)})),function(Y,f,L,U){(f=(L=p(Y),p(Y)),U=r(f,Y),L=r(L,Y),V)(f,Y,U+L)})),q(4))),v)),146),function(Y,f,L,U){V((L=(f=r((U=(L=p(Y),f=p(Y),p(Y)),f),Y),r(L,Y)==f),U),Y,+L)}),12),function(Y,f){Y=(f=p(Y),r(f,Y.g)),Y[0].removeEventListener(Y[1],Y[2],u)}),0)),Z)(v,396,function(Y){g3(4,Y)}),17),function(Y,f,L,U){L=(f=(U=(L=p((f=p(Y),Y)),p(Y)),r)(f,Y),r(L,Y)),V(U,Y,f in L|0)}),161),function(Y,f){f=r(p(Y),Y),oy(Y.g,f)}),function(Y,f,L,U,S){(L=(U=(S=p(Y),p)(Y),p(Y)),Y.g==Y)&&(f=r(S,Y),U=r(U,Y),L=r(L,Y),f[U]=L,123==S&&(Y.X=void 0,2==U&&(Y.J=w(32,Y,false),Y.X=void 0)))})),v),533),function(Y,f,L,U){if(L=Y.Th.pop()){for(f=d(Y);0<f;f--)U=p(Y),L[U]=Y.T[U];Y.T=(L[L[74]=Y.T[74],480]=Y.T[480],L)}else V(335,Y,Y.A)})),202),function(Y){xh(Y,4)}),189),function(Y,f,L){L=p(Y),f=p(Y),V(f,Y,""+r(L,Y))}),37),function(Y,f,L,U,S,H){if(!y(Y,f,true,true)){if("object"==(Y=r((H=(f=r((U=p((f=p((H=p(Y),S=p(Y),Y)),Y)),f),Y),S=r(S,Y),r)(H,Y),U),Y),tN(H))){for(L in U=[],H)U.push(L);H=U}for(U=(f=(L=0,0)<f?f:1,H.length);L<U;L+=f)S(H.slice(L,(L|0)+(f|0)),Y)}}),[])),v.Du=0,431),function(Y,f,L){0!=r((f=r((f=(L=p(Y),p(Y)),f),Y),L),Y)&&V(335,Y,f)}),445),function(Y,f,L,U){f=p(Y),U=d(Y),L=p(Y),V(L,Y,r(f,Y)>>>U)}),function(Y,f,L,U,S,H){y(Y,f,false,true)||(S=vX(Y.g),H=S.tQ,U=S.Z,f=S.av,S=S.Y,L=S.length,H=0==L?new H[U]:1==L?new H[U](S[0]):2==L?new H[U](S[0],S[1]):3==L?new H[U](S[0],S[1],S[2]):4==L?new H[U](S[0],S[1],S[2],S[3]):2(),V(f,Y,H))})),function(Y,f,L,U,S,H,g){for(S=(g=(L=r(5,(f=(H=(U=p(Y),kh(Y)),""),Y)),L.length),0);H--;)S=((S|0)+(kh(Y)|0))%g,f+=a[L[S]];V(U,Y,f)})),v),458,function(){}),339),function(Y,f,L,U,S){for(S=p(Y),f=kh(Y),L=0,U=[];L<f;L++)U.push(d(Y));V(S,Y,U)}),function(Y,f,L,U,S){(f=r((S=(L=(f=p((L=p((S=(U=p(Y),p)(Y),Y)),Y)),r)(L,Y),r(S,Y)),f),Y),V)(U,Y,lA(S,L,f,Y))})),481),function(Y,f,L){f=(f=p(Y),L=p(Y),f=r(f,Y),tN(f)),V(L,Y,f)}),467),v,0),88),function(Y,f,L,U){(f=(U=(L=p(Y),p(Y)),p(Y)),V)(f,Y,r(L,Y)||r(U,Y))}),35),function(Y,f,L,U,S){0!==(f=(L=(S=r((U=(S=p((f=(L=(U=p(Y),p(Y)),p(Y)),Y)),r(U,Y.g)),S),Y),r(L,Y)),r(f,Y)),U)&&(f=lA(f,S,1,Y,U,L),U.addEventListener(L,f,u),V(467,Y,[U,L,f]))}),v),{}),285),v,[]),v),2048),Z(v,231,function(Y,f,L,U){V((f=(L=(L=p((f=p(Y),Y)),U=p(Y),r(L,Y)),r(f,Y)),U),Y,f[L])}),0),0]),v.Eg=0,105),function(Y,f,L,U){!y(Y,f,false,true)&&(f=vX(Y),U=f.tQ,L=f.Z,Y.g==Y||L==Y.fP&&U==Y)&&(V(f.av,Y,L.apply(U,f.Y)),Y.U=Y.v())}),I([Lo],v),[h,E]),v),[ay,c]),v),true),v,true)},u={passive:true,capture:true},tN=function(c,E,v){if("object"==(E=typeof c,E))if(c){if(c instanceof Array)return"array";if(c instanceof Object)return E;if("[object Window]"==(v=Object.prototype.toString.call(c),v))return"object";if("[object Array]"==v||"number"==typeof c.length&&"undefined"!=typeof c.splice&&"undefined"!=typeof c.propertyIsEnumerable&&!c.propertyIsEnumerable("splice"))return"array";if("[object Function]"==v||"undefined"!=typeof c.call&&"undefined"!=typeof c.propertyIsEnumerable&&!c.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==E&&"undefined"==typeof c.call)return"object";return E},xh=function(c,E,v,a){(a=p(c),v=p(c),D)(c,k(r(a,c),E),v)},T=function(c,E){E.P=((E.P?E.P+"~":"E:")+c.message+":"+c.stack).slice(0,2048)},D=function(c,E,v,a,F,Y){if(c.g==c)for(F=r(v,c),197==v?(v=function(f,L,U,S,H){if((H=(L=F.length,(L|0)-4>>3),F).AQ!=H){F.AQ=(U=(S=(H<<3)-4,[0,0,Y[1],Y[2]]),H);try{F.Rv=Ry(Ty(F,(S|0)+4),Ty(F,S),U)}catch(g){throw g;}}F.push(F.Rv[L&7]^f)},Y=r(96,c)):v=function(f){F.push(f)},a&&v(a&255),c=E.length,a=0;a<c;a++)v(E[a])},hN=function(c,E,v,a,F,Y){if(!E.P){E.W++;try{for(Y=(v=(a=0,void 0),E.A);--c;)try{if(F=void 0,E.H)v=SF(E,E.H);else{if(a=r(335,E),a>=Y)break;v=r((F=p((V(371,E,a),E)),F),E)}v&&v[fo]&2048?v(E,c):Q([z,21,F],0,E),y(E,c,false,false)}catch(f){r(198,E)?Q(f,22,E):V(198,E,f)}if(!c){if(E.H8){hN(616892381910,(E.W--,E));return}Q([z,33],0,E)}}catch(f){try{Q(f,22,E)}catch(L){T(L,E)}}E.W--}},q=function(c,E){for(E=[];c--;)E.push(255*Math.random()|0);return E},l=function(c,E,v,a,F,Y){if(E.O.length){E.u=!((E.u&&0(),E).kY=v,0);try{a=E.v(),E.o=0,E.D=a,E.U=a,Y=BX(v,E),F=E.v()-E.D,E.B+=F,F<(c?0:10)||0>=E.N--||(F=Math.floor(F),E.G.push(254>=F?F:254))}finally{E.u=false}return Y}},En=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),h=(P.prototype.l="toString",P.prototype.c8=void 0,[]),z={},ay=[],M=(P.prototype.H8=false,[]),Lo=[],C=[],X=(P.prototype.W8=void 0,[]),Yh=[],fo=[],b=(Iy,q,iA,$h,z).constructor,Xs=((((e=P.prototype,e).nP=0,e.LP=function(){return Math.floor(this.B+(this.v()-this.D))},e).Og=function(){return Math.floor(this.v())},e).v=((P.prototype.R="create",window.performance)||{}).now?function(){return this.X8+window.performance.now()}:function(){return+new Date},e.S=function(c,E,v,a,F){if((v="array"===tN(v)?v:[v],this).P)c(this.P);else try{F=!this.O.length,a=[],I([X,a,v],this),I([M,c,a],this),E&&!F||l(true,this,E)}catch(Y){T(Y,this),c(this.P)}},e.JQ=function(c,E,v){return(E=((E^=E<<13,E^=E>>17,E)^E<<5)&v)||(E=1),c^E},void 0);e.YY=(e.Ug=function(c,E,v,a,F,Y){for(v=(a=(F=0,[]),0);v<c.length;v++)for(F+=E,Y=Y<<E|c[v];7<F;)F-=8,a.push(Y>>F&255);return a},function(c,E,v,a,F){for(F=a=0;F<c.length;F++)a+=c.charCodeAt(F),a+=a<<10,a^=a>>6;return a=(c=(a+=a<<3,a^=a>>11,a+(a<<15)>>>0),new Number(c&(1<<E)-1)),a[0]=(c>>>E)%v,a}),P.prototype.s=function(c,E){return c={},Xs=function(){return E==c?53:78},E={},function(v,a,F,Y,f,L,U,S,H,g,O,R,A,x,m){Y=E,E=c;try{if(R=v[0],R==h){H=v[1];try{for(L=(m=(U=atob(H),g=0),[]);g<U.length;g++)S=U.charCodeAt(g),255<S&&(L[m++]=S&255,S>>=8),L[m++]=S;V(123,this,[0,(this.A=(this.j=L,this.j).length<<3,0),0])}catch(t){Q(t,17,this);return}hN(8001,this)}else if(R==X)v[1].push(r(285,this).length,r(77,this).length,r(480,this),r(197,this).length),V(267,this,v[2]),this.T[208]&&AN(this,8001,r(208,this));else{if(R==M){this.g=(x=(A=k((r(77,(m=v[2],this)).length|0)+2,2),this).g,this);try{f=r(74,this),0<f.length&&D(this,k(f.length,2).concat(f),77,10),D(this,k(this.F,1),77,109),D(this,k(this[M].length,1),77),U=0,a=r(197,this),U-=(r(77,this).length|0)+5,U+=r(125,this)&2047,4<a.length&&(U-=(a.length|0)+3),0<U&&D(this,k(U,2).concat(q(U)),77,15),4<a.length&&D(this,k(a.length,2).concat(a),77,156)}finally{this.g=x}if((L=q(2).concat(r(77,this)),L[1]=L[0]^6,L)[3]=L[1]^A[0],L[4]=L[1]^A[1],O=this.P8(L))O="!"+O;else for(U=0,O="";U<L.length;U++)F=L[U][this.l](16),1==F.length&&(F="0"+F),O+=F;return r(197,(V(480,this,(r(285,(g=O,this)).length=m.shift(),r(77,this).length=m.shift(),m).shift()),this)).length=m.shift(),g}if(R==Yh)AN(this,v[2],v[1]);else if(R==C)return AN(this,8001,v[1])}}finally{E=Y}}}();var Vh,Co=(P.prototype[ay]=[0,0,1,1,0,1,1],P.prototype.mv=0,(P.prototype.P8=function(c,E,v,a){if(a=window.btoa){for(v=0,E="";v<c.length;v+=8192)E+=String.fromCharCode.apply(null,c.slice(v,v+8192));c=a(E).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else c=void 0;return c},P).prototype.ux=0,/./),uA=h.pop.bind(P.prototype[X]),Ko=((Vh=r3({get:uA},(Co[P.prototype.l]=uA,P.prototype.R)),P.prototype).yS=void 0,function(c,E){return(E=mz())&&1===c.eval(E.createScript("1"))?function(v){return E.createScript(v)}:function(v){return""+v}}(K));((W=K.botguard||(K.botguard={}),40<W.m)||(W.m=41,W.bg=no,W.a=Dy),W).Qxt_=function(c,E,v){return[(v=new P(c,E),function(a){return d3(v,a)})]};}).call(this);'));
}).call(this);
#2 JavaScript::Eval (size: 22) - SHA256: 61030fdcaac6b12bc0dc224160114651add4403b1f8ae11acd5078157e62ca8d
0,
function(Y) {
    g3(1, Y)
}
#3 JavaScript::Eval (size: 22) - SHA256: ed52a3db6a44bfd9b4f9d5b869cec5c3ab259aecb2d7634967d036ef5146654c
0,
function(Y) {
    g3(2, Y)
}
#4 JavaScript::Eval (size: 17389) - SHA256: 2d2dfce968b8980980243eedd4fd18ed13456945e09e3f23dd849c60bfaf16d9
(function() {
    var cX = function(c, E, v, a, F) {
            ((v = r((c &= (F = c & 4, 3), v = p(E), a = p(E), v), E), F) && (v = sn("" + v)), c && D(E, k(v.length, 2), a), D)(E, v, a)
        },
        iA = function(c, E, v, a) {
            try {
                a = c[((E | 0) + 2) % 3], c[E] = (c[E] | 0) - (c[((E | 0) + 1) % 3] | 0) - (a | 0) ^ (1 == E ? a << v : a >>> v)
            } catch (F) {
                throw F;
            }
        },
        vX = function(c, E, v, a, F, Y) {
            for (a = (Y = (E = (v = p((F = c[En] || {}, c)), F.av = p(c), F.Y = [], c.g) == c ? (d(c) | 0) - 1 : 1, p)(c), 0); a < E; a++) F.Y.push(p(c));
            for ((F.Z = r(v, c), F).tQ = r(Y, c); E--;) F.Y[E] = r(F.Y[E], c);
            return F
        },
        Fs = function(c, E, v, a, F) {
            if ((a = E[0], a) == X) c.N = 25, c.s(E);
            else if (a == M) {
                v = E[1];
                try {
                    F = c.P || c.s(E)
                } catch (Y) {
                    T(Y, c), F = c.P
                }
                v(F)
            } else if (a == Yh) c.s(E);
            else if (a == h) c.s(E);
            else if (a == ay) {
                try {
                    for (F = 0; F < c.i.length; F++) try {
                        v = c.i[F], v[0][v[1]](v[2])
                    } catch (Y) {}
                } catch (Y) {}(0, E[1])(function(Y, f) {
                    c.S(Y, true, f)
                }, (c.i = [], function(Y) {
                    (Y = !c.O.length, I)([fo], c), Y && l(false, c, true)
                }))
            } else {
                if (a == C) return F = E[2], V(16, c, E[6]), V(267, c, F), c.s(E);
                a == fo ? (c.j = [], c.T = null, c.G = []) : a == Lo && "loading" === K.document.readyState && (c.L = function(Y, f) {
                    function L() {
                        f || (f = true, Y())
                    }
                    K.document.addEventListener((f = false, "DOMContentLoaded"), L, u), K.addEventListener("load", L, u)
                })
            }
        },
        Un = function(c, E, v) {
            return ((v = b[c.R](c.v8), v)[c.R] = function() {
                return E
            }, v).concat = function(a) {
                E = a
            }, v
        },
        r = function(c, E) {
            if (void 0 === (E = E.T[c], E)) throw [z, 30, c];
            if (E.value) return E.create();
            return (E.create(1 * c * c + -13 * c + 53), E).prototype
        },
        SF = function(c, E) {
            return (E = E.create().shift(), c.H.create().length || c.I.create().length) || (c.H = void 0, c.I = void 0), E
        },
        r3 = function(c, E) {
            return b[E](b.prototype, {
                floor: c,
                splice: c,
                stack: c,
                parent: c,
                console: c,
                pop: c,
                length: c,
                document: c,
                replace: c,
                propertyIsEnumerable: c,
                prototype: c,
                call: c
            })
        },
        K = this || self,
        d = function(c) {
            return c.H ? SF(c, c.I) : w(8, c, true)
        },
        HX = function(c, E) {
            return E(function(v) {
                v(c)
            }), [function() {
                return c
            }]
        },
        Dy = function(c, E, v, a) {
            return (a = W[c.substring(0, 3) + "_"]) ? a(c.substring(3), E, v) : HX(c, E)
        },
        g3 = function(c, E, v, a) {
            for (a = (v = p(E), 0); 0 < c; c--) a = a << 8 | d(E);
            V(v, E, a)
        },
        kh = function(c, E) {
            return (E = d(c), E & 128) && (E = E & 127 | d(c) << 7), E
        },
        Ry = function(c, E, v, a, F) {
            for (a = 0, F = v[2] | 0, v = v[3] | 0; 14 > a; a++) c = c >>> 8 | c << 24, c += E | 0, E = E << 3 | E >>> 29, v = v >>> 8 | v << 24, v += F | 0, v ^= a + 708, c ^= F + 708, F = F << 3 | F >>> 29, F ^= v, E ^= c;
            return [E >>> 24 & 255, E >>> 16 & 255, E >>> 8 & 255, E >>> 0 & 255, c >>> 24 & 255, c >>> 16 & 255, c >>> 8 & 255, c >>> 0 & 255]
