r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3eb88dea4fe00db1182370e72683c3ab
ca520abf1e91bfd2aef40c6a1270a911071e8922
d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13102
Expires: Sat, 28 Jan 2023 22:57:54 GMT
Date: Sat, 28 Jan 2023 19:19:32 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a2104f935c638b4767ca5ae0d738ef23
85c6af15af749be0ceeae6de17c36925b750f166
5d4789a3696bd7faa9916768cb627bbc89bf70a756d80e53860cbac13c2bc8b1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5D4789A3696BD7FAA9916768CB627BBC89BF70A756D80E53860CBAC13C2BC8B1"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10644
Expires: Sat, 28 Jan 2023 22:16:56 GMT
Date: Sat, 28 Jan 2023 19:19:32 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Alert, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 28 Jan 2023 18:43:06 GMT
content-type: application/json
age: 2187
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 03092d1a1bc7ac91ee342a1a7ab2a562
52db06ce1fd2c74ddd36b6a0a7aee1b5c891600a
03b8ff2629abac9fc30ebec059c2e2018fcbc41646ad5f71c965ff630fbf1ffd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "03B8FF2629ABAC9FC30EBEC059C2E2018FCBC41646AD5F71C965FF630FBF1FFD"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7192
Expires: Sat, 28 Jan 2023 21:19:25 GMT
Date: Sat, 28 Jan 2023 19:19:33 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: bFFv+1BVQ6Snet7sbQ4EoxtE7tzSiF5iL4pHh1GE4VlENSlHEO/p6tFKykuSqLhY5EzDYcnQapk=
x-amz-request-id: 0GFD5GD38D0YGTZQ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 28 Jan 2023 18:50:01 GMT
age: 1772
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
1writtedr.com/mTryA990542f9e62830d053ebeb60b2dfc1e78b44b171?q=Blu%20M0vies%20AF%202.3_Elmo_SpydogCustomMobile_NoSplit.%E2%80%A6
200 OK 6.7 kB URL HTTP/1.1 1writtedr.com/mTryA990542f9e62830d053ebeb60b2dfc1e78b44b171?q=Blu%20M0vies%20AF%202.3_Elmo_SpydogCustomMobile_NoSplit.%E2%80%A6
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6739), with no line terminators
Hash 0da32b146be901936f868dc1c8af8374
cc651fb6af30f63cb6158ff06df62035a6b61e74
72f7c3f893d55a2cabd69ad147b5c50ed1054b6c185592cdb671b5fc13104908
GET /mTryA990542f9e62830d053ebeb60b2dfc1e78b44b171?q=Blu%20M0vies%20AF%202.3_Elmo_SpydogCustomMobile_NoSplit.%E2%80%A6 HTTP/1.1
Host: 1writtedr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 19:19:32 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: bd_context=R4HaAakG4VaVQKXAQgD3oEl2xPrztHedMuBDSGUrNEl09ugk4hBNU8EtOHy32NkxQcwmN7NfkYJMASODz/MPqu7GrrxEBrK6/GauxVL9PD1frafY7JwKWnHa0AbRMx80ZJp+4sw06L7jXgOLLJt2V2W1hAZTuRlORv3gSJ8+FmoIWf3/SFfJ4VEXNNly8Cbux5NMADnTP/FSwoNeyIzJOCvLqJmQoiHXcuvDJ54LofjLlmii3HzlBgsMdyzJZp3j9XDGVwLRkv4JACqbsc7VBIbA2AzcCklFs3qgztutY2Xq0eczAXcNxT758TDh29ClZhoNapl2sBwtOyLn4GmzMnGdF7c=; Expires=Sun, 28 Jan 2024 19:19:33 GMT
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 19:19:33 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
1writtedr.com/favicon.ico
200 OK 43 B URL HTTP/1.1 1writtedr.com/favicon.ico
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /favicon.ico HTTP/1.1
Host: 1writtedr.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://1writtedr.com/
Connection: keep-alive
Cookie: bd_context=R4HaAakG4VaVQKXAQgD3oEl2xPrztHedMuBDSGUrNEl09ugk4hBNU8EtOHy32NkxQcwmN7NfkYJMASODz/MPqu7GrrxEBrK6/GauxVL9PD1frafY7JwKWnHa0AbRMx80ZJp+4sw06L7jXgOLLJt2V2W1hAZTuRlORv3gSJ8+FmoIWf3/SFfJ4VEXNNly8Cbux5NMADnTP/FSwoNeyIzJOCvLqJmQoiHXcuvDJ54LofjLlmii3HzlBgsMdyzJZp3j9XDGVwLRkv4JACqbsc7VBIbA2AzcCklFs3qgztutY2Xq0eczAXcNxT758TDh29ClZhoNapl2sBwtOyLn4GmzMnGdF7c=
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 19:19:33 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ba5b96886aae11731ab2c7da2157725f
2a774af612701298f2d90884c89a9d3d36286759
b2060054472abd6dc52d9114d522644e7fcca319c91cabe86697361d944bf11d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B2060054472ABD6DC52D9114D522644E7FCCA319C91CABE86697361D944BF11D"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8017
Expires: Sat, 28 Jan 2023 21:33:10 GMT
Date: Sat, 28 Jan 2023 19:19:33 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Pragma, ETag, Retry-After, Content-Type, Content-Length, Expires, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 28 Jan 2023 18:41:40 GMT
age: 2273
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:33 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
jdx1a.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=1
200 OK 12 kB URL HTTP/2 jdx1a.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=1
IP
ASN #39572 DataWeb Global Group B.V.