        },
        d3 = function(c, E, v) {
            return c.S(function(a) {
                v = a
            }, false, E), v
        },
        k = function(c, E, v, a) {
            for (a = (v = (E | 0) - 1, []); 0 <= v; v--) a[(E | 0) - 1 - (v | 0)] = c >> 8 * v & 255;
            return a
        },
        I = function(c, E) {
            E.O.splice(0, 0, c)
        },
        P = function(c, E, v) {
            v = this;
            try {
                jF(E, c, this)
            } catch (a) {
                T(a, this), E(function(F) {
                    F(v.P)
                })
            }
        },
        mz = function(c, E) {
            if ((E = (c = K.trustedTypes, null), !c) || !c.createPolicy) return E;
            try {
                E = c.createPolicy("bg", {
                    createHTML: On,
                    createScript: On,
                    createScriptURL: On
                })
            } catch (v) {
                K.console && K.console.error(v.message)
            }
            return E
        },
        oy = function(c, E) {
            (c.Th.push(c.T.slice()), c.T[335] = void 0, V)(335, c, E)
        },
        MW = function(c, E, v, a, F, Y, f, L) {
            return ((f = b[a = [-8, -13, 42, 76, (L = Xs, Y = v & 7, 25), 27, a, -68, 58, -21], c.R](c.ge), f)[c.R] = function(U) {
                Y += 6 + 7 * v, Y &= (F = U, 7)
            }, f).concat = function(U) {
                return ((U = (F = (U = -3286 * F + a[(U = E % 16 + 1, Y) + 27 & 7] * E * U + (L() | 0) * U + Y + 1 * E * E * U + 62 * F * F - -806 * E * F - 62 * E * E * F - U * F, void 0), a)[U], a)[(Y + 13 & 7) + (v & 2)] = U, a)[Y + (v & 2)] = -13, U
            }, f
        },
        Ty = function(c, E) {
            return c[E] << 24 | c[(E | 0) + 1] << 16 | c[(E | 0) + 2] << 8 | c[(E | 0) + 3]
        },
        W, Q = function(c, E, v, a, F, Y) {
            if (!v.h) {
                if (3 < (c = r((E = (0 == (Y = ((a = void 0, c) && c[0] === z && (E = c[1], a = c[2], c = void 0), r(74, v)), Y.length) && (F = r(371, v) >> 3, Y.push(E, F >> 8 & 255, F & 255), void 0 != a && Y.push(a & 255)), ""), c && (c.message && (E += c.message), c.stack && (E += ":" + c.stack)), 480), v), c)) {
                    E = sn((c -= (E = E.slice(0, (c | 0) - 3), (E.length | 0) + 3), E)), a = v.g, v.g = v;
                    try {
                        D(v, k(E.length, 2).concat(E), 197, 9)
                    } finally {
                        v.g = a
                    }
                }
                V(480, v, c)
            }
        },
        no = function(c, E, v, a) {
            function F() {}
            return {
                invoke: (a = Dy(c, function(Y) {
                    F && (E && N(E), v = Y, F(), F = void 0)
                }, (v = void 0, !!E))[0], function(Y, f, L, U) {
                    function S() {
                        v(function(H) {
                            N(function() {
                                Y(H)
                            })
                        }, L)
                    }
                    if (!f) return f = a(L), Y && Y(f), f;
                    v ? S() : (U = F, F = function() {
                        (U(), N)(S)
                    })
                })
            }
        },
        w = function(c, E, v, a, F, Y, f, L, U, S, H, g, O, R) {
            if ((H = r(335, E), H) >= E.A) throw [z, 31];
            for (F = (g = (L = H, c), E).de.length, O = 0; 0 < g;) a = L >> 3, S = L % 8, Y = E.j[a], R = 8 - (S | 0), R = R < g ? R : g, v && (U = E, U.X != L >> 6 && (U.X = L >> 6, f = r(123, U), U.V = Ry(U.X, U.J, [0, 0, f[1], f[2]])), Y ^= E.V[a & F]), L += R, O |= (Y >> 8 - (S | 0) - (R | 0) & (1 << R) - 1) << (g | 0) - (R | 0), g -= R;
            return V(335, E, (v = O, (H | 0) + (c | 0))), v
        },
        AN = function(c, E, v, a) {
            return V(335, c, (hN(((a = r(335, c), c.j && a < c.A) ? (V(335, c, c.A), oy(c, v)) : V(335, c, v), E), c), a)), r(267, c)
        },
        Iy = function(c, E) {
            E.push(c[0] << 24 | c[1] << 16 | c[2] << 8 | c[3]), E.push(c[4] << 24 | c[5] << 16 | c[6] << 8 | c[7]), E.push(c[8] << 24 | c[9] << 16 | c[10] << 8 | c[11])
        },
        N = K.requestIdleCallback ? function(c) {
            requestIdleCallback(function() {
                c()
            }, {
                timeout: 4
            })
        } : K.setImmediate ? function(c) {
            setImmediate(c)
        } : function(c) {
            setTimeout(c, 0)
        },
        lA = function(c, E, v, a, F, Y) {
            function f() {
                if (a.g == a) {
                    if (a.T) {
                        var L = [C, c, E, void 0, F, Y, arguments];
                        if (2 == v) var U = l(false, a, (I(L, a), false));
                        else if (1 == v) {
                            var S = !a.O.length;
                            (I(L, a), S) && l(false, a, false)
                        } else U = Fs(a, L);
                        return U
                    }
                    F && Y && F.removeEventListener(Y, f, u)
                }
            }
            return f
        },
        V = function(c, E, v) {
            if (335 == c || 371 == c) E.T[c] ? E.T[c].concat(v) : E.T[c] = Un(E, v);
            else {
                if (E.h && 123 != c) return;
                77 == c || 197 == c || 285 == c || 74 == c || 96 == c ? E.T[c] || (E.T[c] = MW(E, c, 126, v)) : E.T[c] = MW(E, c, 17, v)
            }
            123 == c && (E.J = w(32, E, false), E.X = void 0)
        },
        BX = function(c, E, v, a) {
            for (; E.O.length;) {
                a = (E.L = null, E.O).pop();
                try {
                    v = Fs(E, a)
                } catch (F) {
                    T(F, E)
                }
                if (c && E.L) {
                    (c = E.L, c)(function() {
                        l(true, E, true)
                    });
                    break
                }
            }
            return v
        },
        e, sn = function(c, E, v, a, F) {
            for (a = (E = (v = (c = c.replace(/\r\n/g, "\n"), 0), []), 0); a < c.length; a++) F = c.charCodeAt(a), 128 > F ? E[v++] = F : (2048 > F ? E[v++] = F >> 6 | 192 : (55296 == (F & 64512) && a + 1 < c.length && 56320 == (c.charCodeAt(a + 1) & 64512) ? (F = 65536 + ((F & 1023) << 10) + (c.charCodeAt(++a) & 1023), E[v++] = F >> 18 | 240, E[v++] = F >> 12 & 63 | 128) : E[v++] = F >> 12 | 224, E[v++] = F >> 6 & 63 | 128), E[v++] = F & 63 | 128);
            return E
        },
        On = function(c) {
            return c
        },
        $h = function(c, E, v) {
            if (3 == c.length) {
                for (v = 0; 3 > v; v++) E[v] += c[v];
                for (c = [13, 8, 13, 12, 16, 5, 3, 10, 15], v = 0; 9 > v; v++) E[3](E, v % 3, c[v])
            }
        },
        y = function(c, E, v, a, F, Y, f, L, U) {
            if (c.g = ((F = (Y = (f = (L = (a || c.o++, 0) < c.C && c.u && c.kY && 1 >= c.W && !c.H && !c.L && (!a || 1 < c.K - E) && 0 == document.hidden, (U = 4 == c.o) || L) ? c.v() : c.U, f - c.U), Y >> 14), c).J && (c.J ^= F * (Y << 2)), F || c.g), c.F += F, U || L) c.o = 0, c.U = f;
            if (!L || f - c.D < c.C - (v ? 255 : a ? 5 : 2)) return false;
            return !(c.L = (V(335, (v = r(a ? 371 : 335, (c.K = E, c)), c), c.A), c.O.push([Yh, v, a ? E + 1 : E]), N), 0)
        },
        Z = function(c, E, v) {
            v[V(E, c, v), Lo] = 2796
        },
        p = function(c, E) {
            if (c.H) return SF(c, c.I);
            return E = w(8, c, true), E & 128 && (E ^= 128, c = w(2, c, true), E = (E << 2) + (c | 0)), E
        },
        jF = function(c, E, v, a, F) {
            for (a = (F = ((v.ge = r3({get: function() {
                        return this.concat()
                    }
                }, (v.de = (v.sg = (v.Iv = Vh, Co), v[M]), v.R)), v).v8 = b[v.R](v.ge, {
                    value: {
                        value: {}
                    }
                }), 0), []); 375 > F; F++) a[F] = String.fromCharCode(F);
            l((I((I((Z(v, (V(77, v, [160, (V(480, (V((V(267, (Z(v, (Z(v, (V((Z(v, (Z(v, 268, (Z(v, (Z((Z(v, 241, (Z(v, 299, (Z(v, (Z(v, (V(74, v, (Z(v, (Z(v, (Z(v, (Z(v, 502, (V(198, (Z(v, 377, (Z(v, (Z(v, ((V(125, v, (Z(v, (Z(v, (V(130, v, (V(197, v, (Z(v, 397, (Z(v, 300, (Z(v, ((V((V(96, (Z(v, (Z(v, (Z(v, 188, (V(371, (V(335, v, ((v.jW = (v.o = void 0, v.P = void 0, v.I = void 0, v.fP = function(Y) {
                this.g = Y
            }, v.D = 0, v.i = [], v.u = !(v.kY = false, v.T = (v.F = (v.J = void 0, 1), []), 1), v.N = 25, v.X = void 0, v.O = [], v.W = 0, v.h = false, v.B = (v.j = [], v.L = null, v.C = 0, v.G = (v.Th = [], []), v.H = (v.g = v, void 0), F = (v.U = 0, window.performance || {}), v.A = 0, 0), 0), v.V = (v.K = 8001, void 0), v).X8 = F.timeOrigin || (F.timing || {}).navigationStart || 0, 0)), v), 0), function(Y, f, L, U, S, H, g, O, R, A, x, m) {
                function t(n, B) {
                    for (; A < n;) g |= d(Y) << A, A += 8;
                    return B = g & (1 << n) - (A -= n, 1), g >>= n, B
                }
                for (H = U = (m = (L = ((A = (R = p(Y), g = 0), t(3)) | 0) + 1, t(5)), O = [], 0); U < m; U++) S = t(1), O.push(S), H += S ? 0 : 1;
                for (f = (U = ((H | 0) - 1).toString(2).length, []), H = 0; H < m; H++) O[H] || (f[H] = t(U));
                for (U = 0; U < m; U++) O[U] && (f[U] = p(Y));
                for (x = []; L--;) x.push(r(p(Y), Y));
                Z(Y, R, function(n, B, po, J, G) {
                    for (B = (J = (po = [], []), 0); B < m; B++) {
                        if (!O[G = f[B], B]) {
                            for (; G >= J.length;) J.push(p(n));
                            G = J[G]
                        }
                        po.push(G)
                    }
                    n.I = Un(n, (n.H = Un(n, x.slice()), po))
                })
            })), 432), function(Y) {
                cX(3, Y)
            }), 429), function(Y, f, L) {
                y(Y, f, false, true) || (f = p(Y), L = p(Y), V(L, Y, function(U) {
                    return eval(U)
                }(Ko(r(f, Y.g)))))
            }), v), [0, 0, 0]), 336), v, K), v).zh = 0, 441), function(Y) {
                xh(Y, 1)
            }), function(Y) {
                cX(4, Y)
            })), function(Y, f, L, U) {
                (f = (L = p(Y), p(Y)), U = r(f, Y), L = r(L, Y), V)(f, Y, U + L)
            })), q(4))), v)), 146), function(Y, f, L, U) {
                V((L = (f = r((U = (L = p(Y), f = p(Y), p(Y)), f), Y), r(L, Y) == f), U), Y, +L)
            }), 12), function(Y, f) {
                Y = (f = p(Y), r(f, Y.g)), Y[0].removeEventListener(Y[1], Y[2], u)
            }), 0)), Z)(v, 396, function(Y) {
                g3(4, Y)
            }), 17), function(Y, f, L, U) {
                L = (f = (U = (L = p((f = p(Y), Y)), p(Y)), r)(f, Y), r(L, Y)), V(U, Y, f in L | 0)
            }), 161), function(Y, f) {
                f = r(p(Y), Y), oy(Y.g, f)
            }), function(Y, f, L, U, S) {
                (L = (U = (S = p(Y), p)(Y), p(Y)), Y.g == Y) && (f = r(S, Y), U = r(U, Y), L = r(L, Y), f[U] = L, 123 == S && (Y.X = void 0, 2 == U && (Y.J = w(32, Y, false), Y.X = void 0)))
            })), v), 533), function(Y, f, L, U) {
                if (L = Y.Th.pop()) {
                    for (f = d(Y); 0 < f; f--) U = p(Y), L[U] = Y.T[U];
                    Y.T = (L[L[74] = Y.T[74], 480] = Y.T[480], L)
                } else V(335, Y, Y.A)
            })), 202), function(Y) {
                xh(Y, 4)
            }), 189), function(Y, f, L) {
                L = p(Y), f = p(Y), V(f, Y, "" + r(L, Y))
            }), 37), function(Y, f, L, U, S, H) {
                if (!y(Y, f, true, true)) {
                    if ("object" == (Y = r((H = (f = r((U = p((f = p((H = p(Y), S = p(Y), Y)), Y)), f), Y), S = r(S, Y), r)(H, Y), U), Y), tN(H))) {
                        for (L in U = [], H) U.push(L);
                        H = U
                    }
                    for (U = (f = (L = 0, 0) < f ? f : 1, H.length); L < U; L += f) S(H.slice(L, (L | 0) + (f | 0)), Y)
                }
            }), [])), v.Du = 0, 431), function(Y, f, L) {
                0 != r((f = r((f = (L = p(Y), p(Y)), f), Y), L), Y) && V(335, Y, f)
            }), 445), function(Y, f, L, U) {
                f = p(Y), U = d(Y), L = p(Y), V(L, Y, r(f, Y) >>> U)
            }), function(Y, f, L, U, S, H) {
                y(Y, f, false, true) || (S = vX(Y.g), H = S.tQ, U = S.Z, f = S.av, S = S.Y, L = S.length, H = 0 == L ? new H[U] : 1 == L ? new H[U](S[0]) : 2 == L ? new H[U](S[0], S[1]) : 3 == L ? new H[U](S[0], S[1], S[2]) : 4 == L ? new H[U](S[0], S[1], S[2], S[3]) : 2(), V(f, Y, H))
            })), function(Y, f, L, U, S, H, g) {
                for (S = (g = (L = r(5, (f = (H = (U = p(Y), kh(Y)), ""), Y)), L.length), 0); H--;) S = ((S | 0) + (kh(Y) | 0)) % g, f += a[L[S]];
                V(U, Y, f)
            })), v), 458, function() {}), 339), function(Y, f, L, U, S) {
                for (S = p(Y), f = kh(Y), L = 0, U = []; L < f; L++) U.push(d(Y));
                V(S, Y, U)
            }), function(Y, f, L, U, S) {
                (f = r((S = (L = (f = p((L = p((S = (U = p(Y), p)(Y), Y)), Y)), r)(L, Y), r(S, Y)), f), Y), V)(U, Y, lA(S, L, f, Y))
            })), 481), function(Y, f, L) {
                f = (f = p(Y), L = p(Y), f = r(f, Y), tN(f)), V(L, Y, f)
            }), 467), v, 0), 88), function(Y, f, L, U) {
                (f = (U = (L = p(Y), p(Y)), p(Y)), V)(f, Y, r(L, Y) || r(U, Y))
            }), 35), function(Y, f, L, U, S) {
                0 !== (f = (L = (S = r((U = (S = p((f = (L = (U = p(Y), p(Y)), p(Y)), Y)), r(U, Y.g)), S), Y), r(L, Y)), r(f, Y)), U) && (f = lA(f, S, 1, Y, U, L), U.addEventListener(L, f, u), V(467, Y, [U, L, f]))
            }), v), {}), 285), v, []), v), 2048), Z(v, 231, function(Y, f, L, U) {
                V((f = (L = (L = p((f = p(Y), Y)), U = p(Y), r(L, Y)), r(f, Y)), U), Y, f[L])
            }), 0), 0]), v.Eg = 0, 105), function(Y, f, L, U) {
                !y(Y, f, false, true) && (f = vX(Y), U = f.tQ, L = f.Z, Y.g == Y || L == Y.fP && U == Y) && (V(f.av, Y, L.apply(U, f.Y)), Y.U = Y.v())
            }), I([Lo], v), [h, E]), v), [ay, c]), v), true), v, true)
        },
        u = {
            passive: true,
            capture: true
        },
        tN = function(c, E, v) {
            if ("object" == (E = typeof c, E))
                if (c) {
                    if (c instanceof Array) return "array";
                    if (c instanceof Object) return E;
                    if ("[object Window]" == (v = Object.prototype.toString.call(c), v)) return "object";
                    if ("[object Array]" == v || "number" == typeof c.length && "undefined" != typeof c.splice && "undefined" != typeof c.propertyIsEnumerable && !c.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == v || "undefined" != typeof c.call && "undefined" != typeof c.propertyIsEnumerable && !c.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == E && "undefined" == typeof c.call) return "object";
            return E
        },
        xh = function(c, E, v, a) {
            (a = p(c), v = p(c), D)(c, k(r(a, c), E), v)
        },
        T = function(c, E) {
            E.P = ((E.P ? E.P + "~" : "E:") + c.message + ":" + c.stack).slice(0, 2048)
        },
        D = function(c, E, v, a, F, Y) {
            if (c.g == c)
                for (F = r(v, c), 197 == v ? (v = function(f, L, U, S, H) {
                        if ((H = (L = F.length, (L | 0) - 4 >> 3), F).AQ != H) {
                            F.AQ = (U = (S = (H << 3) - 4, [0, 0, Y[1], Y[2]]), H);
                            try {
                                F.Rv = Ry(Ty(F, (S | 0) + 4), Ty(F, S), U)
                            } catch (g) {
                                throw g;
                            }
                        }
                        F.push(F.Rv[L & 7] ^ f)
                    }, Y = r(96, c)) : v = function(f) {
                        F.push(f)
                    }, a && v(a & 255), c = E.length, a = 0; a < c; a++) v(E[a])
        },
        hN = function(c, E, v, a, F, Y) {
            if (!E.P) {
                E.W++;
                try {
                    for (Y = (v = (a = 0, void 0), E.A); --c;) try {
                        if (F = void 0, E.H) v = SF(E, E.H);
                        else {
                            if (a = r(335, E), a >= Y) break;
                            v = r((F = p((V(371, E, a), E)), F), E)
                        }
                        v && v[fo] & 2048 ? v(E, c) : Q([z, 21, F], 0, E), y(E, c, false, false)
                    } catch (f) {
                        r(198, E) ? Q(f, 22, E) : V(198, E, f)
                    }
                    if (!c) {
                        if (E.H8) {
                            hN(616892381910, (E.W--, E));
                            return
                        }
                        Q([z, 33], 0, E)
                    }
                } catch (f) {
                    try {
                        Q(f, 22, E)
                    } catch (L) {
                        T(L, E)
                    }
                }
                E.W--
            }
        },
        q = function(c, E) {
            for (E = []; c--;) E.push(255 * Math.random() | 0);
            return E
        },
        l = function(c, E, v, a, F, Y) {
            if (E.O.length) {
                E.u = !((E.u && 0(), E).kY = v, 0);
                try {
                    a = E.v(), E.o = 0, E.D = a, E.U = a, Y = BX(v, E), F = E.v() - E.D, E.B += F, F < (c ? 0 : 10) || 0 >= E.N-- || (F = Math.floor(F), E.G.push(254 >= F ? F : 254))
                } finally {
                    E.u = false
                }
                return Y
            }
        },
        En = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        h = (P.prototype.l = "toString", P.prototype.c8 = void 0, []),
        z = {},
        ay = [],
        M = (P.prototype.H8 = false, []),
        Lo = [],
        C = [],
        X = (P.prototype.W8 = void 0, []),
        Yh = [],
        fo = [],
        b = (Iy, q, iA, $h, z).constructor,
        Xs = ((((e = P.prototype, e).nP = 0, e.LP = function() {
            return Math.floor(this.B + (this.v() - this.D))
        }, e).Og = function() {
            return Math.floor(this.v())
        }, e).v = ((P.prototype.R = "create", window.performance) || {}).now ? function() {
            return this.X8 + window.performance.now()
        } : function() {
            return +new Date
        }, e.S = function(c, E, v, a, F) {
            if ((v = "array" === tN(v) ? v : [v], this).P) c(this.P);
            else try {
                F = !this.O.length, a = [], I([X, a, v], this), I([M, c, a], this), E && !F || l(true, this, E)
            } catch (Y) {
                T(Y, this), c(this.P)
            }
        }, e.JQ = function(c, E, v) {
            return (E = ((E ^= E << 13, E ^= E >> 17, E) ^ E << 5) & v) || (E = 1), c ^ E
        }, void 0);
    e.YY = (e.Ug = function(c, E, v, a, F, Y) {
        for (v = (a = (F = 0, []), 0); v < c.length; v++)
            for (F += E, Y = Y << E | c[v]; 7 < F;) F -= 8, a.push(Y >> F & 255);
        return a
    }, function(c, E, v, a, F) {
        for (F = a = 0; F < c.length; F++) a += c.charCodeAt(F), a += a << 10, a ^= a >> 6;
        return a = (c = (a += a << 3, a ^= a >> 11, a + (a << 15) >>> 0), new Number(c & (1 << E) - 1)), a[0] = (c >>> E) % v, a
    }), P.prototype.s = function(c, E) {
        return c = {}, Xs = function() {
                return E == c ? 53 : 78
            }, E = {},
            function(v, a, F, Y, f, L, U, S, H, g, O, R, A, x, m) {
                Y = E, E = c;
                try {
                    if (R = v[0], R == h) {
                        H = v[1];
                        try {
                            for (L = (m = (U = atob(H), g = 0), []); g < U.length; g++) S = U.charCodeAt(g), 255 < S && (L[m++] = S & 255, S >>= 8), L[m++] = S;
                            V(123, this, [0, (this.A = (this.j = L, this.j).length << 3, 0), 0])
                        } catch (t) {
                            Q(t, 17, this);
                            return
                        }
                        hN(8001, this)
                    } else if (R == X) v[1].push(r(285, this).length, r(77, this).length, r(480, this), r(197, this).length), V(267, this, v[2]), this.T[208] && AN(this, 8001, r(208, this));
                    else {
                        if (R == M) {
                            this.g = (x = (A = k((r(77, (m = v[2], this)).length | 0) + 2, 2), this).g, this);
                            try {
                                f = r(74, this), 0 < f.length && D(this, k(f.length, 2).concat(f), 77, 10), D(this, k(this.F, 1), 77, 109), D(this, k(this[M].length, 1), 77), U = 0, a = r(197, this), U -= (r(77, this).length | 0) + 5, U += r(125, this) & 2047, 4 < a.length && (U -= (a.length | 0) + 3), 0 < U && D(this, k(U, 2).concat(q(U)), 77, 15), 4 < a.length && D(this, k(a.length, 2).concat(a), 77, 156)
                            } finally {
                                this.g = x
                            }
                            if ((L = q(2).concat(r(77, this)), L[1] = L[0] ^ 6, L)[3] = L[1] ^ A[0], L[4] = L[1] ^ A[1], O = this.P8(L)) O = "!" + O;
                            else
                                for (U = 0, O = ""; U < L.length; U++) F = L[U][this.l](16), 1 == F.length && (F = "0" + F), O += F;
                            return r(197, (V(480, this, (r(285, (g = O, this)).length = m.shift(), r(77, this).length = m.shift(), m).shift()), this)).length = m.shift(), g
                        }
                        if (R == Yh) AN(this, v[2], v[1]);
                        else if (R == C) return AN(this, 8001, v[1])
                    }
                } finally {
                    E = Y
                }
            }
    }();
    var Vh, Co = (P.prototype[ay] = [0, 0, 1, 1, 0, 1, 1], P.prototype.mv = 0, (P.prototype.P8 = function(c, E, v, a) {
            if (a = window.btoa) {
                for (v = 0, E = ""; v < c.length; v += 8192) E += String.fromCharCode.apply(null, c.slice(v, v + 8192));
                c = a(E).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
            } else c = void 0;
            return c
        }, P).prototype.ux = 0, /./),
        uA = h.pop.bind(P.prototype[X]),
        Ko = ((Vh = r3({get: uA
        }, (Co[P.prototype.l] = uA, P.prototype.R)), P.prototype).yS = void 0, function(c, E) {
            return (E = mz()) && 1 === c.eval(E.createScript("1")) ? function(v) {
                return E.createScript(v)
            } : function(v) {
                return "" + v
            }
        }(K));
    ((W = K.botguard || (K.botguard = {}), 40 < W.m) || (W.m = 41, W.bg = no, W.a = Dy), W).Qxt_ = function(c, E, v) {
        return [(v = new P(c, E), function(a) {
            return d3(v, a)
        })]
    };
}).call(this);
#5 JavaScript::Eval (size: 62) - SHA256: a8e5a9e89dd2059b0ae5b141b769125ee2581cb7c3a0aa69b384a96c04b6b5e4
0,
function(Y, f, L) {
    f = (L = p((f = p(Y), Y)), Y.T[f] && r(f, Y)), V(L, Y, f)
}