Hash 4c596b835cab7221e5e1a64b768f3986
91da5f27ce8412d3c0822e7cdb4fd9d8622dcbd9
b0d98531ad2680717f39a37d2224c7f5fe55ce11d3cf54327a71d8675eebdfdb
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=1 HTTP/1.1
Host: jdx1a.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://czgovd.com/
Cookie: truniq=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:33 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
jdx1a.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 jdx1a.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: jdx1a.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jdx1a.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=1
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:33 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 87a411ae7e5829df53ece0e29a0fd017
55ba83eba9864c13f8859cc8864adae8f10ea334
183b5027adba3b89d6524735147e2f83312a0e6a75cf52ff4d48a73c671abba4
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "183B5027ADBA3B89D6524735147E2F83312A0E6A75CF52FF4D48A73C671ABBA4"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2916
Expires: Sat, 28 Jan 2023 20:08:10 GMT
Date: Sat, 28 Jan 2023 19:19:34 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 87a411ae7e5829df53ece0e29a0fd017
55ba83eba9864c13f8859cc8864adae8f10ea334
183b5027adba3b89d6524735147e2f83312a0e6a75cf52ff4d48a73c671abba4
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "183B5027ADBA3B89D6524735147E2F83312A0E6A75CF52FF4D48A73C671ABBA4"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2916
Expires: Sat, 28 Jan 2023 20:08:10 GMT
Date: Sat, 28 Jan 2023 19:19:34 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: P8XXsCf/gwxYmQWBrbcqag==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: jtYR6Y/6K+8Hs49VS58nMjbxyNM=
b6k1c.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 b6k1c.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: b6k1c.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://b6k1c.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=2
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
t5n17.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 t5n17.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: t5n17.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t5n17.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=3
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2
eyklp.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 eyklp.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: eyklp.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://eyklp.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=4
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:35 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
b6k1c.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=2
200 OK 37 kB URL HTTP/2 b6k1c.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=2
IP
ASN #39572 DataWeb Global Group B.V.
Hash d0b91f860e3d2b675f4a88c0bcb26aa8
2fc00bbe7ae7f4dbeed331601ae1303f89665b33
b7f7e71453be9c64082fbe75fe0b6cfbd227d9aef1a59ed8029c3100fb0d2a56
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=2 HTTP/1.1
Host: b6k1c.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jdx1a.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 28 Jan 2023 21:21:12 GMT
Date: Sat, 28 Jan 2023 19:19:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 28 Jan 2023 21:21:12 GMT
Date: Sat, 28 Jan 2023 19:19:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 28 Jan 2023 21:21:12 GMT
Date: Sat, 28 Jan 2023 19:19:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 28 Jan 2023 21:21:12 GMT
Date: Sat, 28 Jan 2023 19:19:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7297
Expires: Sat, 28 Jan 2023 21:21:12 GMT
Date: Sat, 28 Jan 2023 19:19:35 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b7a0759c043594fbe85af422b59b8227
a05cfaad16078f42218dae233da38f6f5dff8487
e898d6ef1b3998fb9322a8fc190069ec5f7b3582bfe8397a2367497d84a27549
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11568
x-amzn-requestid: 2e85f75e-ab9d-4d45-adad-7313950a9647
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fSWbxGwnoAMFejw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d0d117-68f1a9e71a07a0453311fd32;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 06:49:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: dbz3wXGNaetf6xvRE98rshyHy-FVfDo8co-4VDL0a4Qe3E4U8A82Og==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 18:36:06 GMT
age: 2609
etag: "a05cfaad16078f42218dae233da38f6f5dff8487"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
2pidn.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=5
200 OK 20 kB URL HTTP/2 2pidn.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=5
IP
ASN #39572 DataWeb Global Group B.V.