Executed Writes (1)
#1 JavaScript::Write (size: 15) - SHA256: c77e5168dffda66b8dc13f1425b4d3630a6656a3e5acf707f4393277ba3c8b5e
< !DOCTYPE html >


HTTP Transactions (93)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "FE77420EC3A11F547CF5172B68D30FAA4FE0C13165AE305F0013B02914E61084"
Last-Modified: Sat, 25 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12760
Expires: Sun, 26 Mar 2023 02:38:02 GMT
Date: Sat, 25 Mar 2023 23:05:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "34A026664386054B0B73C36CD1DDFCE023551EE41963DF0E38248BAC1E1EB56C"
Last-Modified: Fri, 24 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14799
Expires: Sun, 26 Mar 2023 03:12:01 GMT
Date: Sat, 25 Mar 2023 23:05:22 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Alert, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 25 Mar 2023 22:15:29 GMT
age: 2993
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    84db75194692d4afe13196bda6f22da8
Sha1:   4c1f49bc973a4917f146d93c8d598344edc021f6
Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "63463447D29550C3734F621BE02EC85290FBDF4612F79F9FAD7E94F7E066DCB0"
Last-Modified: Fri, 24 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2252
Expires: Sat, 25 Mar 2023 23:42:54 GMT
Date: Sat, 25 Mar 2023 23:05:22 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: RhR5yG/0AwaHaVElzKiw0Vx/OtU6sQe5rxgjsakDHDy7SOEhfhXPN/aLP0hqSGSFYC/WRvrpOuk=
x-amz-request-id: H140BNQCD8R4EK5S
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 25 Mar 2023 22:55:05 GMT
age: 617
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    e7bace7c1e04d44012e37ddffe36e5d5
Sha1:   3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 25 Mar 2023 23:05:22 GMT
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /dum/ubdqqsumiaeau HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             162.241.61.69
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 25 Mar 2023 23:05:22 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Redirect-By: WordPress
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Location: https://timehunter.co/dum/ubdqqsumiaeau
Content-Length: 0
Keep-Alive: timeout=5, max=75


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Malware
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, ETag, Content-Type, Cache-Control, Pragma, Alert, Last-Modified, Retry-After, Backoff, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 25 Mar 2023 22:14:33 GMT
age: 3050
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "3C8D41EFE14DC75E001CE50AAE65E133D90BCB2E2F86B2426CEFE7ABE4C7B588"
Last-Modified: Fri, 24 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6188
Expires: Sun, 26 Mar 2023 00:48:31 GMT
Date: Sat, 25 Mar 2023 23:05:23 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "9F1CB8E31FC23EA55F8B86AF7A731F1770A2D6C805715C7FB13375E720274679"
Last-Modified: Sat, 25 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Sun, 26 Mar 2023 05:05:23 GMT
Date: Sat, 25 Mar 2023 23:05:23 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: SFSGqMYKhpN6R0agS9RmjA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.39.172.78
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 3r+uONcwvGB/K9gufKelgJeda50=

                                        
                                            GET /dum/ubdqqsumiaeau HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             162.241.61.69
HTTP/2 404 Not Found
content-type: text/html; charset=UTF-8
                                            
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://timehunter.co/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
content-encoding: gzip
content-length: 13304
date: Sat, 25 Mar 2023 23:05:23 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (9381), with CRLF, LF line terminators
Size:   13304
Md5:    e27417ea74293a99110ab9b9fbe02b60
Sha1:   f2bd45598141b103113c282afcbef1a76bae8a37
Sha256: 9661c54e59cfcc404fd30c0d82657ad371b5a4725679efb7c7490bfe11092de2

Blocklists:
  - fortinet: Malware
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gtag/js?id=UA-105559457-1 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.168
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 25 Mar 2023 23:05:24 GMT
expires: Sat, 25 Mar 2023 23:05:24 GMT
cache-control: private, max-age=900
last-modified: Sat, 25 Mar 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 44782
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2206)
Size:   44782
Md5:    321bf6f3b054c3dda50823837bfc558b
Sha1:   d732af0d30300d39394757129fc6c8936d154cc5
Sha256: 4e2bce65a72dd09e2edcb53db11de4168337cc0a37b59a5eff24be55befafef7
                                        
                                            GET /recaptcha/api.js?render=6LcSKsEUAAAAAKIBDGoll9BpWCYn-YKFYKUlfomp&ver=3.0 HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.164
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                            
expires: Sat, 25 Mar 2023 23:05:24 GMT
date: Sat, 25 Mar 2023 23:05:24 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 585
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   585
Md5:    27d4753c7c2bc567c4d55e3a654ad4e9
Sha1:   04903471fb2375bcf8ae260a414220232d9acf5a
Sha256: db3329e386462a08b43778815804e2768fc95f1c27e3e161437f8b44b78858bd
                                        
                                            GET /gtm.js?id=GTM-5P4PFGL HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.168
HTTP/2 404 Not Found
content-type: text/html; charset=UTF-8
                                            
cross-origin-resource-policy: cross-origin
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Google Tag Manager
content-length: 1582
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Size:   1582
Md5:    cb8d3db96cd495c113fec2b7c2b8ea03
Sha1:   d4ec71e564eb519606a5498ac0af17fe50a701b1
Sha256: b26bc4137d8545ca6dfd4736961fa557237ca42ca242e716323af3adf7e1548c
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Tue, 25 Oct 2022 13:45:16 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 189
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   189
Md5:    5a18e16eb01cbaa862eb32e6b77bedb2
Sha1:   3abf9b913cc9f558f02cba7c9b822f8d1812cb96
Sha256: d2b5af913332941d5ae7786d1fa70e0d009315c4ede6ad5b80d0f663bb54521f

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/themes/sydney/css/bootstrap/bootstrap.min.css?ver=1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 5401
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (16271)
Size:   5401
Md5:    2b9e5b48da7557b2a23645d642ea9a60
Sha1:   420c8e7665e16e6f22f2c683aad0d62a4b6d264c
Sha256: fa0c7b3058120d0ff9dc6f9db90ef60869d16a89301ec4bc70821dbc56d886af

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/plugins/wpcf7-redirect/build/css/wpcf7-redirect-frontend.min.css?ver=6.1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Tue, 07 Feb 2023 02:34:35 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 124
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF, CR line terminators
Size:   124
Md5:    893dd4d34591cb544851b5a41747cdfd
Sha1:   e8585a3187cfaa2288f0cb48e5696929306b7615
Sha256: 1de5e3983dd9d63c6d92bc1543a4ae8978b38fbaa8d79fbbc2035c62a68cd7cf
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-content/themes/sydney/fonts/font-awesome.min.css?ver=6.1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 7114
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (30837)
Size:   7114
Md5:    82a55032c4b614390aea6ef6870d3e90
Sha1:   bb21577feea531540a8d4f27ac3730ffac111e1b
Sha256: 4f068500ef9ef0dbffa5b76ac10f1970a7a9de8ff033f84228971a140eb20069
                                        
                                            GET /wp-content/uploads/pum/pum-site-styles.css?generated=1678373154&ver=1.18.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Thu, 09 Mar 2023 14:45:54 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 4985
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (7454), with CRLF, LF line terminators
Size:   4985
Md5:    1cc80871d2dfda2163f22948509dbcc2
Sha1:   259b77350dfc6f3e56a18df26ea6aa16c03052fb
Sha256: b616540f35abaa124479b6e62f67b98a490008e93c55417a1ab18fed9d1f2983
                                        
                                            GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 4618
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (11126)
Size:   4618
Md5:    acdb97105af28a7066790c6748ae2e1e
Sha1:   65794d2c5a9d04f747faf370bc8bacd330e69e5a
Sha256: dc4efbc4b704b142b5313588c32e56ea56648068a01d2bc596a4eee06b379b5e

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-content/themes/sydney/js/main.min.js?ver=20180716 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 2937
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (8084), with no line terminators
Size:   2937
Md5:    3f404d5037a01a81c106616c8622dd4e
Sha1:   a734a56488c6365ae57ca14986af5e623ca5f646
Sha256: 936f05f008f5421149ad06caf61f6d7932809b051a54d1a2c9507d247540a1e4
                                        