Hash c20f6a931dfe82bfa9b0de67f6b14610
cae1aa88f7fbe810f9afa31785599f07c7e50cf7
8ecb585645cca44bb9aa27c032de4e5ab4443995cf1f797c1398f2df3c2f1f44
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=5 HTTP/1.1
Host: 2pidn.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://eyklp.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ea24bcba583bd8bd139559448a343e68
b9d37c2b14f890d41983a59f352e8f7caa9c94bb
e5ef5975eec964ae1684deb424f00833f2d217bdc7e6c385320ed3adeb6bc1c4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7585
x-amzn-requestid: bfb52acb-e0d7-482d-8be9-be5db1c16cac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_vkE5roAMF0Hw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d44663-2d38d314177e0ac40d4c8240;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:47:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 1WE1zQwrCGVy8HLT9_BFkAr6rQE_ROyttMOByR32KeT0w2Hd_ylvYQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:16:00 GMT
age: 75815
etag: "b9d37c2b14f890d41983a59f352e8f7caa9c94bb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f884785-3b60-4d1a-b7b9-f58e73d6d819.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f884785-3b60-4d1a-b7b9-f58e73d6d819.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b4afa01d2ffe17f8378e4c0b5afd4608
f5c7e2137efa07a207427a6b6fe1df541f85ea25
84fc0c05d25d674b5594b54720017332b86d391f66c7136d76cfce3e884e8e12
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f884785-3b60-4d1a-b7b9-f58e73d6d819.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13375
x-amzn-requestid: 372fcbe8-85a1-4be2-a006-31fb9289c5e9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-CxF6BoAMFyGg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443ab-4b9860545c612cc416cbe599;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: yEFlWGi3J14JLA0l2h02VlIqV8opHesKP6GOvfoP5Tp0m7dOYDxIGA==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:59:32 GMT
age: 76803
etag: "f5c7e2137efa07a207427a6b6fe1df541f85ea25"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 195316042e7f798eeeb7993fecb3a383
4aeca24ad4702f87feaf9674ea0c1ff6d71826a3
b7e0a61060455241fce844d2c91eca500d409804361063ddb61053cbc9c7b1c1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13376
x-amzn-requestid: 64d0092e-1f1a-4183-a4a6-805e0bf37d32
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-DvHIyoAMF6fA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443b1-6387770232ddca74531bce91;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Jqb6G21QeTDiI0HWT9Fd87D-HkAOiesyfN9vr7vMxrOUADBxV-_Fug==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:55:42 GMT
age: 77033
etag: "4aeca24ad4702f87feaf9674ea0c1ff6d71826a3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb12df7-074b-4044-bdbe-0e07bccbc8e9.jpeg
200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb12df7-074b-4044-bdbe-0e07bccbc8e9.jpeg
IP
Hash 8e3fafb721fee69e30bc2a03e67ece4c
62b5f0f089b562216df655e7ee3da4c146f60c7e
400cd7420c5af40cca211bb4c48b0da4017847d34462c0db5bd6162f5645d7a5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb12df7-074b-4044-bdbe-0e07bccbc8e9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12397
x-amzn-requestid: e8436997-696d-483a-b03a-a84e7ca614ea
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_T5HbzoAMFXsw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445b2-1c2ccd0a187d0a3e2f6a59cc;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:44:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: lmLHc8fKQYUpq9B-GyOQ0FKzhxi0ToTEPA7cu6JnQftgDFDNV8USvw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:37 GMT
age: 76978
etag: "62493ca03be9870aac2341e033611a6d56bd322a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
h1gt2.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 h1gt2.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: h1gt2.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://h1gt2.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=6
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:35 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
t5n17.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=3
200 OK 29 kB URL HTTP/2 t5n17.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=3
IP
ASN #39572 DataWeb Global Group B.V.