                                            GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Tue, 20 Sep 2022 15:43:29 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 7621
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17819), with no line terminators
Size:   7621
Md5:    66c68f2158dcf7d97a02f3719a17aab0
Sha1:   fdb04fb4c632b9fb4275006a4e402cd0d4fa393a
Sha256: e4b360f0e6ae1afc06f05f958e8696e5ae45257912bc2ab0b9334bd1382a51aa
                                        
                                            GET /wp-content/uploads/so-css/so-css-sydney.css?ver=1672499783 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Sat, 31 Dec 2022 15:16:23 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 82
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   82
Md5:    2855c6d867cd59f5565f2c7f702ccbc2
Sha1:   516ab39b00a10532aca59fa5e966a74e8570cd4e
Sha256: 1a9df6c632060e1c1a2d9e7cafcc2394af4d4a50c39bb94f89719f42fa92d435

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Mon, 19 Sep 2022 14:16:24 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   39624
Md5:    8dd7202999f7626656e114f33cb46431
Sha1:   1715a0f9ac3516be59515c1ab285a83c9f2e5415
Sha256: af137bc31522abf954a51ec3d15e99391264e2c2c16989ab746d2257f55e1658

Blocklists:
  - fortinet: Malware
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-content/uploads/2018/07/LOGO-TimeHunter-Julio-2018.001.png HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: image/png
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: bytes
content-length: 86477
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1606 x 355, 8-bit/color RGBA, non-interlaced\012- data
Size:   86477
Md5:    63348c3973d4b56390f61d96d7616d46
Sha1:   46c727c79685459454ca0e1fcee9d3eeeadc81e2
Sha256: d9e4ec87ec7b8449f9c85b9839cc8b434c0d238319a2825f49e7359a4289ac77
                                        
                                            GET /css?family=Abel|Dosis|Montserrat HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.74
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 25 Mar 2023 23:05:24 GMT
date: Sat, 25 Mar 2023 23:05:24 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   1082
Md5:    b5008a8cffaedbdf05908aefb03a2744
Sha1:   692e352ad04a3c8a48f7b4ab934f9dbc59d1ae2a
Sha256: 4783e6d99c1c6e92f82a293e369d5056cee56b57379c88d6e71843841162c504
                                        
                                            GET /s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 13036
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Mar 2023 10:26:47 GMT
expires: Sat, 23 Mar 2024 10:26:47 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
age: 131917
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 13036, version 1.0\012- data
Size:   13036
Md5:    0ad032b3d07aaf33b160ac4799dda40f
Sha1:   06b931e0d0bf37f5037d9e66d6feedfddd21c0ba
Sha256: c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
                                        
                                            GET /s/raleway/v28/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46524
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Mar 2023 10:26:47 GMT
expires: Sat, 23 Mar 2024 10:26:47 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 18 Jul 2022 19:58:01 GMT
age: 131917
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 46524, version 1.0\012- data
Size:   46524
Md5:    c1fd378f54921c75e4ae1821e7b8fff6
Sha1:   2ce96e97783b2f154d07f4464ca6f8eb2469f2c1
Sha256: 405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
                                        
                                            GET /s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 13052
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Mar 2023 10:26:51 GMT
expires: Sat, 23 Mar 2024 10:26:51 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
age: 131913
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 13052, version 1.0\012- data
Size:   13052
Md5:    7cf79fbd1df848510d7352274efc2401
Sha1:   5540b5a26cc7dfe25294c4eabe011e2c6cd60143
Sha256: bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-content/themes/sydney/js/skip-link-focus-fix.js?ver=20130115 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 339
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   339
Md5:    2aaf3505d90d13e5cabc603852e4eac5
Sha1:   e4dcdc00d099b9d887842d07243685339ff3f17c
Sha256: c769d01d7d6bd3f43f802407cdbda09d8c52d665eab28b5e0fe16e04480ceb8d

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/plugins/wpcf7-redirect/build/js/wpcf7r-fe.js?ver=1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Tue, 07 Feb 2023 02:34:35 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 1987
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text
Size:   1987
Md5:    dbdb77c63dd28a8dd9f8f019d9ad54d1
Sha1:   dd3bea5b04778940916181f924389a5e7ab14c04
Sha256: e4d9f90a96396cb47de0c8945d70a7c50b2bb0befed3f6016cd443712a3cf7fb

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Mon, 11 Apr 2022 12:04:30 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 2675
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (6475), with no line terminators
Size:   2675
Md5:    45bd1d6f7fc3a4069fc6fd400b90c961
Sha1:   903c7e28c7141e9fc1bdb4dfc62d043a97a01e2d
Sha256: c638a0057b4be0a61cfb65b1860a855a327397e9871f5dde28fa2f138fb394dc

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Tue, 12 Apr 2022 05:56:23 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 5321
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (15660)
Size:   5321
Md5:    710f8b142ea44c0682dc2c30f318f065
Sha1:   49144e9b3a76d3d383b1d4359cf7a25e947f4233
Sha256: 708bb5819879a2a2c7670abc20a58cca68a415ffd621011cbc4c3c9d82dddc50

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.2 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Fri, 23 Sep 2022 19:55:30 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
content-length: 8344
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (8189)
Size:   8344
Md5:    838560e989767f2ef5951b9eeee20352
Sha1:   6bf8419cb4d68d9beced9e4b79b22b347ae16a46
Sha256: 72e6d275c5229613a59aef94523fc6a96330553976aee003d8544d5806fa0c3d
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  gzip compressed data, max compression\012- data
Size:   618
Md5:    8107b84ba895b6d7fd8502636e579a99
Sha1:   3c15260063023901a9f95b172d019df8df9b6793
Sha256: 87bf4a500a4fd67e802b8aeebaaf1fbafdf29ff463e1b4a335f218ba1af9f8b8

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/themes/sydney/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://timehunter.co/wp-content/themes/sydney/fonts/font-awesome.min.css?ver=6.1.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: font/woff2
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: bytes
content-length: 77160
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Size:   77160
Md5:    af7ae505a9eed503f8b8e6982036873e
Sha1:   d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
Sha256: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Blocklists:
  - fortinet: Malware
                                        
                                            GET /wp-content/uploads/2018/07/LOGO-TimeHunter-Reseller-Pipedrive-Julio-2018-2-768x112.png HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: image/png
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: bytes
content-length: 70441
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 768 x 112, 8-bit/color RGBA, non-interlaced\012- data
Size:   70441
Md5:    b5688747fb93c735cf968697c233a509
Sha1:   e104ebf73ba20268cac96b23c588447f5ee03f0b
Sha256: 185309abdd6c83afc98cef89344317e69696342ee6b125cd21842707843e795b
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:25 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.7.5.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                            
date: Sat, 25 Mar 2023 23:05:25 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /?sid=lAxoEaKWQBAaOYGd&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJVQS0xMDU1NTk0NTctMSJdLCJnYUNsaWVudElkcyI6W10sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNjAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly90aW1laHVudGVyLmNvL2R1bS91YmRxcXN1bWlhZWF1IiwicGFnZVRpdGxlIjoiUMOhZ2luYSBubyBlbmNvbnRyYWRhIC0gVGltZUh1bnRlciIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiMTA3OTExYjczZTAyZDQ0MyIsInNjcmlwdElkIjoibEF4b0VhS1dRQkFhT1lHZCIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuMDljYTg4ZDljZTNjOGE4Yy4xNjc5Nzg1NTM5MjczIiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0= HTTP/1.1 
Host: tr.lfeeder.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.96
HTTP/2 200 OK
content-type: image/gif
                                            
content-length: 43
server: CloudFront
date: Sat, 25 Mar 2023 23:05:25 GMT
x-cache: LambdaGeneratedResponse from cloudfront
via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 9fzqvlIS5iZjrrP1EE62RI_hUg4uKA56NNuy8U3uqUuoA9abuIayyg==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
                                        
                                            GET /recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: text/javascript
                                            
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 166058
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 20 Mar 2023 16:20:35 GMT
expires: Tue, 19 Mar 2024 16:20:35 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 20 Mar 2023 04:02:00 GMT
vary: Accept-Encoding
age: 456290
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with very long lines (597)
Size:   166058
Md5:    4043af37a3392a9db521ff9ab62d9608
Sha1:   83828688e7a2259ed2f77345851a16122383b422
Sha256: ee076822f35390ee382cda71759a2eec8f4db2bc18e4e3acd586173c29dab321
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             216.58.207.206
HTTP/2 200 OK
content-type: text/javascript
                                            
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20085
date: Sat, 25 Mar 2023 22:05:11 GMT
expires: Sun, 26 Mar 2023 00:05:11 GMT
cache-control: public, max-age=7200
age: 3614
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1490)
Size:   20085
Md5:    ca7fbbfd120e3e329633044190bbf134
Sha1:   d17f81e03dd827554ddd207ea081fb46b3415445
Sha256: 847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db
                                        
                                            GET /modules.936575bc1767492884db.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.79
HTTP/2 200 OK
content-type: application/javascript
                                            
content-length: 69056
date: Fri, 24 Mar 2023 15:40:07 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "d6165b54ac1bedfdf423823cc05855ac"
last-modified: Fri, 24 Mar 2023 15:39:54 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: FXeP3UKRRMqN_e1GunVNPcAV_9yKDxcBMrZC50BkyARigmUFboyn5w==
age: 113118
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (50842)
Size:   69056
Md5:    d6165b54ac1bedfdf423823cc05855ac
Sha1:   c59efe41c8303c4954af5b4fda66b06c54ca30f3
Sha256: 4008352d5fd357e2dc85ca061c490b16707e690bf74489ccb0cb72d2a792c701
                                        
                                            GET /wp-content/uploads/2018/07/cropped-Logos-Square-TimeHunter-Julio-2018-32x32.png HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Cookie: _lfa=LF1.1.09ca88d9ce3c8a8c.1679785539273
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: image/png
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: bytes
content-length: 713
date: Sat, 25 Mar 2023 23:05:25 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size:   713
Md5:    e6560943b446322eea1f02a0935b914e
Sha1:   c9ca36c7fd0658739b12c5999ceea314af37b9d4
Sha256: 8880c70021a1101ec8e1ef3cf078843a12c1d214eaf620a576c8d15c3b9e7b5f
                                        
                                            GET /lftracker_v1_lAxoEaKWQBAaOYGd.js HTTP/1.1 
Host: sc.lfeeder.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             143.204.55.127
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Wed, 22 Mar 2023 07:04:47 GMT
x-amz-version-id: 1FUY6jRYWHFytbKwcrqW8T9YRrQ3tBU4
server: AmazonS3
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:25 GMT
cache-control: max-age=3600
etag: W/"01000231fa1c8d16e06c5ce167780e89"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: sOT1kyydLMukXobRWI4BXomfQZ-USRKN3oSethogh2I_AzFu2n0ZLw==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   16382
Md5:    c16c439c1f25879c0b013741f76cb570
Sha1:   d365f809c47d4a2f79aeba04f86a53d0fcb08409
Sha256: c787a607a8df3d4f79e355d85699d2f5a83ca8214c8e8e3999a2890c4f068bf6
                                        
                                            GET /recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/styles__ltr.css HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: text/css
                                            
accept-ranges: bytes
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24605
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 20 Mar 2023 16:20:36 GMT
expires: Tue, 19 Mar 2024 16:20:36 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 20 Mar 2023 04:02:00 GMT
vary: Accept-Encoding
age: 456289
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (56403), with no line terminators
Size:   24605
Md5:    a42c6333a13e5376af95f46fd9c7b627
Sha1:   57a98e519a44915e39a0cb6f23812adfa6611e67
Sha256: 62bff9dd0379da44f9d7f739af671bb6b243c016b49c7146b431ae9e6b9cb41b
                                        
                                            GET /wp-includes/css/dist/block-library/style.min.css?ver=6.1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Fri, 11 Nov 2022 14:56:45 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (47826)
Size:   183725
Md5:    f6c9f8096cf8b2b8557754ce208cfd2d
Sha1:   0f1f5bec09c6d6716374b794018c1d7eff746a65
Sha256: e594cc6510c174938eea4171a7d81a58747768cdef3576cc9ba3e3ae81f77703
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-105559457-1&cid=1877594722.1679785539&jid=617097678&gjid=397027098&_gid=519941047.1679785539&_u=YEBAAUAAAAAAACAAI~&z=979454983 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             173.194.221.154
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin: https://timehunter.co
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 25 Mar 2023 23:05:25 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  very short file (no magic)
Size:   1
Md5:    c4ca4238a0b923820dcc509a6f75849b
Sha1:   356a192b7913b04c54574d18c28d46e6395428ab
Sha256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 25 Mar 2023 23:05:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /sessions/1229188?s=0.25&r=0.17788474073605076 HTTP/1.1 
Host: vc.hotjar.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.8
HTTP/2 204 No Content
                                            
access-control-allow-origin: *
cache-control: no-store
date: Sat, 25 Mar 2023 23:05:25 GMT
server: Python/3.8 aiohttp/3.8.4
x-cache: Miss from cloudfront
via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: PhWv7kkB4lWp3QiSbWp6dnHQTMuaQlL3WR-5Ih3pT_uVVNzhF2LQUw==
X-Firefox-Spdy: h2

                                        
                                            GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Mar 2023 10:26:44 GMT
expires: Sat, 23 Mar 2024 10:26:44 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
age: 131921
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Size:   15344
Md5:    5d4aeb4e5f5ef754e307d7ffaef688bd
Sha1:   06db651cdf354c64a7383ea9c77024ef4fb4cef8
Sha256: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
                                        
                                            GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Mar 2023 10:26:45 GMT
expires: Sat, 23 Mar 2024 10:26:45 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
age: 131920
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Size:   15552
Md5:    285467176f7fe6bb6a9c6873b3dad2cc
Sha1:   ea04e4ff5142ddd69307c183def721a160e0a64e
Sha256: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8723
Expires: Sun, 26 Mar 2023 01:30:48 GMT
Date: Sat, 25 Mar 2023 23:05:25 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "62A45C1BEDD4241448AB43B535518E423B0500901328B3A0B984D758C9B0540D"
Last-Modified: Fri, 24 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8723
Expires: Sun, 26 Mar 2023 01:30:48 GMT
Date: Sat, 25 Mar 2023 23:05:25 GMT
Connection: keep-alive

                                        
                                            GET /recaptcha/api2/logo_48.png HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/styles__ltr.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: image/png
                                            
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 2228
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 22 Mar 2023 18:05:11 GMT
expires: Wed, 29 Mar 2023 18:05:11 GMT
cache-control: public, max-age=604800
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
age: 277214
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size:   2228
Md5:    ef9941290c50cd3866e2ba6b793f010d
Sha1:   4736508c795667dcea21f8d864233031223b7832
Sha256: 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc872b459-32b1-4ecb-a595-95cee4c53ca4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12991
x-amzn-requestid: 16bc16bf-b87e-4ed7-a559-3e900595928e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CW1smH_kIAMF5oA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641f6983-21e7ce61788315866c752f28;Sampled=0
x-amzn-remapped-date: Sat, 25 Mar 2023 21:37:07 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 0XTrJJ-Z6-GCn2VJUUt8tqhvG4E8b_TYTBiDBu1Qr35g7THOqp5Zkg==
via: 1.1 4b800f7fa2c3fbb9f4f3c505b0df315e.cloudfront.net (CloudFront), 1.1 aabd01c4a20dae837d162bd972422efc.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 21:51:13 GMT
age: 4452
etag: "007758853c1d1605db69131eb50ff433a4da5f8c"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12991
Md5:    8e19767dbe464134f0ab81b0eadb98fa
Sha1:   007758853c1d1605db69131eb50ff433a4da5f8c
Sha256: 63f1f08cd038e7b6d3316bbdc59a598b01c3bedd1ef04ba1986152e239fa128c
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255e6a5a-97bb-4a35-8a48-4d120747a63c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4000
x-amzn-requestid: 68dc01d7-3eed-48f6-8532-8efaa96cc1ec
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CJpraEqyoAMFgNQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a2315-3852cc8961365a560d1fa02f;Sampled=0
x-amzn-remapped-date: Tue, 21 Mar 2023 21:35:17 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: Ncagzm12kJaHQtYhhjUUhcfXVfbwMdonoNYqpK-QXEmLfyyENgFnFA==
via: 1.1 288c777a01e22425da9494dad7a69734.cloudfront.net (CloudFront), 1.1 42ef990e439ae115ff739f04e3945234.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 08:51:06 GMT
age: 51259
etag: "b798268806dc2f79f033e5872676019faf0e0cc1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4000
Md5:    85351059b67b0a42eda7e69a31b3b4b4
Sha1:   b798268806dc2f79f033e5872676019faf0e0cc1
Sha256: 86e163b7159b197d6358ab01333ac6da221de0ebe1c5da8d5cef2977d38625fe
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3fb4d16c-eef2-49cc-ac24-b125a7d6d9e0.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 3589
x-amzn-requestid: 9c09af43-79e8-4734-b28b-4194e0bb1e4e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CW1uyE2joAMF50g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641f6991-7607d33f6301182b591c56e8;Sampled=0
x-amzn-remapped-date: Sat, 25 Mar 2023 21:37:21 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: Olik0rOopNpu03_GQWvvGeuS0D579nAdtuk9RGWUQSopMavKHDn1cQ==
via: 1.1 46673955829b59a6da0ab071e0b7fbea.cloudfront.net (CloudFront), 1.1 b48dedcc55e63f14261aa92cf2d61522.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 21:53:15 GMT
age: 4330
etag: "bf61369962342cce85de8f48942b4b150fd2721e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3589
Md5:    1ec08d4bd079a92161fc80f41281b5a9
Sha1:   bf61369962342cce85de8f48942b4b150fd2721e
Sha256: 8a8ed12c31d89d71c3cb88f0813ded83939529206461e917dcb0b8bc11abdda4
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa47e8d1c-6343-48dc-966b-71e83875b350.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7778
x-amzn-requestid: 5794fe13-ddf8-4a4d-86e3-53da34af0c98
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CW2QAF91IAMFoNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641f6a66-1f6247aa2651e9a35dbccec7;Sampled=0
x-amzn-remapped-date: Sat, 25 Mar 2023 21:40:54 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: ym5ku830id9iQl1QzIRpIo1jrMq7KILCx91VgOKApAkkDpEdLi_lug==
via: 1.1 02f1a759e4ec9fab6fc17c080dd851dc.cloudfront.net (CloudFront), 1.1 c9b161639a9353c2354b895548ea9fca.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 22:12:28 GMT
age: 3177
etag: "4242d3ff0a1ca9f76166585532a815c4b1f15175"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7778
Md5:    1782dd235045315ec9b8d127a4a61dfd
Sha1:   4242d3ff0a1ca9f76166585532a815c4b1f15175
Sha256: c404e097daf50098edf2d46b1d314fb2ab95f1d655293f0a9e123867fc11a982
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb3b49ab-f78e-4860-8aae-369eacfe43e3.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9486
x-amzn-requestid: b0324b5e-303e-485a-ae57-c001378aa401
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CW2eRHjaoAMF74w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641f6ac1-27f002da252bd7ee19802f3d;Sampled=0
x-amzn-remapped-date: Sat, 25 Mar 2023 21:42:25 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: UITJqHB2zehWwMWUVkWr9hpp5-c0IJgLmHvvpAj_UeM4fJgRP-feLA==
via: 1.1 185f4b03b711932fc7e735c08fdc5abe.cloudfront.net (CloudFront), 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 22:08:31 GMT
etag: "a53e0919923151e009e12010c60acb5a9175d37e"
age: 3414
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9486
Md5:    6530dbbc16d84b7047fa4bc66364fbf4
Sha1:   a53e0919923151e009e12010c60acb5a9175d37e
Sha256: e64a2699e763d75a068ee6ceafd4eb2a1922488dc2e052699fb4242f0bf20524
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F08d32734-eed8-49a0-b130-4b792c0776a7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9192
x-amzn-requestid: 973b7d1d-0726-4b07-bf31-f17f700950cc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CW1uKHYOoAMFrkQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641f698d-079fc061602811d02e9fa3a5;Sampled=0
x-amzn-remapped-date: Sat, 25 Mar 2023 21:37:17 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 9vrtImPAqDiD0Bso0YlkYkBjoSh2C5PtEA5T3BN9P71RsT4qQOVRPg==
via: 1.1 0a166b53605851fe961f5a2952e5a748.cloudfront.net (CloudFront), 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 google
date: Sat, 25 Mar 2023 21:52:09 GMT
age: 4396
etag: "83e31c1bda5551eb05d926bc4b16b7a2f5920ab0"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9192
Md5:    073d7b39a5d1d400fce97accc61209ea
Sha1:   83e31c1bda5551eb05d926bc4b16b7a2f5920ab0
Sha256: 3336340f79556f7effd3a56536e49d4951bc40447c4ef549af185d13900ec9cf
                                        