Hash 682000a41788d9af4d4b3561ae6aa59c
2bfbde5076282147120e24d814e65d9812b40f8b
32dfc92a361e2c7ad22c1b2ef8d6f1f1b27c637e9e7f65edd1d571d48af50cb5
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=3 HTTP/1.1
Host: t5n17.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://b6k1c.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu4
content-encoding: gzip
X-Firefox-Spdy: h2
bor61.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 bor61.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: bor61.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bor61.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=8
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:36 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2
7kbzd.czgovd.com/images/bot.png
200 OK 14 kB URL HTTP/2 7kbzd.czgovd.com/images/bot.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 460 x 145, 8-bit colormap, non-interlaced\012- data
Hash 7805f0839d6287816dd977e11d900d74
b03ca287261623f0b6e4732f83d233f01cf90272
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
GET /images/bot.png HTTP/1.1
Host: 7kbzd.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://7kbzd.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:36 GMT
content-type: image/png
content-length: 13792
last-modified: Fri, 25 Nov 2022 08:33:14 GMT
etag: "63807dca-35e0"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2
azkcqs.com/rpe?a=1&s=1&act=7&src=2&p=1138759&st=1177780&wd=407557&d=czgovd.com&tpl=2&rnd=0.7988768700204364&sbid=342222&sbid2=
200 OK 0 B URL HTTP/2 azkcqs.com/rpe?a=1&s=1&act=7&src=2&p=1138759&st=1177780&wd=407557&d=czgovd.com&tpl=2&rnd=0.7988768700204364&sbid=342222&sbid2=
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rpe?a=1&s=1&act=7&src=2&p=1138759&st=1177780&wd=407557&d=czgovd.com&tpl=2&rnd=0.7988768700204364&sbid=342222&sbid2= HTTP/1.1
Host: azkcqs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://7kbzd.czgovd.com
Connection: keep-alive
Referer: https://7kbzd.czgovd.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 28 Jan 2023 19:19:36 GMT
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c905425cf4450198eab507a1d36bdff2
f6179c49765dd0e54d180d961d58a4349880a3bc
02ee1824dfb6b149a84ee306785b4a34af19aaa716aa23d87700ccf2b56da82c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "02EE1824DFB6B149A84EE306785B4A34AF19AAA716AA23D87700CCF2B56DA82C"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17052
Expires: Sun, 29 Jan 2023 00:03:49 GMT
Date: Sat, 28 Jan 2023 19:19:37 GMT
Connection: keep-alive
tratbc.com/tb?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9
302 Found 0 B URL HTTP/1.1 tratbc.com/tb?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9
IP
ASN #14061 DIGITALOCEAN-ASN
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tb?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9 HTTP/1.1
Host: tratbc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://7kbzd.czgovd.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.15.0
Date: Sat, 28 Jan 2023 19:19:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://n33d0nem0re.com/ptb/AER11WPOOAUAWFcCAE5PFwAMALL_qpQA
X-Zone: eu
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 97b2be1134894c74793dc524491c5f3f
4c6af9072a0833e2d8a877f20298b96a2661146e
c0da61884e766c07312223f483e2bcc65839ce6f77185f727f0136fdae927a8a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C0DA61884E766C07312223F483E2BCC65839CE6F77185F727F0136FDAE927A8A"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15998
Expires: Sat, 28 Jan 2023 23:46:15 GMT
Date: Sat, 28 Jan 2023 19:19:37 GMT
Connection: keep-alive
n33d0nem0re.com/favicon.ico
200 OK 43 B URL HTTP/2 n33d0nem0re.com/favicon.ico
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /favicon.ico HTTP/1.1
Host: n33d0nem0re.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://n33d0nem0re.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 19:19:37 GMT
content-type: image/gif
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
X-Firefox-Spdy: h2
7kbzd.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9
200 OK 17 kB URL HTTP/2 7kbzd.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9
IP
ASN #39572 DataWeb Global Group B.V.
Hash 3bae507ca2fda512f484cbe07089d719
ba9e9040d65b4da8690e81e0490586e54a462bad
2b4d1baec627a2c001bb91711a5af5e12724866864911d8ed62911d56753b6ac
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=9 HTTP/1.1
Host: 7kbzd.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bor61.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash f6c69d6d1e89e40e43f1230a59561232
cd6123e0f4cd308f8bddb34bc127ff1c22da9ead
31e19dd333f228cf500570de04d827a1c996ce9b6b50dc7308e222fdf3c368e8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "31E19DD333F228CF500570DE04D827A1C996CE9B6B50DC7308E222FDF3C368E8"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7625
Expires: Sat, 28 Jan 2023 21:26:42 GMT
Date: Sat, 28 Jan 2023 19:19:37 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 4.3 kB IP
ASN #20940 Akamai International B.V.
Hash d53da6d5af8ddaddf9884001da34655f
cc8ec7e2df547574fdfdfb992c9aefa1b9cb3a99
f0461d65bb0a890175c2d8513912c0658bdef44c651b97c70d291acfe43a4060
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "31E19DD333F228CF500570DE04D827A1C996CE9B6B50DC7308E222FDF3C368E8"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7625
Expires: Sat, 28 Jan 2023 21:26:42 GMT
Date: Sat, 28 Jan 2023 19:19:37 GMT
Connection: keep-alive
czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA
200 OK 0 B URL HTTP/2 czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA HTTP/1.1
Host: czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://1writtedr.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:33 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: truniq=1; expires=Sun, 29-Jan-2023 19:19:33 GMT; Max-Age=86400; path=/; domain=czgovd.com
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
ulmoyc.com/v1/sdk.js?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6MiwicG0iOjJ9eyJ&d=czgovd.com&tpl=2&pbd=iOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsImNsaWNraWQiOiJBRVIxMVdQT09BVUFXRmNDQUU1UEZ3QU1BTExfcXBRQSIsInNpMSI6IjM0MjIyMiIsImFfdGIiOiJodHRwOlwvXC85a2JrZnNmOTkubW9uc3RlclwvYj90b2tlbj01NmNkMGQzZDE5Y2NkZjY0ZTY4YTVmOGE1YzAyZDdiYjczNTkyOTQzJmM9QUVSMTFXUE9PQVVBV0ZjQ0FFNVBGd0FNQUxMX3FwUUEiLCJpIjoiMSJ9eyJwaWQ
200 OK 0 B URL HTTP/2 ulmoyc.com/v1/sdk.js?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6MiwicG0iOjJ9eyJ&d=czgovd.com&tpl=2&pbd=iOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsImNsaWNraWQiOiJBRVIxMVdQT09BVUFXRmNDQUU1UEZ3QU1BTExfcXBRQSIsInNpMSI6IjM0MjIyMiIsImFfdGIiOiJodHRwOlwvXC85a2JrZnNmOTkubW9uc3RlclwvYj90b2tlbj01NmNkMGQzZDE5Y2NkZjY0ZTY4YTVmOGE1YzAyZDdiYjczNTkyOTQzJmM9QUVSMTFXUE9PQVVBV0ZjQ0FFNVBGd0FNQUxMX3FwUUEiLCJpIjoiMSJ9eyJwaWQ
IP
GET /v1/sdk.js?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6MiwicG0iOjJ9eyJ&d=czgovd.com&tpl=2&pbd=iOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsImNsaWNraWQiOiJBRVIxMVdQT09BVUFXRmNDQUU1UEZ3QU1BTExfcXBRQSIsInNpMSI6IjM0MjIyMiIsImFfdGIiOiJodHRwOlwvXC85a2JrZnNmOTkubW9uc3RlclwvYj90b2tlbj01NmNkMGQzZDE5Y2NkZjY0ZTY4YTVmOGE1YzAyZDdiYjczNTkyOTQzJmM9QUVSMTFXUE9PQVVBV0ZjQ0FFNVBGd0FNQUxMX3FwUUEiLCJpIjoiMSJ9eyJwaWQ HTTP/1.1
Host: ulmoyc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jdx1a.czgovd.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-origin: https://czgovd.com
etag: W/"RMDJmnfZiaimTIZGaiFEB6uI4XY"
x-zone: eu
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bjAhVWpBwwTzgVjWqT2gWNcoNxsBW1kAq43%2FX8RKBq26PF%2Fd8AoRkaLsfF4J9UsDliQ6%2Fr1E4b2VqlJq5cw2BJDhkj8uxpr0F25Dvyu8kKok%2Blkc6FvfVg17OLQA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790c14964e11b50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ulmoyc.com/fp.js?d=jdx1a.czgovd.com
200 OK 0 B URL HTTP/2 ulmoyc.com/fp.js?d=jdx1a.czgovd.com
IP
GET /fp.js?d=jdx1a.czgovd.com HTTP/1.1
Host: ulmoyc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jdx1a.czgovd.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 28 Jan 2023 19:19:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=14400
max-age: 0
access-control-allow-origin: https://jdx1a.czgovd.com
x-zone: eu
last-modified: Sat, 28 Jan 2023 19:19:34 GMT
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XND8ocXhzYgqAyOkTWX%2Bn2iiEsXLtqYZhzgE7eKX97NEqtm77N4rh16HY9pVhJ5Z4HPzjKoh5W17Y%2FhM7%2FNGmAJDNK3mqQ36VultuyOkJaW2L5hpm01bZHJLdQex"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790c1496beadb50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
h1gt2.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=6
200 OK 0 B URL HTTP/2 h1gt2.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=6
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=6 HTTP/1.1
Host: h1gt2.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://2pidn.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu
content-encoding: gzip
X-Firefox-Spdy: h2
flymylife.info/push.js?b=40
200 OK 0 B URL HTTP/2 flymylife.info/push.js?b=40
IP
GET /push.js?b=40 HTTP/1.1
Host: flymylife.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tradeinfo35.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 28 Jan 2023 19:19:37 GMT
content-type: application/javascript
last-modified: Wed, 04 Jan 2023 23:57:46 GMT
etag: W/"63b6127a-5953"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1050
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6kpggkiiPkGcVyIuspEWk2kvkramGdpXzPdxSLsyP34MKHtDwDNjMy1q7OHFdoJaNECmOLrT7ijhbhMSWVXbKOgXZt5C5NYXen3qV8KLx8kFrQe7bQTiPpd5mSL2ErRj1w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 790c14ac1bae1c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
so12t.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=7
200 OK 0 B URL HTTP/2 so12t.czgovd.com/bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=7
IP
ASN #39572 DataWeb Global Group B.V.
GET /bot-check?h=waWQiOjExMzg3NTksInNpZCI6MTE3Nzc4MCwid2lkIjo0MDc1NTcsInNyYyI6Mn0=eyJ&clickid=AER11WPOOAUAWFcCAE5PFwAMALL_qpQA&si1=342222&a_tb=http%3A%2F%2F9kbkfsf99.monster%2Fb%3Ftoken%3D56cd0d3d19ccdf64e68a5f8a5c02d7bb73592943%26c%3DAER11WPOOAUAWFcCAE5PFwAMALL_qpQA&i=7 HTTP/1.1
Host: so12t.czgovd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://h1gt2.czgovd.com/
Cookie: truniq=1; ufp2=7cb78e65c40956f1fbc4c758d1993b85d9898ea7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.21.1
date: Sat, 28 Jan 2023 19:19:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-zone: eu3
content-encoding: gzip
X-Firefox-Spdy: h2
n33d0nem0re.com/ptb/AER11WPOOAUAWFcCAE5PFwAMALL_qpQA
200 OK 0 B URL HTTP/2 n33d0nem0re.com/ptb/AER11WPOOAUAWFcCAE5PFwAMALL_qpQA
IP
Analyzer Verdict Alert fortinet Malware
GET /ptb/AER11WPOOAUAWFcCAE5PFwAMALL_qpQA HTTP/1.1
Host: n33d0nem0re.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://7kbzd.czgovd.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 19:19:36 GMT
content-type: text/html; charset=utf-8
set-cookie: bd_context=c7AoNlGZhkRgwLXRHAOHt5q7LX07z+bLP7OBfOVdNQ+fhDVIHT5/OGqRJ9N9gLYiGcNKPNln6Oe//mqU4FOv5C0pCtvcPtMo1mi21GlgCpJWxP4zbsrQS2ZIIm/1NI2ZyaTl3uMZYvb7DRcZfgVvhhrvef8vI01vGkRQbnLN3K9/sI+CGM7wX6zshL5ySDuhEORh+LI8XfmS/HbgdjrS09Wursfd8cqHG6oZrLwdLX+MC8l53JArioWuHNpgpoUc7zd4X4mtk2PBLuhjriA51t47mQT+czxrI+/g8+wA/orZX4bKFA6TYLiBPNYfCfvGZa2OFJ46MiRNqRJeaD/OlJACkA==; Expires=Sun, 28 Jan 2024 19:19:37 GMT
X-Firefox-Spdy: h2
188.72.236.136
23.36.77.32
35.241.9.150
188.114.97.1
104.21.60.139
185.162.85.19