                                            POST / HTTP/1.1 
Host: ocsp.e2m02.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             54.230.80.227
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Content-Length: 280
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sat, 25 Mar 2023 23:05:25 GMT
Last-Modified: Sat, 25 Mar 2023 21:41:54 GMT
Server: ECAcc (nya/799C)
X-Cache: Miss from cloudfront
Via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: eHL_J4TtZzxltnFOfztpkKixKRKG5r7gDiPplzNoMQFtgNCfSLucNw==
Age: 5011

                                        
                                            GET /widget/bhsd13ru HTTP/1.1 
Host: widget.intercom.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.86
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
content-length: 3264
last-modified: Fri, 24 Mar 2023 15:33:19 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
x-amz-version-id: caM4P01qE.L7O8sG9el8Fc3SvcjPMR8J
accept-ranges: bytes
server: AmazonS3
date: Sat, 25 Mar 2023 22:46:32 GMT
cache-control: max-age=900, s-maxage=900, public
etag: "dc2c2c637e23a1d2873724f8ad56868b"
x-cache: Error from cloudfront
via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: OOFaUxJbAj8CTehcWk0TLXkmHAZSsQpDtvx5lmqM8oTSmlhFF3mB8A==
age: 1215
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8520), with no line terminators
Size:   3264
Md5:    dc2c2c637e23a1d2873724f8ad56868b
Sha1:   6b078c41490245f5765cb3055a06c284596f2160
Sha256: 7167cd34fb808e452a8cc9d58e95dfb5b37e2e4b1c9ca7e2f716679730cde14d
                                        
                                            GET /frame.30f5c391.js HTTP/1.1 
Host: js.intercomcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.118
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
content-length: 144148
last-modified: Fri, 24 Mar 2023 15:31:00 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
x-amz-version-id: Difkf8zUiqO.bPqMg69ii4ahy9qIbqKk
accept-ranges: bytes
server: AmazonS3
date: Sat, 25 Mar 2023 21:33:17 GMT
cache-control: max-age=31536000, s-maxage=7200, public
etag: "aca2285aea6dc17a29bd82dc22d66aa7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: Xf24HZcvs-vcP9qYfd3lyeVOL8yXVRgjPHPK7w30YHPsqeqD1XGldQ==
age: 5530
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   144148
Md5:    aca2285aea6dc17a29bd82dc22d66aa7
Sha1:   c66966a8016459ab3e58a7f9db3f5781c578ba24
Sha256: 540395cc3a24bd1a6639a6698d0dfd969963e4bf18d656a305df0a689deceeeb
                                        
                                            POST / HTTP/1.1 
Host: ocsp.r2m02.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             54.230.80.227
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=113989
Date: Sat, 25 Mar 2023 23:05:26 GMT
Etag: "641e818d-1d7"
Expires: Mon, 27 Mar 2023 06:45:15 GMT
Last-Modified: Sat, 25 Mar 2023 05:07:25 GMT
Server: ECAcc (bsa/EB6C)
X-Cache: Miss from cloudfront
Via: 1.1 5bcfe2deda0bdbc6bade0af9b61602ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 4F0fW6cJCon-OcUWCxK7iDaXn9-Pc6Dx_7pKbv2USX455Nd1YEsbJw==
Age: 5870

                                        
                                            POST / HTTP/1.1 
Host: ocsp.r2m01.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             54.230.80.227
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sat, 25 Mar 2023 23:05:26 GMT
Last-Modified: Sat, 25 Mar 2023 22:01:16 GMT
Server: ECAcc (nya/78C0)
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: f8fXE9VSOzZPTMerdLmbjjVb3fDdTF9dvGoFVYFngv8HfN0KQeg43g==
Age: 3850

                                        
                                            GET /vendor.c10557ba.js HTTP/1.1 
Host: js.intercomcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.118
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
content-length: 108559
last-modified: Fri, 24 Mar 2023 15:31:00 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
x-amz-version-id: E_6qWTZm0DMtXE27L0DzkXZaO9URt3Cf
accept-ranges: bytes
server: AmazonS3
date: Sat, 25 Mar 2023 22:27:06 GMT
cache-control: max-age=31536000, s-maxage=7200, public
etag: "cc56a94b9afbb9cd7d81037d8a2f39af"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: t97TR2Ikp8QHGbBPxpuxh0MLZR300l6ZpHfeIwQgSCGkAL9zDxHA8A==
age: 2301
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   175219
Md5:    ee3ad51b024bed6971d5e6e9047dc42e
Sha1:   ba8601126d87b0c3fcb591ea190697c4cd089762
Sha256: db47e763e564e76f1b9e2650738d97bdd2103ea68ac25714c16bb04634dd02db
                                        
                                            POST /messenger/web/ping HTTP/1.1 
Host: api-iam.intercom.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 505
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             18.234.2.45
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
date: Sat, 25 Mar 2023 23:05:27 GMT
status: 200 OK
cache-control: max-age=0, private, must-revalidate
x-ratelimit-limit: 13333
x-ratelimit-reset: 1679785530
strict-transport-security: max-age=31556952; includeSubDomains; preload
x-ratelimit-remaining: 13332
access-control-allow-origin: https://timehunter.co
vary: Accept,Accept-Encoding
x-intercom-version: 9df59f704468e2e0f1a049d5f24c6789b29188a9
x-xss-protection: 1; mode=block
content-encoding: gzip
x-request-id: 003216uau8jju6hkrqn0
access-control-allow-headers: Content-Type, Idempotency-Key, X-INTERCOM-APP, X-INTERCOM-PAGE-TITLE, X-INTERCOM-USER-DATA
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
etag: W/"206fc6f32723685ff91f2122940def3d"
x-runtime: 0.244307
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
server: nginx
x-ami-version: ami-087c2d0cb2ae07534
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   2075
Md5:    6a1bfb3eb85c1089816bfee69dbd4a99
Sha1:   503acf32bae113d5ea3543d717adacdb849989a8
Sha256: 6007027a490917f3c2a1307a935b9358a75da0dfdc1427f6f26c5109eca1d0cd
                                        
                                            GET /pubsub/5-4K_3Ckw4gOXrmP8jPo8GkK_4KyIcsYUrncqqgOJMf3NvZ4bSFuQTYRuek3ulrE15OG2HFBJ8rrpUPA4-to7bO6fQvCl6ZsQC3oXr?X-Nexus-New-Client=true&X-Nexus-Version=0.9.0&user_role=undefined HTTP/1.1 
Host: nexus-websocket-a.intercom.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://timehunter.co
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: sslU0H/Zv99u1SMhTHLrTQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             35.174.127.31
HTTP/1.1 101 Switching Protocols
                                            
Server: nginx
Date: Sat, 25 Mar 2023 23:05:27 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: TK4JrIczXgsr2qaZbWxWjint0Q8=
Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover; client_no_context_takeover

                                        
                                            GET /wp-content/themes/sydney/js/scripts.js?ver=6.1.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - fortinet: Malware
                                        
                                            POST /api/v2/client/sites/1229188/visit-data?sv=5 HTTP/1.1 
Host: in.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 112
Origin: https://timehunter.co
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             54.72.116.255
HTTP/2 200 OK
content-type: application/json
                                            
date: Sat, 25 Mar 2023 23:05:25 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /wp-content/uploads/pum/pum-site-scripts.js?defer&generated=1678373154&ver=1.18.1 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: application/javascript
                                            
last-modified: Thu, 09 Mar 2023 14:45:54 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /c/hotjar-1229188.js?sv=5 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.230.111.8
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Sat, 25 Mar 2023 23:05:25 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/cbae86eecbb64320e55c1685d761e5dd
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 1kk6Smah3pg8OSx6FCe9P2mg7_u7F4g0tLV0NpmaprFcRRESbuuIzw==
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /wp-content/themes/sydney/images/header.jpg HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: image/jpeg
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: bytes
content-length: 224142
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /css?family=Source+Sans+Pro%3A400%2C400italic%2C600%7CRaleway%3A400%2C500%2C600 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.74
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 25 Mar 2023 23:05:24 GMT
date: Sat, 25 Mar 2023 23:05:24 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /wp-content/themes/sydney/style.css?ver=20180710 HTTP/1.1 
Host: timehunter.co
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/dum/ubdqqsumiaeau
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             162.241.61.69
HTTP/2 200 OK
content-type: text/css
                                            
last-modified: Mon, 05 Sep 2022 20:08:40 GMT
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
date: Sat, 25 Mar 2023 23:05:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - fortinet: Malware
                                        
                                            GET /assets/loader.js HTTP/1.1 
Host: leadbooster-chat.pipedrive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://timehunter.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.18.188.228
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Sat, 25 Mar 2023 23:05:24 GMT
cf-ray: 7adacc66dd9b1bfa-OSL
access-control-allow-origin: *
cache-control: public, max-age=0
last-modified: Wed, 22 Mar 2023 10:39:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
cf-cache-status: MISS
access-control-expose-headers: X-RateLimit-Remaining, X-RateLimit-Limit, X-RateLimit-Reset
badi: Routing: lon-1=>lon-1; Version: a4c5; Host: 5f98b7886f-tm2r6;
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
expect-ct: max-age=0
referrer-policy: no-referrer
x-content-type-options: nosniff
x-correlation-id: 268a5516-9dfd-41c6-ab62-3afc234e3746
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0, 1; mode=block
set-cookie: __cf_bm=UlRYvUybfydVM87Z1J0yX1G9F0X39QYLTTm2KKny_a8-1679785524-0-AdDPw0YwlwOhP7et7Vvg61ObYPW/Ct5Mh8QQFUhRIzGF9ykUiXhjsBVSXbgxE5Nk2sQ/f9MwXcdQWj2WnxktxQc=; path=/; expires=Sat, 25-Mar-23 23:35:24 GMT; domain=.pipedrive.com; HttpOnly; Secure; SameSite=None
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: