kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
301 Moved Permanently 0 B URL HTTP/1.1 kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html HTTP/1.1
Host: kuroviral.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Tue, 24 Jan 2023 23:34:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 25 Jan 2023 00:34:26 GMT
Location: https://kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GEJEjgo6zbOflE9HQAnFnSK%2B9QkM0EfOU7UqSkzkDfFSFiKgH0bvq6HsCWOWzq2kpAlBp9K1uZSiZ1vPT73Zj6mrNMoyfwBAY22l3dxUcDONiTL0MojMSPe4UL9tcOI6"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 78ec946d09b0b512-OSL
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f416977a8d6dfaafb2dbfd0e68b871f8
dfa97bd829b03162de91c80133f2fde69b58a8d2
2c4d0fd1b7a6d398026a4817267adce203429acdd3defa44a879f0d945f392d5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2C4D0FD1B7A6D398026A4817267ADCE203429ACDD3DEFA44A879F0D945F392D5"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5040
Expires: Wed, 25 Jan 2023 00:58:26 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0be6cec5607bb65c06dbadd33456aec1
9d13129e936eb5fc82e403931884cdc8c6e6ab92
cb028034340b709ece65e45e8fc1a26a64dd85926beaa542f308d3f1d5ee2c84
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CB028034340B709ECE65E45E8FC1A26A64DD85926BEAA542F308D3F1D5EE2C84"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21025
Expires: Wed, 25 Jan 2023 05:24:51 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Alert, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 24 Jan 2023 22:42:45 GMT
content-type: application/json
age: 3101
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 31c8743c2b5202ce0228bac5aad7229b
4b5eee8e1ecbfc992505003be58e265ff3a0ee0a
8b3b47ea29fc02b8a08ee2a340a05ab23e391f0eb3b8d6beb17516706bb2e94d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B3B47EA29FC02B8A08EE2A340A05AB23E391F0EB3B8D6BEB17516706BB2E94D"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6616
Expires: Wed, 25 Jan 2023 01:24:42 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: TW0nUJXc/YiAgAgH+5PFMY40fgrllbi9H/7t/CtAHAQCxjTtQCtZk1xMHI0Qk7uQNefLKWm0SBM=
x-amz-request-id: QRYQ76QKY9B0T7BQ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 24 Jan 2023 22:48:20 GMT
age: 2766
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 4623d8fa7e2bdd4786b9adcb5e9a1f89
2e75234d5019b7150df17c0f7405539a675b8e3f
eef9a3b4130d24e8a01d01cd7713d23dc05a95f1736309f6bc96e2b9148f5db6
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EEF9A3B4130D24E8A01D01CD7713D23DC05A95F1736309F6BC96E2B9148F5DB6"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20852
Expires: Wed, 25 Jan 2023 05:21:58 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:26 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 4623d8fa7e2bdd4786b9adcb5e9a1f89
2e75234d5019b7150df17c0f7405539a675b8e3f
eef9a3b4130d24e8a01d01cd7713d23dc05a95f1736309f6bc96e2b9148f5db6
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EEF9A3B4130D24E8A01D01CD7713D23DC05A95F1736309F6BC96E2B9148F5DB6"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20852
Expires: Wed, 25 Jan 2023 05:21:58 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 1.6 kB IP
Hash 9f2df02ade351085ecdc77eeb4ba7035
8d1eba10d88ea5efd500ac05136dd68cd85c7e8b
782d39c6f222f582a0a6a44860b5f3d2f719b2072b44acafdda7a5dbee662048
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 24 Jan 2023 23:17:31 GMT
age: 1015
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5bd0d25343636802f0b7f41cb016ba2d
5809723996903d8190bc741dc61bdea004979f57
79a28ae86371679afccde6820ad79696859093d4bbf057a1434affc2361460e5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "79A28AE86371679AFCCDE6820AD79696859093D4BBF057A1434AFFC2361460E5"
Last-Modified: Mon, 23 Jan 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4554
Expires: Wed, 25 Jan 2023 00:50:20 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c398b6b39d11d25b8ae9bc5cd94a1c98
640aa8c399ced71d0c2a9f5a90fbaf091b01d642
a6f07f7c6a4746acc25457c726701df33120628dfb578bc4982448d8efee5855
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A6F07F7C6A4746ACC25457C726701DF33120628DFB578BC4982448D8EFEE5855"
Last-Modified: Tue, 24 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11299
Expires: Wed, 25 Jan 2023 02:42:45 GMT
Date: Tue, 24 Jan 2023 23:34:26 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1005c9e99dc8d4390861d6730c7a403b
0e3858ae26a1c01e0160e3b60e400bea202ebd05
4ff7ceb81a3dad4fefd3a15ece4ce13898624c01bf5a0cb4fdd90958978ed6b9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
200 OK 21 kB URL HTTP/2 fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 21224, version 1.0\012- data
Hash 13bdfb843f942ccd9f485eb6c0bc1934
2bad44362ff7569f24f2a3df2521b27a97ec1297
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
GET /s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 21224
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 19 Jan 2023 13:04:09 GMT
expires: Fri, 19 Jan 2024 13:04:09 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 19 Apr 2022 18:04:18 GMT
content-type: font/woff2
age: 469818
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
200 OK 22 kB URL HTTP/2 fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 22376, version 1.0\012- data
Hash e6af16165f9bfda6aafd0088b8c01daa
c9c0ee8309619643e65ba1b22bfffcd1a7ca1e51
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
GET /s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 22376
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 19 Jan 2023 06:40:57 GMT
expires: Fri, 19 Jan 2024 06:40:57 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 19 Apr 2022 18:25:01 GMT
content-type: font/woff2
age: 492810
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
boustahe.com/zone?pub=0&zone_id=5507411&is_mobile=false&domain=kuroviral.com&var=&ymid=&var_3=
200 OK 664 B URL HTTP/2 boustahe.com/zone?pub=0&zone_id=5507411&is_mobile=false&domain=kuroviral.com&var=&ymid=&var_3=
IP
File type JSON data\012- , ASCII text, with very long lines (663)
Hash fb84ce75cdcf8d2df73e3351c3834dba
7408e224c82b7a360ff5b60bad3070c201b9be01
928d4bfa544655a186dc58e1e93d75c9973b637b48733f18e0e9c48dbb3286d0
GET /zone?pub=0&zone_id=5507411&is_mobile=false&domain=kuroviral.com&var=&ymid=&var_3= HTTP/1.1
Host: boustahe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kuroviral.com/
Origin: https://kuroviral.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:27 GMT
content-type: application/json; charset=utf-8
content-length: 664
x-trace-id: 1c01e9ecf5022e89e1725ded44e49189
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: PWcWOrVsQfL95SLIdJi4/w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: o1kLgeaXgcQ9nneNlz5eOUX33EM=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 23e863f063d6186bbaf198b09bb905b3
8df0384c2a43f1a5127a7419aaf757b505012490
a6921b61caca4e8c8a41e6282a3c554fc9efecead926e4c13e3362bb7a44e93a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A6921B61CACA4E8C8A41E6282A3C554FC9EFECEAD926E4C13E3362BB7A44E93A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15691
Expires: Wed, 25 Jan 2023 03:55:58 GMT
Date: Tue, 24 Jan 2023 23:34:27 GMT
Connection: keep-alive
js.juicyads.com/jp.php?c=34b413v2v284u4q2w2b4236494&u=https%3A%2F%2Fbit.ly%2F3fUsHj2
200 OK 93 kB URL HTTP/2 js.juicyads.com/jp.php?c=34b413v2v284u4q2w2b4236494&u=https%3A%2F%2Fbit.ly%2F3fUsHj2
IP
File type ASCII text, with very long lines (65533)
Hash 1743b8d069de302034ade8086feda0b2
e1f226c35b4b651ba2f928111e08e5e6061e44ac
f8b41ceae819bb36df611e408f55a8ef682be013ad21df28db5cb7b04361edb8
GET /jp.php?c=34b413v2v284u4q2w2b4236494&u=https%3A%2F%2Fbit.ly%2F3fUsHj2 HTTP/1.1
Host: js.juicyads.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
cache-control: max-age=900
date: Tue, 24 Jan 2023 23:34:16 GMT
expires: Tue, 24 Jan 2023 23:49:16 GMT
pragma: cache
server: nginx
x-cache: Hit from cloudfront
via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: u4fmRsO8t7bcxTmW5F_g8zFlpPoOxnZIKNx2GeSu2Wt0T6GENPii7g==
age: 11
X-Firefox-Spdy: h2
boustahe.com/custom
200 OK 39 B IP
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: boustahe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kuroviral.com/
Content-Type: application/json
Origin: https://kuroviral.com
Content-Length: 454
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:27 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 7f54221675d05a4b814a856313f9ce8a
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
pl17888748.profitablegatetocontent.com/cf/db/b8/cfdbb88d62ae998fea3e97de0be38a29.js
200 OK 21 kB URL HTTP/1.1 pl17888748.profitablegatetocontent.com/cf/db/b8/cfdbb88d62ae998fea3e97de0be38a29.js
IP
File type HTML document, ASCII text, with very long lines (60133), with no line terminators
Hash d7470bb5b7bc5461bd2f265f9a027e6f
670d271086870c75cb8e641abedf3af122ac4a0a
5bfa0e0cbd01f3fc56eefcb78d9006c9c539e80bcab875c7b4be1c85ff356641
Analyzer Verdict Alert quad9 Sinkholed
GET /cf/db/b8/cfdbb88d62ae998fea3e97de0be38a29.js HTTP/1.1
Host: pl17888748.profitablegatetocontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:27 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cceb1461ed123aa053eaa28bf856cb05
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
pl17888922.profitablegatetocontent.com/ac/74/55/ac74553746a8a849877e6854572c9c47.js
200 OK 13 kB URL HTTP/1.1 pl17888922.profitablegatetocontent.com/ac/74/55/ac74553746a8a849877e6854572c9c47.js
IP
ASN #39572 DataWeb Global Group B.V.
File type ASCII text, with very long lines (37119), with no line terminators
Hash 39ff3ca96cbf0d82660f75642da34004
7807fd731123b33770016d4b4416a8f3cea7b905
90a762dc0219667baf2556adc006ab7c4e3456dd5bf91f7ae6686cb24a9dbd09
Analyzer Verdict Alert quad9 Sinkholed
GET /ac/74/55/ac74553746a8a849877e6854572c9c47.js HTTP/1.1
Host: pl17888922.profitablegatetocontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Tue, 24 Jan 2023 23:34:27 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1336efe5fdaca896e7b105f1ffe0d340
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUHBsia1paBfsGqQ7l1iqIhWL0ac10HDvlx9SZP15PiVuEypK5Cibqcg3j2cOMfPCqEsIQ7Qj0QdbntsVfmJjZtmBVD1x4SsbR9HUlUvUuOChX4nUPGglxrlE0epPY87C4Ri_op4JbhE1w34qbByrg083338O2_xjr6BZEWDbPZe5nCfaJMmkJfc6vGw/s320/Screenshot_91.jpg
200 OK 12 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUHBsia1paBfsGqQ7l1iqIhWL0ac10HDvlx9SZP15PiVuEypK5Cibqcg3j2cOMfPCqEsIQ7Qj0QdbntsVfmJjZtmBVD1x4SsbR9HUlUvUuOChX4nUPGglxrlE0epPY87C4Ri_op4JbhE1w34qbByrg083338O2_xjr6BZEWDbPZe5nCfaJMmkJfc6vGw/s320/Screenshot_91.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 178x320, components 3\012- data
Hash 78c4ce3e65e1c20fb34e574088e9eddc
27467587497ddab359511714cbc2c53727732038
a196dd1b696a78cb27c3261b90c0ae4f04c9112ae70a8a5855a12c6985d22a34
GET /img/b/R29vZ2xl/AVvXsEgUHBsia1paBfsGqQ7l1iqIhWL0ac10HDvlx9SZP15PiVuEypK5Cibqcg3j2cOMfPCqEsIQ7Qj0QdbntsVfmJjZtmBVD1x4SsbR9HUlUvUuOChX4nUPGglxrlE0epPY87C4Ri_op4JbhE1w34qbByrg083338O2_xjr6BZEWDbPZe5nCfaJMmkJfc6vGw/s320/Screenshot_91.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1cd"
expires: Wed, 25 Jan 2023 23:34:27 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_91.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:27 GMT
server: fife
content-length: 12060
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ0C5rlvWNvEshhsjPQhPg_0xRq60RMB7CMQws1gKuiyPFqFQhYh1bN4fEyLgAJq0OuRPDkIstYpgKyRAzQforFQr3gyeJpjMp7IYWevS4jzyWbp0-Sjiuc7R0D0piR8XNGyeunQCi_LqmYmmRYkww1JYGAXkHOh2MroRktLgLvED4TKu2J-qP1l2gcA/s320/Screenshot_79.jpg
200 OK 11 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ0C5rlvWNvEshhsjPQhPg_0xRq60RMB7CMQws1gKuiyPFqFQhYh1bN4fEyLgAJq0OuRPDkIstYpgKyRAzQforFQr3gyeJpjMp7IYWevS4jzyWbp0-Sjiuc7R0D0piR8XNGyeunQCi_LqmYmmRYkww1JYGAXkHOh2MroRktLgLvED4TKu2J-qP1l2gcA/s320/Screenshot_79.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x226, components 3\012- data
Hash e2188a9a45f96320554d0440bac5c72e
02c7ffc207274b67240b575c7d6f445be31da6bb
156c7a05d9b01517eaf0fa2ec537156e24e948b8e89483db429131c429484a13
GET /img/b/R29vZ2xl/AVvXsEhZ0C5rlvWNvEshhsjPQhPg_0xRq60RMB7CMQws1gKuiyPFqFQhYh1bN4fEyLgAJq0OuRPDkIstYpgKyRAzQforFQr3gyeJpjMp7IYWevS4jzyWbp0-Sjiuc7R0D0piR8XNGyeunQCi_LqmYmmRYkww1JYGAXkHOh2MroRktLgLvED4TKu2J-qP1l2gcA/s320/Screenshot_79.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1f8"
expires: Wed, 25 Jan 2023 23:34:27 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_79.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:27 GMT
server: fife
content-length: 11422
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoewig76osSI8TYkiWPrLo5bDb_zpLcj18SjxEcoC4VLewg8h19JVl9nPWkVFv36v_Kpu1lyp8qoeE7yHVDHIqlojHpk7u2sDIPEltmBlZvLmcfsL49ugezIYClytwIzf1yia-_v7jTjYi2cPJ7tOykkid-fzhOeaqbqiuXhDEwoSKdKcilPe9YHMk-g/s320/Screenshot_141.jpg
200 OK 28 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoewig76osSI8TYkiWPrLo5bDb_zpLcj18SjxEcoC4VLewg8h19JVl9nPWkVFv36v_Kpu1lyp8qoeE7yHVDHIqlojHpk7u2sDIPEltmBlZvLmcfsL49ugezIYClytwIzf1yia-_v7jTjYi2cPJ7tOykkid-fzhOeaqbqiuXhDEwoSKdKcilPe9YHMk-g/s320/Screenshot_141.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 246x320, components 3\012- data
Hash 449bf7ef72d02193d8cb433ac2e87139
11424eb80a51a327548702def4df3d493bbcc509
3e2b63a3491375747efc72e29ebb3925ea9d0229d09cd1b89044936f205b51e4
GET /img/b/R29vZ2xl/AVvXsEjoewig76osSI8TYkiWPrLo5bDb_zpLcj18SjxEcoC4VLewg8h19JVl9nPWkVFv36v_Kpu1lyp8qoeE7yHVDHIqlojHpk7u2sDIPEltmBlZvLmcfsL49ugezIYClytwIzf1yia-_v7jTjYi2cPJ7tOykkid-fzhOeaqbqiuXhDEwoSKdKcilPe9YHMk-g/s320/Screenshot_141.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "vd5"
expires: Wed, 25 Jan 2023 23:34:27 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_141.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:27 GMT
server: fife
content-length: 28481
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJIOldUvLtrMs19Q5V_bGyXBsx2k7gmDt_DOce_voqYqhy46oPJpPXU-X7uFBbbaeTv1LjY1Ekatb5MIojrtIWznndX_PnTdgaDuExC7mI17_bT_mT6m_zeOqTHWKffd-dgrUfzF0Rk8sr915cwQ7moDqonpRsnnFGGgakrJ74vjqiCPqHffq82U9_cQ/s320/Screenshot_88.jpg
200 OK 14 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJIOldUvLtrMs19Q5V_bGyXBsx2k7gmDt_DOce_voqYqhy46oPJpPXU-X7uFBbbaeTv1LjY1Ekatb5MIojrtIWznndX_PnTdgaDuExC7mI17_bT_mT6m_zeOqTHWKffd-dgrUfzF0Rk8sr915cwQ7moDqonpRsnnFGGgakrJ74vjqiCPqHffq82U9_cQ/s320/Screenshot_88.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x181, components 3\012- data
Hash 8c27a5de7ad671ef158906dfa4646d5d
6d0c6900f2227c4578dbb766b35f3f7fbb72ed46
aabeab3776ba812f54a69526b3fa65567238de7d79319b21c2513806ce1712ca
GET /img/b/R29vZ2xl/AVvXsEiJIOldUvLtrMs19Q5V_bGyXBsx2k7gmDt_DOce_voqYqhy46oPJpPXU-X7uFBbbaeTv1LjY1Ekatb5MIojrtIWznndX_PnTdgaDuExC7mI17_bT_mT6m_zeOqTHWKffd-dgrUfzF0Rk8sr915cwQ7moDqonpRsnnFGGgakrJ74vjqiCPqHffq82U9_cQ/s320/Screenshot_88.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1d0"
expires: Wed, 25 Jan 2023 23:34:27 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_88.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:27 GMT
server: fife
content-length: 13807
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLqWO1C84BM-n7Cjiw67l3thD5uD_fQmpZxn8To3YWk2ORzOLU11kJjYwBcPMMBpjDQXEIYDRKeogjjuXK3p82TB2u5elgHC1u5wyCG-PeLvadXXb8S2SlfmOGJBg6ewajF1Jg2BldpgTjYO3xhSQRvRaZufpvayw_dcONTUgR79OfFjwIpaqm94JtQA/s320/Screenshot_201.jpg
200 OK 14 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLqWO1C84BM-n7Cjiw67l3thD5uD_fQmpZxn8To3YWk2ORzOLU11kJjYwBcPMMBpjDQXEIYDRKeogjjuXK3p82TB2u5elgHC1u5wyCG-PeLvadXXb8S2SlfmOGJBg6ewajF1Jg2BldpgTjYO3xhSQRvRaZufpvayw_dcONTUgR79OfFjwIpaqm94JtQA/s320/Screenshot_201.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x193, components 3\012- data
Hash 1ede966bcea758512baa61a5c1fc04c8
b393bb0066e2d44fd0f398d6edbeb90ecff6a5a9
6b6dae0b665ea7414c7a12818d18cc478d12ea7caa18e8aafc1502e6b8fe3302
GET /img/b/R29vZ2xl/AVvXsEjLqWO1C84BM-n7Cjiw67l3thD5uD_fQmpZxn8To3YWk2ORzOLU11kJjYwBcPMMBpjDQXEIYDRKeogjjuXK3p82TB2u5elgHC1u5wyCG-PeLvadXXb8S2SlfmOGJBg6ewajF1Jg2BldpgTjYO3xhSQRvRaZufpvayw_dcONTUgR79OfFjwIpaqm94JtQA/s320/Screenshot_201.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1ea"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_201.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 13472
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3zaw9hF3ogI3T3oPD5zFLFe5OQEAL2BxfrBdXclepmdVUIYkZEKi9Rf1jTL56b5KJM6X0g3AYSo79SRkISrIz_zj18E3OMxNVbPopfZ8743tEPnhvbFe4dfA2A8TIlo1fySgVXHX9YIsKTQg246ktwe5dn7HBt3oGZKy-ORdHKevPvplYgpjQuoefPA/s320/Screenshot_203.jpg
200 OK 14 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3zaw9hF3ogI3T3oPD5zFLFe5OQEAL2BxfrBdXclepmdVUIYkZEKi9Rf1jTL56b5KJM6X0g3AYSo79SRkISrIz_zj18E3OMxNVbPopfZ8743tEPnhvbFe4dfA2A8TIlo1fySgVXHX9YIsKTQg246ktwe5dn7HBt3oGZKy-ORdHKevPvplYgpjQuoefPA/s320/Screenshot_203.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x239, components 3\012- data
Hash 566a3173f4d0c161050d5b92e10c5570
00885a849a114bfe873a9d8ccdaadd43872cee6d
3d794b51b87bf0ebe25af90c7f12bac2ec67803cf3095979ff8633f0cfdc2781
GET /img/b/R29vZ2xl/AVvXsEh3zaw9hF3ogI3T3oPD5zFLFe5OQEAL2BxfrBdXclepmdVUIYkZEKi9Rf1jTL56b5KJM6X0g3AYSo79SRkISrIz_zj18E3OMxNVbPopfZ8743tEPnhvbFe4dfA2A8TIlo1fySgVXHX9YIsKTQg246ktwe5dn7HBt3oGZKy-ORdHKevPvplYgpjQuoefPA/s320/Screenshot_203.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1ed"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_203.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 13872
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr52dwso-kvcKKksHJbzryA45GstZfhBPd7blsrBXijocyiRn6IAURbUHv8p2-zwwVLQkY5rUFogIJ1PuZYtW00lI8GqFg_hWnkeoRUiCdtvz7nSa3vVKObOJAPFRMMs4hUrm71OuZJNcgKyYoKySGe2_8HP6Gkt2oJ6GQTZrcP3FMBtwFQPXDojZQGA/s320/Screenshot_142%20copy.JPG
200 OK 33 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr52dwso-kvcKKksHJbzryA45GstZfhBPd7blsrBXijocyiRn6IAURbUHv8p2-zwwVLQkY5rUFogIJ1PuZYtW00lI8GqFg_hWnkeoRUiCdtvz7nSa3vVKObOJAPFRMMs4hUrm71OuZJNcgKyYoKySGe2_8HP6Gkt2oJ6GQTZrcP3FMBtwFQPXDojZQGA/s320/Screenshot_142%20copy.JPG
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x232, components 3\012- data
Hash 9157f24c32a01aefa6493177ac54014f
35989bb47068c01780088b5af7308e4a3a02969d
d5596554540fbd08f7874a0c02bc013f978efaacdd22100f17004ce06c1ec185
GET /img/b/R29vZ2xl/AVvXsEjr52dwso-kvcKKksHJbzryA45GstZfhBPd7blsrBXijocyiRn6IAURbUHv8p2-zwwVLQkY5rUFogIJ1PuZYtW00lI8GqFg_hWnkeoRUiCdtvz7nSa3vVKObOJAPFRMMs4hUrm71OuZJNcgKyYoKySGe2_8HP6Gkt2oJ6GQTZrcP3FMBtwFQPXDojZQGA/s320/Screenshot_142%20copy.JPG HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "vd6"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_142 copy.JPG"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 33074
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1U4YxCF24mvx5JvjJV7CfvtOJACBQLZ2Dbe0EGn7kgjPjK_QHygikhJkI-4CTD_NuCpcpmZWHx_QFHY8vkvrW5ynu6zCXKt7fPthdKAs4879TU_IqenmOM37Qdj2eTSTB-GkCpgamM9HBBkijxYGXilgGK3yX6s4yqaV_a57XAcG9qvCUoxbx1b2L/s320/Ice%20Spice.jpg
200 OK 16 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1U4YxCF24mvx5JvjJV7CfvtOJACBQLZ2Dbe0EGn7kgjPjK_QHygikhJkI-4CTD_NuCpcpmZWHx_QFHY8vkvrW5ynu6zCXKt7fPthdKAs4879TU_IqenmOM37Qdj2eTSTB-GkCpgamM9HBBkijxYGXilgGK3yX6s4yqaV_a57XAcG9qvCUoxbx1b2L/s320/Ice%20Spice.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x295, components 3\012- data
Hash ee85fb0f060e1db29df16fb3b0f0c263
21a11228b2df9b3ee08d0aa022969e808e67e972
b2754af84ee984195751f67a8255bcc01ca88ec875d98e6e886ad34b2a139b40
GET /img/b/R29vZ2xl/AVvXsEg1U4YxCF24mvx5JvjJV7CfvtOJACBQLZ2Dbe0EGn7kgjPjK_QHygikhJkI-4CTD_NuCpcpmZWHx_QFHY8vkvrW5ynu6zCXKt7fPthdKAs4879TU_IqenmOM37Qdj2eTSTB-GkCpgamM9HBBkijxYGXilgGK3yX6s4yqaV_a57XAcG9qvCUoxbx1b2L/s320/Ice%20Spice.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v69d"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Ice Spice.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 15738
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvFbXtBZoDCPA_K71a5t1tHfInx-xSOuxka-GLBe_r4UQ1tGbsJQXrsNbvEpn5y47jCEdGz1mm5oKm1KR-TAqFNPPNsG1wOhOPjkT3Xf0BLqe-mQh9smydrS7BTt7vciOxdSnUde-T5HFHPwolpWGXWiXi7Bwn61v6yw9S7nn_Ux8Fawso54_V7qPkvQ/s320/Screenshot_205.jpg
200 OK 9.7 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvFbXtBZoDCPA_K71a5t1tHfInx-xSOuxka-GLBe_r4UQ1tGbsJQXrsNbvEpn5y47jCEdGz1mm5oKm1KR-TAqFNPPNsG1wOhOPjkT3Xf0BLqe-mQh9smydrS7BTt7vciOxdSnUde-T5HFHPwolpWGXWiXi7Bwn61v6yw9S7nn_Ux8Fawso54_V7qPkvQ/s320/Screenshot_205.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x208, components 3\012- data
Hash 444b83af477ec833db7f7442b5f0ce7c
92462cf22550a96151f69ff9f01af23739f3ef93
e96630995075e48a9d21fc988f2f4d3d4074fcc032e660dc740570da28ea7a4c
GET /img/b/R29vZ2xl/AVvXsEhvFbXtBZoDCPA_K71a5t1tHfInx-xSOuxka-GLBe_r4UQ1tGbsJQXrsNbvEpn5y47jCEdGz1mm5oKm1KR-TAqFNPPNsG1wOhOPjkT3Xf0BLqe-mQh9smydrS7BTt7vciOxdSnUde-T5HFHPwolpWGXWiXi7Bwn61v6yw9S7nn_Ux8Fawso54_V7qPkvQ/s320/Screenshot_205.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v1ee"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_205.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 9721
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 93af086c11908f25c43c0bd730ca1fd1
75f2cbb9c6d8aeb54145293cafa5404cc3489389
7169b0c49ea8e410f5ec7fb0fd01d0df35251e52057612bfcdff4b88e81b12f6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie0cFTqTkJenTQHpq5-G9xNun1FOSmT9ltxXvE0VK_Ed4aTs9zOWw2JxxyfuzlQDKe7fyUXX2oEcwftV4yqmE6VxAgnQ8G38SUMkAN81q8SVL5noAmq9fePQH-aeK3qENYjttDA1DubXuhikuRbPGhD1Ty6hsnQDSVibpl0c1s0YeZIhnTWuoYGxG_JQ/s320/Screenshot_2.jpg
200 OK 9.4 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie0cFTqTkJenTQHpq5-G9xNun1FOSmT9ltxXvE0VK_Ed4aTs9zOWw2JxxyfuzlQDKe7fyUXX2oEcwftV4yqmE6VxAgnQ8G38SUMkAN81q8SVL5noAmq9fePQH-aeK3qENYjttDA1DubXuhikuRbPGhD1Ty6hsnQDSVibpl0c1s0YeZIhnTWuoYGxG_JQ/s320/Screenshot_2.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x186, components 3\012- data
Hash c08dfd61374aa5e3934ef460d317afba
40385aa31f1937dfd56da266cf0574e0a20d71a1
8e99dc9298fbdea3d0f66c3e47637fc272f3c423e0604e3e444bd5e63b951a85
GET /img/b/R29vZ2xl/AVvXsEie0cFTqTkJenTQHpq5-G9xNun1FOSmT9ltxXvE0VK_Ed4aTs9zOWw2JxxyfuzlQDKe7fyUXX2oEcwftV4yqmE6VxAgnQ8G38SUMkAN81q8SVL5noAmq9fePQH-aeK3qENYjttDA1DubXuhikuRbPGhD1Ty6hsnQDSVibpl0c1s0YeZIhnTWuoYGxG_JQ/s320/Screenshot_2.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v228"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_2.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 9406
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg3opbBPxGYJ3GOt9ytxBd6PeK52VR1N2RWV6cJy_Y6pw_yx_TK-rdc4H9j78DhadrNYhzoxA48h1XAD2PE8lo4NU5_4wckpEy0Tc_r1sGUw3ojW53QeIBJz-IKmigp2g7cWN3S5FgeNv2W3WltoX7LAUQYiTWduuj_t5p0mFwrLY5ln2Wvi1glYq1/s320/is.jpg
200 OK 13 kB URL HTTP/2 blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg3opbBPxGYJ3GOt9ytxBd6PeK52VR1N2RWV6cJy_Y6pw_yx_TK-rdc4H9j78DhadrNYhzoxA48h1XAD2PE8lo4NU5_4wckpEy0Tc_r1sGUw3ojW53QeIBJz-IKmigp2g7cWN3S5FgeNv2W3WltoX7LAUQYiTWduuj_t5p0mFwrLY5ln2Wvi1glYq1/s320/is.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x316, components 3\012- data
Hash ca16777dfbffa27b70aa0a8a2ed837f5
4beba9c32fd416b6bc25172dad3f1c2a8e4dc242
2a397e0f68ef971d27d19bb723e81b0ef77f16f2888654031ad34de4f0d4819e
GET /img/b/R29vZ2xl/AVvXsEhg3opbBPxGYJ3GOt9ytxBd6PeK52VR1N2RWV6cJy_Y6pw_yx_TK-rdc4H9j78DhadrNYhzoxA48h1XAD2PE8lo4NU5_4wckpEy0Tc_r1sGUw3ojW53QeIBJz-IKmigp2g7cWN3S5FgeNv2W3WltoX7LAUQYiTWduuj_t5p0mFwrLY5ln2Wvi1glYq1/s320/is.jpg HTTP/1.1
Host: blogger.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
etag: "v27b"
expires: Wed, 25 Jan 2023 23:34:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="is.jpg"
content-type: image/jpeg
vary: Origin
x-content-type-options: nosniff
date: Tue, 24 Jan 2023 23:34:28 GMT
server: fife
content-length: 12951
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 23f4b01a430ac3cd131f4b0afadbc101
f523c41c49e2fa293046770278341bf9e85b02b3
d89e48ee244a88b167102bbd865e00b0407715100cb9f8b94595270869abd926
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "D89E48EE244A88B167102BBD865E00B0407715100CB9F8B94595270869ABD926"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7271
Expires: Wed, 25 Jan 2023 01:35:39 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fe92992ce784bcdb95a74c01034e4afc
aad627e0dba4b27165498b11a3d064f417ca55dc
046eb09a133d249fb3fe8cbd629281570cfb6fb9af1e3c65ffa9aeb3cae9fe27
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "046EB09A133D249FB3FE8CBD629281570CFB6FB9AF1E3C65FFA9AEB3CAE9FE27"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10534
Expires: Wed, 25 Jan 2023 02:30:02 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 7ea193c0fb24472033bb42013fdd4ca3
012639b98dd940b23a0e83a141ccd4de00bc6a10
8c0b4376d1fdfe469cfc43ebe18e79f55805fc775152547f2dc068ad6f21a9a3
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=142640
Date: Tue, 24 Jan 2023 23:34:28 GMT
Etag: "63cfdda0-1d7"
Expires: Thu, 26 Jan 2023 15:11:48 GMT
Last-Modified: Tue, 24 Jan 2023 13:31:12 GMT
Server: ECS (bsa/EB1F)
X-Cache: Miss from cloudfront
Via: 1.1 193a8c13b6e0a6b90db7172f6358335e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: j4AhJ3Vk1L4CW6htyhlOCo5MAOiAb6QC0vs7f87-i2tp0XVkt18bRQ==
Age: 6036
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 7ea193c0fb24472033bb42013fdd4ca3
012639b98dd940b23a0e83a141ccd4de00bc6a10
8c0b4376d1fdfe469cfc43ebe18e79f55805fc775152547f2dc068ad6f21a9a3
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 24 Jan 2023 23:34:28 GMT
Etag: "63cfdda0-1d7"
Last-Modified: Tue, 24 Jan 2023 22:16:50 GMT
Server: ECS (dcb/7F3B)
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: xO7jMCVS72dkeP3T9N6cVn2SUHrY7ueccQe0_kwaIe-W9ckGa4JPaw==
Age: 4658
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash 1ab119e6497d004825a5e68b85ef73c7
94197ba0fc03b0b89b35c76dfb2673547d47702e
243a414ccbf26ce168508e727411f0ce14f37efbea9e85d6d2d9ea21c3065412
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
set-cookie: uid_id2=e75bab59-60c9-4b42-8301-42f01262f567:3:1; expires=Fri, 21 Jan 2033 23:34:28 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash e0faad01e94cba41deb63596b6c281a2
e4322008729e48fbd8e61f892678d50fd1648a97
84ff713dfaa1d41f7485bee9c394aac5c74873a0a9b8e15c5d1cfb0d88af7641
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
set-cookie: uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Fri, 21 Jan 2033 23:34:28 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0d5b6107537a6941603952e8ce5630a7
6f3b548e49f0d69fcb629781cf392eefe22d62ae
37f80f1cc1e032172a761d2cbfc8f8945627bc452eb13b20a8c03d92027d835f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "37F80F1CC1E032172A761D2CBFC8F8945627BC452EB13B20A8C03D92027D835F"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4237
Expires: Wed, 25 Jan 2023 00:45:05 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash 23f4b01a430ac3cd131f4b0afadbc101
f523c41c49e2fa293046770278341bf9e85b02b3
d89e48ee244a88b167102bbd865e00b0407715100cb9f8b94595270869abd926
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "D89E48EE244A88B167102BBD865E00B0407715100CB9F8B94595270869ABD926"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7271
Expires: Wed, 25 Jan 2023 01:35:39 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1efa8c61f9db8e0ec1774f0b1baecdea
08ba8067d89579803e286e5b7ae649b8cfc6db2e
5b08ce2e19047ede80f7ea622c2e1785e5ee8fb2400e88682229cd82dfb3c95a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5B08CE2E19047EDE80F7EA622C2E1785E5EE8FB2400E88682229CD82DFB3C95A"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9033
Expires: Wed, 25 Jan 2023 02:05:01 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2894
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
inklinkor.com/tag.min.js
200 OK 53 kB IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 7b4f1f73df1cfa727097197f0dd343b8
e5e91c006fa03b99fc8ee4ddb427c2b4fc51bbb6
bfa6c82083e5a75c7f6961d847a44c235b37067a3814482123b62328b3729253
GET /tag.min.js HTTP/1.1
Host: inklinkor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: text/javascript; charset=utf-8
x-trace-id: 05fe2df655b2b5878fb1313db041ea53
cache-control: max-age=86400
last-modified: Mon, 23 Jan 2023 15:50:55 GMT
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
expires: Wed, 25 Jan 2023 22:26:59 GMT
timing-allow-origin: *
cf-cache-status: HIT
age: 4049
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RiD9dCXrFZW1IWhVNO2p7qBlRr86gEEgtrNlA7aSUBnOGxwv3qsxDXsMOBfzP1R5UJ7YEtzVEDtcLtjE6ufqFPnD6Etq%2FYIIyL2209lxV0jqcgFCnlnsJe5NC%2FmntZbb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec9479beeab4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2894
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2894
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2894
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F409361f2-a546-44d7-82d6-d496f6ee134d.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F409361f2-a546-44d7-82d6-d496f6ee134d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4cb7be12333fa7ea3353901b4b3215af
4b758cc432874384f330568177eef5a328d7e69a
d6f86c0ddbabd5c4fd7cee72ce4da62ccddd9d29139c9ab033bb1ab8425bae22
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F409361f2-a546-44d7-82d6-d496f6ee134d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11918
x-amzn-requestid: ff47dd24-004f-4cc7-acfb-283b2e751f23
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fEqxwEyWoAMF3gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cb580b-1e95f74b0846080f75a757f6;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 03:12:11 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ntW_cYMwX6UWInGOxxPlwnV1AJh46X-hiLvwggRz9oa1Yno6jyE51g==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 03:28:47 GMT
age: 72341
etag: "4b758cc432874384f330568177eef5a328d7e69a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a487590-ad87-4af1-8dd1-f65f36af5bc9.jpeg
200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a487590-ad87-4af1-8dd1-f65f36af5bc9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a65fb960c9da18a5b0b0301ebf46afbe
87ec376bfb94f098e3c116b39661bc204479300c
7811aac796f07106cdc371444964407b4b7941fe9422e239867869f5f1bf9097
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a487590-ad87-4af1-8dd1-f65f36af5bc9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9482
x-amzn-requestid: ec84cb38-2bed-4fea-b40c-a9244a3d2784
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLQeFHn5oAMFrBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cdfac0-789b23531d15da8b50e3cbe9;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 03:10:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: AwZKaKI2B_SfNzYVjwjV8ftgVbLs6UOvvyT1eA7E4EURkwZwoDw3lg==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 04:04:27 GMT
age: 70201
etag: "87ec376bfb94f098e3c116b39661bc204479300c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7da858f1-3099-4d35-9bf6-fae2a155404c.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7da858f1-3099-4d35-9bf6-fae2a155404c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 05ff19472d4870833d7c6b495099a86c
6ad7424d14301c62a93ea71843238d2ff0699a02
1f2c62b3be1147d1ed12d1e28caa86c97684d5c5da87ebe3a709ce01cd878abb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7da858f1-3099-4d35-9bf6-fae2a155404c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8676
x-amzn-requestid: 15ae46cb-c80e-4b94-a8d3-8e2a83be64c8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLQdAG2BoAMFbOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cdfab9-236ebb6b3fab6b25266203ba;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 03:10:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: YO8uR9kaLR894rl-O2X1kRf0Z2kTK-B0SMUEe3k-_n9xvJWsi5Mo1A==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 04:03:08 GMT
age: 70280
etag: "6ad7424d14301c62a93ea71843238d2ff0699a02"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2130ca0-4287-4def-9d97-00fdb518ced4.jpeg
200 OK 7.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2130ca0-4287-4def-9d97-00fdb518ced4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6254fc1aaa5fbb1d87114b5b28d52c40
8d7bd3af0b9bfc3d3eb2751cb1ba211169eaefe8
866e0b364026754b2a88d73da5ccabf5b5df59fb75bc60b3aa5c66e8322ee764
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2130ca0-4287-4def-9d97-00fdb518ced4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7691
x-amzn-requestid: ee5858ec-ae6b-4a83-81f0-84903bea9786
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLP5HGwRIAMF2Lw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cdf9d3-1b9f899e1d9e9ba67adbeeac;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 03:06:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 59rOv8-DhAIGQx240tISV3X6FskvU33S-4LVzv8fP45qQilEpp2VwQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 04:11:23 GMT
age: 69785
etag: "8d7bd3af0b9bfc3d3eb2751cb1ba211169eaefe8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F302c83f3-fc0d-4aa1-a74b-ca3da86a6193.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F302c83f3-fc0d-4aa1-a74b-ca3da86a6193.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6bb86eb4c771d04fbe14536002327ee2
2ce08b3000a62157a4c39b4857a818dc53841757
436ea54ad85871bafde614cbbbdd0b79fe7f583826935190258ff7c26b84e22d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F302c83f3-fc0d-4aa1-a74b-ca3da86a6193.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11443
x-amzn-requestid: 305a8be0-f495-4c5c-a09e-1129ce9022fd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fH9BfF3ZoAMFXKw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cca86f-542ef19e000475b61a066bf9;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 03:07:27 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 66xBs5YKPG_IJqmZLF4LpYoKg40G-q-yEW092BS0OefGY3DIdXs3sA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 08:26:56 GMT
age: 54452
etag: "2ce08b3000a62157a4c39b4857a818dc53841757"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d0e7609-9fe9-4d8e-8e5d-d900bbac3bcf.webp
200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d0e7609-9fe9-4d8e-8e5d-d900bbac3bcf.webp
IP
Hash 9479fc08cf2f413887ec18517f5bdeb3
0561b42937cac3ab0b95932672ecb88b67049a2b
a789490202fa9ccff58a3e723f13c80e2e9c9e52c44b3dd0dc135aaf3b00290c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d0e7609-9fe9-4d8e-8e5d-d900bbac3bcf.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9343
x-amzn-requestid: 5786e270-1aae-45e2-b406-ad9ce4e90c20
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fHH8hEcBIAMFyjA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cc5383-3b3fb6220035b4e34db73fee;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 21:05:07 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ffDYSL3N0ZZ2vGX3d94Evnu0SeEkLWwv4HRHdyUYXQ19MstDR4jROA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 09:16:45 GMT
age: 51463
etag: "4934319819697b4c89466949cd4ef93bb8b9c8b2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
my.rtmark.net/gid.js?userId=69b453bf96004695a6dd8df21721d2ed
200 OK 65 B URL HTTP/2 my.rtmark.net/gid.js?userId=69b453bf96004695a6dd8df21721d2ed
IP
File type JSON data\012- , ASCII text
Hash 222df24379d4f46b2f5a562a453241cf
0141542dd387fd094885fa760e7fab03c4963a60
d3ca5bf8cbc3572095644a7fd97d80effa6e6b83f0bd9e475967979a35f89b13
GET /gid.js?userId=69b453bf96004695a6dd8df21721d2ed HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://kuroviral.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=69b453bf96004695a6dd8df21721d2ed; expires=Wed, 24 Jan 2024 23:34:28 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
www.highperformancedisplayformat.com/171e7976dcca1502d1d24e08466c5ba6/invoke.js
200 OK 9.8 kB URL HTTP/1.1 www.highperformancedisplayformat.com/171e7976dcca1502d1d24e08466c5ba6/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (26949), with no line terminators
Hash d226dbef18db52c455fa490e414bf014
7698a68bcc9bcead45e01d75143057dfe88f8ba5
04a3b4a052331d1014996e4f2bd7b2d6b49eac5d7ce5664e9eb60edb38477ddd
Analyzer Verdict Alert quad9 Sinkholed
GET /171e7976dcca1502d1d24e08466c5ba6/invoke.js HTTP/1.1
Host: www.highperformancedisplayformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Tue, 24 Jan 2023 23:34:28 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d5d38b905d95457d407bd058fcad64d9
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e93510af7fbb01ec576cd6667de4decc
bc8ccb22159c837a232324bb3169513be7eb6386
bcfbebd3c569daceed83a680b9e1b76fb3e367426b4baad8bfe3973cd3b39410
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BCFBEBD3C569DACEED83A680B9E1B76FB3E367426B4BAAD8BFE3973CD3B39410"
Last-Modified: Mon, 23 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5831
Expires: Wed, 25 Jan 2023 01:11:39 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
www.highperformancedisplayformat.com/171e7976dcca1502d1d24e08466c5ba6/invoke.js
200 OK 9.8 kB URL HTTP/1.1 www.highperformancedisplayformat.com/171e7976dcca1502d1d24e08466c5ba6/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (26941), with no line terminators
Hash f05ecc6f42b86a30eeb1a139597ee990
639fa267617eb7a6764523bbf317301e4d97e9bf
6ff2b3a98a27510f8c525b933d157e470962a9857c3360022e1df842785a49c6
Analyzer Verdict Alert quad9 Sinkholed
GET /171e7976dcca1502d1d24e08466c5ba6/invoke.js HTTP/1.1
Host: www.highperformancedisplayformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Tue, 24 Jan 2023 23:34:28 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b1f610c644740126c67c07157195ca35
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 239af136e73740de7b9c92cdaf6e1724
36cd229524a6d64c429c54f10cf88453d940c7e9
b7ae4bc1cbbf67cf843a33239ccc89dd5d6e8404919384619f071463f3540b67
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B7AE4BC1CBBF67CF843A33239CCC89DD5D6E8404919384619F071463F3540B67"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9370
Expires: Wed, 25 Jan 2023 02:10:38 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0ce4d7b763ed52bf431da6c86e3b2877
f15094d601c786add7569a59ca7c1bbc47bd780f
152b537bb69e09b4e28c9cfd408d95255f2cb8404ae320bb962a576e5aece707
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "152B537BB69E09B4E28C9CFD408D95255F2CB8404AE320BB962A576E5AECE707"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1947
Expires: Wed, 25 Jan 2023 00:06:55 GMT
Date: Tue, 24 Jan 2023 23:34:28 GMT
Connection: keep-alive
www.highperformancedisplayformat.com/d86be65986c94575e6d957cefd42b319/invoke.js
200 OK 9.8 kB URL HTTP/1.1 www.highperformancedisplayformat.com/d86be65986c94575e6d957cefd42b319/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
File type exported SGML document, ASCII text, with very long lines (26949), with no line terminators
Hash 8d34308964e23f3032d41b2c7360f184
6aa35f2832a5b754f1dc2f040354330b2ad5f9e9
02cc2f12f778d7c2a4c1f368cddbcaf053bb31c51fbf1c96619e585e2b057967
Analyzer Verdict Alert quad9 Sinkholed
GET /d86be65986c94575e6d957cefd42b319/invoke.js HTTP/1.1
Host: www.highperformancedisplayformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Tue, 24 Jan 2023 23:34:28 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ce7d78ebffdbcaaaf8710c1a8584ddab
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
boustahe.com/custom
200 OK 48 B IP
Hash 57d72bcb5ea0111cb982adfc923a47f8
ba97cb69b9c29f264466f8ffc138eff63607e57d
9c0c93d1a85238cb745c66c1f1005d809873895347a6c66bec77205345f4de3c
POST /custom HTTP/1.1
Host: boustahe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kuroviral.com/
Content-Type: application/json
Origin: https://kuroviral.com
Content-Length: 837
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:29 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 1f52233c2430a9dbb4b0dddcfa0352b9
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
shaggyselectmast.com/watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
307 Temporary Redirect 0 B URL HTTP/1.1 shaggyselectmast.com/watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1 HTTP/1.1
Host: shaggyselectmast.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.17.9
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com
Access-Control-Allow-Origin: https://kuroviral.com
Access-Control-Allow-Credentials: true
Location: https://shaggyselectmast.com/watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=2e8e2897210991ef39dd1065c2304c9202eb92aa795246aa453cfa9cbbe64a9251deb882a3328c6e28c6d44625b9d3cc1466e72bfe39ce0bdddb2549e07e50c6da8136aee6535654a8ff53c14724314d4f9944&pst=1674603329&rmtc=t
Set-Cookie: u_pl=17788350; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODM1MCwiayI6IjE3MWU3OTc2ZGNjYTE1MDJkMWQyNGUwODQ2NmM1YmE2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI3LCJwdCI6NCwicGsiOiJ1MGVzejl1eHIiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9rdXJvdmlyYWwuY29tLzIwMjMvMDEvdXBkYXRlLWxpbmstZnVsbC12aWRlb3Mtb2YtaWNlLXNwaWNlLWxlYWtlZC1lYXRpbmctbXVuY2gtb24tdHdpdHRlci1hbmQtcmVkZGl0Lmh0bWwifX0.VlrneDy2PHUdU0lB0B63bohdvHjcVpYEPalicyPlQKU; expires=Tue, 24 Jan 2023 23:35:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5254469007f3b98e5fe37d7475b87766
Strict-Transport-Security: max-age=0; includeSubdomains
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f422d52a7adf70caaf629f514f2016ba
1511d7825a79dfaf67301c4030cb70c55ee721f7
8ae0e7305901574b5fd19e4a752a11d9483090989ae94cfed7c987a106ffb455
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8AE0E7305901574B5FD19E4A752A11D9483090989AE94CFED7C987A106FFB455"
Last-Modified: Mon, 23 Jan 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19178
Expires: Wed, 25 Jan 2023 04:54:07 GMT
Date: Tue, 24 Jan 2023 23:34:29 GMT
Connection: keep-alive
onmarshtompor.com/?rb=eVHJbiKdcr7OJBdgbQoPjIlqWIqKwV7HvhqkOq-PgJmWPpBFcbKhoDp_SRx1EcE9YvMj6tnssFF8i7Y2uMyza8GJTpJpN3L_KzbVvjEO3DWDB7Zvp-hoZe06mtvynXE5jkmhqmSy-3GEAewiws8vy8LHY6ZoK8u_kzusLcc27_-7oQz9l4YlTW7rG3nYBt4DtzTJjtQPXQk0zHgeNL8eXGvZ7HdSYt5X_pjavX4Y3nI%3D&request_ab2=0&zoneid=5499564&js_build=iclick-v1.473.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=0&pl=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.473.0&bs=b845e235-b713-456b-9463-d9db5514373a&userId=69b453bf96004695a6dd8df21721d2ed&m=link
200 OK 6.8 kB URL HTTP/2 onmarshtompor.com/?rb=eVHJbiKdcr7OJBdgbQoPjIlqWIqKwV7HvhqkOq-PgJmWPpBFcbKhoDp_SRx1EcE9YvMj6tnssFF8i7Y2uMyza8GJTpJpN3L_KzbVvjEO3DWDB7Zvp-hoZe06mtvynXE5jkmhqmSy-3GEAewiws8vy8LHY6ZoK8u_kzusLcc27_-7oQz9l4YlTW7rG3nYBt4DtzTJjtQPXQk0zHgeNL8eXGvZ7HdSYt5X_pjavX4Y3nI%3D&request_ab2=0&zoneid=5499564&js_build=iclick-v1.473.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=0&pl=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.473.0&bs=b845e235-b713-456b-9463-d9db5514373a&userId=69b453bf96004695a6dd8df21721d2ed&m=link
IP
File type JSON data\012- , ASCII text, with very long lines (8832), with no line terminators
Hash 92b7eaebb099f555c7d81f9e23bbc42c
777828fa01fb83d6d30a54c7209ab3bb75070d06
f1283cd2c1efe4557dbd1d016e01d25d595cb7a6907bad12ff5be372a6a21b3f
GET /?rb=eVHJbiKdcr7OJBdgbQoPjIlqWIqKwV7HvhqkOq-PgJmWPpBFcbKhoDp_SRx1EcE9YvMj6tnssFF8i7Y2uMyza8GJTpJpN3L_KzbVvjEO3DWDB7Zvp-hoZe06mtvynXE5jkmhqmSy-3GEAewiws8vy8LHY6ZoK8u_kzusLcc27_-7oQz9l4YlTW7rG3nYBt4DtzTJjtQPXQk0zHgeNL8eXGvZ7HdSYt5X_pjavX4Y3nI%3D&request_ab2=0&zoneid=5499564&js_build=iclick-v1.473.0&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1268&wih=939&wiw=1280&wfc=0&pl=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.473.0&bs=b845e235-b713-456b-9463-d9db5514373a&userId=69b453bf96004695a6dd8df21721d2ed&m=link HTTP/1.1
Host: onmarshtompor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kuroviral.com/
Origin: https://kuroviral.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: application/json
x-trace-id: 606593c9257ca51dec8d6c29bce7aa63
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=69b453bf96004695a6dd8df21721d2ed; expires=Wed, 24 Jan 2024 23:34:28 GMT; path=/; secure; SameSite=None
oaidts=1674603268; expires=Wed, 24 Jan 2024 23:34:28 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Tue, 31 Jan 2023 23:34:28 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
shaggyselectmast.com/watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=2e8e2897210991ef39dd1065c2304c9202eb92aa795246aa453cfa9cbbe64a9251deb882a3328c6e28c6d44625b9d3cc1466e72bfe39ce0bdddb2549e07e50c6da8136aee6535654a8ff53c14724314d4f9944&pst=1674603329&rmtc=t
200 OK 2.4 kB URL HTTP/1.1 shaggyselectmast.com/watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=2e8e2897210991ef39dd1065c2304c9202eb92aa795246aa453cfa9cbbe64a9251deb882a3328c6e28c6d44625b9d3cc1466e72bfe39ce0bdddb2549e07e50c6da8136aee6535654a8ff53c14724314d4f9944&pst=1674603329&rmtc=t
IP
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document, ASCII text, with very long lines (3087)
Hash dd08b932026edba941abd4e21993b50a
c992dae4fb57e06d77a2709ddc66e5fe25ceb4db
98dcc55b55000460f45b21ec0f229f00a56efff417e222fcd00925e89f9a0cb2
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.1148031916700.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=2e8e2897210991ef39dd1065c2304c9202eb92aa795246aa453cfa9cbbe64a9251deb882a3328c6e28c6d44625b9d3cc1466e72bfe39ce0bdddb2549e07e50c6da8136aee6535654a8ff53c14724314d4f9944&pst=1674603329&rmtc=t HTTP/1.1
Host: shaggyselectmast.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Referer: https://kuroviral.com/
Connection: keep-alive
Cookie: u_pl=17788350; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODM1MCwiayI6IjE3MWU3OTc2ZGNjYTE1MDJkMWQyNGUwODQ2NmM1YmE2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI3LCJwdCI6NCwicGsiOiJ1MGVzejl1eHIiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9rdXJvdmlyYWwuY29tLzIwMjMvMDEvdXBkYXRlLWxpbmstZnVsbC12aWRlb3Mtb2YtaWNlLXNwaWNlLWxlYWtlZC1lYXRpbmctbXVuY2gtb24tdHdpdHRlci1hbmQtcmVkZGl0Lmh0bWwifX0.VlrneDy2PHUdU0lB0B63bohdvHjcVpYEPalicyPlQKU
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.9
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com
Access-Control-Allow-Origin: https://kuroviral.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Tue, 31 Jan 2023 23:34:29 GMT; secure; SameSite=None
iprc98916245ca5991241467925d835ae1b5=3569683; expires=Wed, 25 Jan 2023 03:34:29 GMT; secure; SameSite=None
pdhtkv=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv27=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs27=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 733e950450da69d86459e767ef23894c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
excretekings.com/sbar.json?key=ac74553746a8a849877e6854572c9c47&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
200 OK 4.5 kB URL HTTP/1.1 excretekings.com/sbar.json?key=ac74553746a8a849877e6854572c9c47&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (6182), with no line terminators
Hash e831d7da71740adca0438b876670a7f6
95c09a7daf1bca71708fe0d9b3dd1dedeb2e8a96
b0caace718af0f4de46b38c3564d28268656a36737545ee4402abd1b98fa65f5
Analyzer Verdict Alert quad9 Sinkholed
GET /sbar.json?key=ac74553746a8a849877e6854572c9c47&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1 HTTP/1.1
Host: excretekings.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com
Access-Control-Allow-Origin: https://kuroviral.com
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=17788423; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Tue, 31 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv29=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs29=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c61982c56e3f884249eff20f3c4ceb77
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
naveljutmistress.com/watch.573024122194.js?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
307 Temporary Redirect 0 B URL HTTP/1.1 naveljutmistress.com/watch.573024122194.js?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.573024122194.js?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1 HTTP/1.1
Host: naveljutmistress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com
Access-Control-Allow-Origin: https://kuroviral.com
Access-Control-Allow-Credentials: true
Location: https://naveljutmistress.com/watch.573024122194.js?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=ee8871139c1c40149dd24faa884985c616dbe61e17ae1873282ff80f17623a0823230e2849eaf172507d35ec20adf77a1f08023c4d91cac308800fb6679ce5fba4bae28784091144399255e5293673b7eab5bb21cce55f129476ce64ee9d74c3bb94&pst=1674603329&rmtc=t
Set-Cookie: u_pl=17788400; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODQwMCwiayI6ImQ4NmJlNjU5ODZjOTQ1NzVlNmQ5NTdjZWZkNDJiMzE5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI2LCJwdCI6NCwicGsiOiJ2ZjVuZ2NjNXFyIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8va3Vyb3ZpcmFsLmNvbS8yMDIzLzAxL3VwZGF0ZS1saW5rLWZ1bGwtdmlkZW9zLW9mLWljZS1zcGljZS1sZWFrZWQtZWF0aW5nLW11bmNoLW9uLXR3aXR0ZXItYW5kLXJlZGRpdC5odG1sIn19.WTWA6vBv85mJwZ3qQdxQs5rQ6vQH8SgYN2E9FrvDLWI; expires=Tue, 24 Jan 2023 23:35:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 24ec1cd3ede3872f8a8582806db4c68c
Strict-Transport-Security: max-age=0; includeSubdomains
excretekings.com/watch.950528149279.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=834be663de45b41f642a83af6c5d33e11313a82d93f8ff19340d30131e5eb6338e0ff7e544a112605acf76651478e9a7d7c8d991092363da03ad634f05e0e6ce95e98d0d990cea9e7c72103f7464cd20185cc24fde7e81f2648b432cc1bc0a1ed2&pst=1674603329&rmtc=t
200 OK 633 B URL HTTP/1.1 excretekings.com/watch.950528149279.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=834be663de45b41f642a83af6c5d33e11313a82d93f8ff19340d30131e5eb6338e0ff7e544a112605acf76651478e9a7d7c8d991092363da03ad634f05e0e6ce95e98d0d990cea9e7c72103f7464cd20185cc24fde7e81f2648b432cc1bc0a1ed2&pst=1674603329&rmtc=t
IP
File type HTML document text\012- HTML document, ASCII text, with very long lines (581)
Hash 4fe355a67eaca93d3f577f5bb4e8bcab
0af30bedbe2b237a2683cc6239798de9248c32aa
cc6ead97191bf3b548cb3be6c5dc141508fc662905c14fece085da0ca14d78ab
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.950528149279.js?key=171e7976dcca1502d1d24e08466c5ba6&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&shu=834be663de45b41f642a83af6c5d33e11313a82d93f8ff19340d30131e5eb6338e0ff7e544a112605acf76651478e9a7d7c8d991092363da03ad634f05e0e6ce95e98d0d990cea9e7c72103f7464cd20185cc24fde7e81f2648b432cc1bc0a1ed2&pst=1674603329&rmtc=t HTTP/1.1
Host: excretekings.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Referer: https://kuroviral.com/
Connection: keep-alive
Cookie: u_pl=17788350; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODM1MCwiayI6IjE3MWU3OTc2ZGNjYTE1MDJkMWQyNGUwODQ2NmM1YmE2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI3LCJwdCI6NCwicGsiOiJ1MGVzejl1eHIiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9rdXJvdmlyYWwuY29tLzIwMjMvMDEvdXBkYXRlLWxpbmstZnVsbC12aWRlb3Mtb2YtaWNlLXNwaWNlLWxlYWtlZC1lYXRpbmctbXVuY2gtb24tdHdpdHRlci1hbmQtcmVkZGl0Lmh0bWwifX0.VlrneDy2PHUdU0lB0B63bohdvHjcVpYEPalicyPlQKU
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com
Access-Control-Allow-Origin: https://kuroviral.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Tue, 31 Jan 2023 23:34:29 GMT; secure; SameSite=None
iprc4c511c60fc8e968860d462223213a82f=2004370; expires=Thu, 26 Jan 2023 01:34:29 GMT; secure; SameSite=None
pdhtkv=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv27=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs27=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8416a8cbdbbb8a8328581c52c4b9a2af
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
excretekings.com/pixel/sbe?t=2&error=timeout
200 OK 0 B URL HTTP/1.1 excretekings.com/pixel/sbe?t=2&error=timeout
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /pixel/sbe?t=2&error=timeout HTTP/1.1
Host: excretekings.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Cookie: u_pl=17788423; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODM1MCwiayI6IjE3MWU3OTc2ZGNjYTE1MDJkMWQyNGUwODQ2NmM1YmE2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI3LCJwdCI6NCwicGsiOiJ1MGVzejl1eHIiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9rdXJvdmlyYWwuY29tLzIwMjMvMDEvdXBkYXRlLWxpbmstZnVsbC12aWRlb3Mtb2YtaWNlLXNwaWNlLWxlYWtlZC1lYXRpbmctbXVuY2gtb24tdHdpdHRlci1hbmQtcmVkZGl0Lmh0bWwifX0.VlrneDy2PHUdU0lB0B63bohdvHjcVpYEPalicyPlQKU; uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; iprc4c511c60fc8e968860d462223213a82f=2004370; pdhtkv27=true; uncs27=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3e8c95965ff9725874bdbb5fad03669b
9ac197cc1b054c2f64eaa1b764f9ac70b11bee0f
17b9c00db614017561865e3d155d5ca7f79bb06bad9f5b151b14a63d8bfd7ae9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17B9C00DB614017561865E3D155D5CA7F79BB06BAD9F5B151B14A63D8BFD7AE9"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2927
Expires: Wed, 25 Jan 2023 00:23:16 GMT
Date: Tue, 24 Jan 2023 23:34:29 GMT
Connection: keep-alive
naveljutmistress.com/watch.573024122194?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
200 OK 1.3 kB URL HTTP/1.1 naveljutmistress.com/watch.573024122194?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
IP
File type HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (767)
Hash 11b84f56875c1106e57a3b1c97563328
de8c3086c54c4685da74eccc583562e1f09e8062
27cec227085493a9072860770cb830feb22266530e0b07f7833b1e62706ccaff
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.573024122194?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1 HTTP/1.1
Host: naveljutmistress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Cookie: u_pl=17788400; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODQwMCwiayI6ImQ4NmJlNjU5ODZjOTQ1NzVlNmQ5NTdjZWZkNDJiMzE5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI2LCJwdCI6NCwicGsiOiJ2ZjVuZ2NjNXFyIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8va3Vyb3ZpcmFsLmNvbS8yMDIzLzAxL3VwZGF0ZS1saW5rLWZ1bGwtdmlkZW9zLW9mLWljZS1zcGljZS1sZWFrZWQtZWF0aW5nLW11bmNoLW9uLXR3aXR0ZXItYW5kLXJlZGRpdC5odG1sIn19.WTWA6vBv85mJwZ3qQdxQs5rQ6vQH8SgYN2E9FrvDLWI
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODQwMCwiayI6ImQ4NmJlNjU5ODZjOTQ1NzVlNmQ5NTdjZWZkNDJiMzE5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI2LCJwdCI6NCwicGsiOiJ2ZjVuZ2NjNXFyIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6ZmFsc2UsInIiOiJodHRwczovL2t1cm92aXJhbC5jb20vMjAyMy8wMS91cGRhdGUtbGluay1mdWxsLXZpZGVvcy1vZi1pY2Utc3BpY2UtbGVha2VkLWVhdGluZy1tdW5jaC1vbi10d2l0dGVyLWFuZC1yZWRkaXQuaHRtbCJ9fQ.tlR3-Nfd88086pslhrNjY_t99Rf1uxmGEVVYm4Ab6Ww; expires=Tue, 24 Jan 2023 23:35:29 GMT; secure; SameSite=None
uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Tue, 31 Jan 2023 23:34:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 922d5ff00295cbf1510408a233bf860c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
jennyvisits.com/pph1aeej?key=7a7c3779889805e2058addecb7e13424&psid=17788350
200 OK 1.3 kB URL HTTP/1.1 jennyvisits.com/pph1aeej?key=7a7c3779889805e2058addecb7e13424&psid=17788350
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 16d24ad49209ba3465c15f52be086c29
9679f577ab451bc0ffbfc66b87dee1cffb31beaf
48d8f2c8991080a78be65e774bde8b0e5042fc8a9b6bec9d39d267e85f942574
Analyzer Verdict Alert quad9 Sinkholed
GET /pph1aeej?key=7a7c3779889805e2058addecb7e13424&psid=17788350 HTTP/1.1
Host: jennyvisits.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=15077602; expires=Wed, 25 Jan 2023 23:34:29 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTA3NzYwMiwiayI6IjdhN2MzNzc5ODg5ODA1ZTIwNThhZGRlY2I3ZTEzNDI0Iiwic2lkIjoiMTc3ODgzNTAiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyOCwicHQiOjQsInBrIjoicHBoMWFlZWoiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8va3Vyb3ZpcmFsLmNvbS8ifX0.K--dAoqgNM5yaHNlTRqYl77lWV69QnjfhBhlRry_5Yk; expires=Tue, 24 Jan 2023 23:35:29 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 86b9849efeccfcf4dea0043a27b07434
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
naveljutmistress.com/watch.573024122194?shu=ed841d8658929fd2ce94f873442f4e45d5fd0c92444a417412013f82d6b2001552545155ce56d17aff4a940990f573fb17c11f22b6217ede246462ad609105d416e28ea3ec7e3d8be0e819a04e5e1ad037d4fd8c707a3120d2d66500c4770b61&pst=1674603329&rmtc=t&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&pii=&in=false&key=d86be65986c94575e6d957cefd42b319&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&tz=0&dev=e&res=12.1055
200 OK 2.1 kB URL HTTP/1.1 naveljutmistress.com/watch.573024122194?shu=ed841d8658929fd2ce94f873442f4e45d5fd0c92444a417412013f82d6b2001552545155ce56d17aff4a940990f573fb17c11f22b6217ede246462ad609105d416e28ea3ec7e3d8be0e819a04e5e1ad037d4fd8c707a3120d2d66500c4770b61&pst=1674603329&rmtc=t&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&pii=&in=false&key=d86be65986c94575e6d957cefd42b319&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&tz=0&dev=e&res=12.1055
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2913)
Hash 828883b47d1ff71bd1fd33b9579a8c18
918e4114158703e0629f0d8c8b31085141a30e9a
5c674b5848ac23b8b1c21f7b8ee1385a76ee8c930322b8c2c84b41da186416d2
Analyzer Verdict Alert quad9 Sinkholed
GET /watch.573024122194?shu=ed841d8658929fd2ce94f873442f4e45d5fd0c92444a417412013f82d6b2001552545155ce56d17aff4a940990f573fb17c11f22b6217ede246462ad609105d416e28ea3ec7e3d8be0e819a04e5e1ad037d4fd8c707a3120d2d66500c4770b61&pst=1674603329&rmtc=t&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1&pii=&in=false&key=d86be65986c94575e6d957cefd42b319&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&tz=0&dev=e&res=12.1055 HTTP/1.1
Host: naveljutmistress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://naveljutmistress.com/watch.573024122194?key=d86be65986c94575e6d957cefd42b319&kw=%5B%22update%22%2C%22link%22%2C%22full%22%2C%22videos%22%2C%22of%22%2C%22ice%22%2C%22spice%22%2C%22leaked%22%2C%22eating%22%2C%22munch%22%2C%22on%22%2C%22twitter%22%2C%22and%22%2C%22reddit%22%2C%22%E2%80%93%22%2C%22viral%22%2C%22trending%22%5D&refer=https%3A%2F%2Fkuroviral.com%2F2023%2F01%2Fupdate-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html&tz=0&dev=e&res=12.1055&uuid=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91%3A3%3A1
Cookie: u_pl=17788400; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzc4ODQwMCwiayI6ImQ4NmJlNjU5ODZjOTQ1NzVlNmQ5NTdjZWZkNDJiMzE5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMDE5MTEyLCJwaWQiOjU0Njk2MiwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoyLCJhaWQiOjI2LCJwdCI6NCwicGsiOiJ2ZjVuZ2NjNXFyIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6ZmFsc2UsInIiOiJodHRwczovL2t1cm92aXJhbC5jb20vMjAyMy8wMS91cGRhdGUtbGluay1mdWxsLXZpZGVvcy1vZi1pY2Utc3BpY2UtbGVha2VkLWVhdGluZy1tdW5jaC1vbi10d2l0dGVyLWFuZC1yZWRkaXQuaHRtbCJ9fQ.tlR3-Nfd88086pslhrNjY_t99Rf1uxmGEVVYm4Ab6Ww; uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
Access-Control-Allow-Origin: https://kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=7c6b6bed-c4b1-4cb9-a6d6-1105fab2dd91:3:1; expires=Tue, 31 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
pdhtkv26=true; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
uncs26=1; expires=Wed, 25 Jan 2023 23:34:29 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fce4b12ee550f3f335f933bd0ce3f774
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
jennyvisits.com/pph1aeej?shu=468082d2991aeb5458d56deff33d7d654de381c374bc31e67ccac0551f9c4a426fa677fa67118a690c3ca1f2ebb34a896caa7a1e9de24fc890b580e13966da76510d9d3bebbbaca6b77ec464da632008905af0b2e5d7c81ebf2c97735c6b244a38&pst=1674603329&rmtc=t&uuid=&pii=&in=false&key=7a7c3779889805e2058addecb7e13424&refer=https%3A%2F%2Fkuroviral.com%2F&psid=17788350
302 Found 0 B URL HTTP/1.1 jennyvisits.com/pph1aeej?shu=468082d2991aeb5458d56deff33d7d654de381c374bc31e67ccac0551f9c4a426fa677fa67118a690c3ca1f2ebb34a896caa7a1e9de24fc890b580e13966da76510d9d3bebbbaca6b77ec464da632008905af0b2e5d7c81ebf2c97735c6b244a38&pst=1674603329&rmtc=t&uuid=&pii=&in=false&key=7a7c3779889805e2058addecb7e13424&refer=https%3A%2F%2Fkuroviral.com%2F&psid=17788350
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /pph1aeej?shu=468082d2991aeb5458d56deff33d7d654de381c374bc31e67ccac0551f9c4a426fa677fa67118a690c3ca1f2ebb34a896caa7a1e9de24fc890b580e13966da76510d9d3bebbbaca6b77ec464da632008905af0b2e5d7c81ebf2c97735c6b244a38&pst=1674603329&rmtc=t&uuid=&pii=&in=false&key=7a7c3779889805e2058addecb7e13424&refer=https%3A%2F%2Fkuroviral.com%2F&psid=17788350 HTTP/1.1
Host: jennyvisits.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://jennyvisits.com/pph1aeej?key=9ca601a9f47c735df76d5ca46fa26a66&submetric=15077602
Cookie: u_pl=15077602; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTA3NzYwMiwiayI6IjdhN2MzNzc5ODg5ODA1ZTIwNThhZGRlY2I3ZTEzNDI0Iiwic2lkIjoiMTc3ODgzNTAiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxNiwiYWlkIjoyOCwicHQiOjQsInBrIjoicHBoMWFlZWoiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8va3Vyb3ZpcmFsLmNvbS8ifX0.K--dAoqgNM5yaHNlTRqYl77lWV69QnjfhBhlRry_5Yk; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 302 Found
Server: nginx/1.19.5
Date: Tue, 24 Jan 2023 23:34:30 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://for-j.com/tds3.html?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&sourceid=722514&tt=2
Set-Cookie: iprc3ce7003f582f14652d2262da46a22e3d=3959492; expires=Wed, 25 Jan 2023 23:34:30 GMT
pdhtkv=true; expires=Wed, 25 Jan 2023 23:34:30 GMT
uncs=1; expires=Wed, 25 Jan 2023 23:34:30 GMT
pdhtkv28=true; expires=Wed, 25 Jan 2023 23:34:30 GMT
uncs28=1; expires=Wed, 25 Jan 2023 23:34:30 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6c4a7639bc27cd9746f0c3c51fc9a2bb
Strict-Transport-Security: max-age=0; includeSubdomains
ak.roudoduor.com/afu.php?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&var=722514
200 OK 614 B URL HTTP/2 ak.roudoduor.com/afu.php?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&var=722514
IP
ASN #20940 Akamai International B.V.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 439bbec5036f16ff875d09bef4f13998
342eb35d6def1e30a552a4b1020f18e2ff870b18
92e6fca7dfe5ac79db3f78a5aca52e98dfcdef90fab817af63e9f7fe671b43d9
Analyzer Verdict Alert quad9 Sinkholed
GET /afu.php?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&var=722514 HTTP/1.1
Host: ak.roudoduor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=utf8
x-trace-id: f161b3e04e0fb05f1ca1f19979ffd8d6
link: <https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch", <https://buzzonclick.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
content-length: 614
vary: Accept-Encoding
expires: Tue, 24 Jan 2023 23:34:30 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Tue, 24 Jan 2023 23:34:30 GMT
set-cookie: OAID=77652ca0cc2f49ec93bee43116ff3e8b; expires=Wed, 24 Jan 2024 23:34:30 GMT; path=/; secure; SameSite=None
oaidts=1674603270; expires=Wed, 24 Jan 2024 23:34:30 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1efa8c61f9db8e0ec1774f0b1baecdea
08ba8067d89579803e286e5b7ae649b8cfc6db2e
5b08ce2e19047ede80f7ea622c2e1785e5ee8fb2400e88682229cd82dfb3c95a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5B08CE2E19047EDE80F7EA622C2E1785E5EE8FB2400E88682229CD82DFB3C95A"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9031
Expires: Wed, 25 Jan 2023 02:05:01 GMT
Date: Tue, 24 Jan 2023 23:34:30 GMT
Connection: keep-alive
ak.roudoduor.com/favicon.ico
204 No Content 0 B URL HTTP/2 ak.roudoduor.com/favicon.ico
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: ak.roudoduor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: OAID=77652ca0cc2f49ec93bee43116ff3e8b; oaidts=1674603270
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 204 No Content
expires: Tue, 24 Jan 2023 23:34:30 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Tue, 24 Jan 2023 23:34:30 GMT
X-Firefox-Spdy: h2
my.rtmark.net/img.gif?f=merge&userId=77652ca0cc2f49ec93bee43116ff3e8b
200 OK 43 B URL HTTP/2 my.rtmark.net/img.gif?f=merge&userId=77652ca0cc2f49ec93bee43116ff3e8b
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
POST /img.gif?f=merge&userId=77652ca0cc2f49ec93bee43116ff3e8b HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:30 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: null
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=77652ca0cc2f49ec93bee43116ff3e8b; expires=Wed, 24 Jan 2024 23:34:30 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash 6027f0bd1b4e9eb3ac6129b0763289af
ebde2f41d3e7f9cb631605a245df8d7d3c049633
86b76baa0626e10201460a8c731031893ce4ac4d46d71f343d18075b6d29680c
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 24 Jan 2023 23:34:31 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 22 Jan 2023 14:30:43 GMT
Expires: Sun, 29 Jan 2023 14:30:42 GMT
Etag: "ebde2f41d3e7f9cb631605a245df8d7d3c049633"
Cache-Control: max-age=398770,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 78ec94895f4ab500-OSL
ocsp.sectigo.com/
200 OK 471 B IP
Hash 6027f0bd1b4e9eb3ac6129b0763289af
ebde2f41d3e7f9cb631605a245df8d7d3c049633
86b76baa0626e10201460a8c731031893ce4ac4d46d71f343d18075b6d29680c
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 24 Jan 2023 23:34:31 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 22 Jan 2023 14:30:43 GMT
Expires: Sun, 29 Jan 2023 14:30:42 GMT
Etag: "ebde2f41d3e7f9cb631605a245df8d7d3c049633"
Cache-Control: max-age=398770,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 78ec948ebbd5b500-OSL
adserving.unibet.com/redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=5623198-1579691880-0_Adcash
307 Temporary Redirect 1 B URL HTTP/2 adserving.unibet.com/redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=5623198-1579691880-0_Adcash
IP
ASN #20940 Akamai International B.V.
File type very short file (no magic)
Hash 68b329da9893e34099c7d8ad5cb9c940
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
GET /redirect.aspx?bid=37953&pid=2100237&sref=ADC&ADC=5623198-1579691880-0_Adcash HTTP/1.1
Host: adserving.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 307 Temporary Redirect
content-type: text/html
content-length: 0
location: https://www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953
p3p: CP="This is not a P3P policy! It is used to bypass IEs problematic handling of cookies"
x-aspnet-version: 4.0.30319
request-context: appId=cid-v1:83ffbda4-9458-475e-90ec-4427cfb5c3b0
access-control-expose-headers: Request-Context
expires: Tue, 24 Jan 2023 23:34:31 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Tue, 24 Jan 2023 23:34:31 GMT
set-cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a92607737%2c%22BID%22%3a37953%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1674603271960)%5c%2f%22%2c%22CookieTag%22%3a%223795392607737451240919C20231242334%22%7d%5d; SameSite=None;; domain=.unibet.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure
NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%228733512303%7c1%22%7d%5d; domain=.unibet.com; expires=Thu, 24-Jan-3022 23:34:31 GMT; path=/; secure; SameSite=Strict
server-timing: cdn-cache; desc=MISS, edge; dur=21, origin; dur=34
X-Firefox-Spdy: h2
www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953
301 Moved Permanently 0 B URL HTTP/2 www.mariacasino.nu/stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/campaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953 HTTP/1.1
Host: www.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Tue, 24 Jan 2023 23:34:32 GMT
content-length: 0
location: https://www.mariacasino.nu:443/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953
set-cookie: JSESSIONID=node01392v0p9yx9rvy6jlt1ef0vzd3184593.node0; Path=/stan; Secure; HttpOnly; SameSite=Strict
__ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; Path=/; Domain=.mariacasino.nu; Expires=Thu, 23-Jan-2025 23:34:32 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr=ST.0.T; Path=/; Domain=.mariacasino.nu; Expires=Thu, 23-Jan-2025 23:34:32 GMT; Max-Age=63072000; Secure; SameSite=None
uniattr_ref=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 23-Jan-2025 23:34:32 GMT; Max-Age=63072000; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
affid=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
netwid=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
CLAIM_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
campaignId=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Tue, 24-Jan-2023 23:34:47 GMT; Max-Age=15; Secure; SameSite=None
affiliateId=1; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
REGISTRATION_CODE=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BID=37953; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
PID=92607737; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
CHID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
REFERER=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_INTERNAL_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
UNIBET_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_ACCEPTED=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AMS_INVITE_CHAT_DECLINED=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
BOCAID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
PRODUCT_ID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFID=; Path=/; Domain=.mariacasino.nu; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Secure; SameSite=None
AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
AFFILIATE_CAMPAIGN_ID=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Tue, 24-Jan-2023 23:34:47 GMT; Max-Age=15; Secure; SameSite=None
campaignId=2397257; Path=/; Domain=.mariacasino.nu; Expires=Wed, 31-Jan-2024 22:58:59 GMT; Max-Age=32138667; Secure; SameSite=None
framework.forceBigLandingArea=; Path=/; Domain=.mariacasino.nu; Expires=Tue, 24-Jan-2023 23:34:47 GMT; Max-Age=15; Secure; SameSite=None
clientId=browser_desktop; Domain=www.mariacasino.nu; Path=/; SameSite=None; Secure
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT, Tue, 24 Jan 2023 23:34:32 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
X-Firefox-Spdy: h2
www.mariacasino.nu/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953
301 Moved Permanently 0 B URL HTTP/2 www.mariacasino.nu/stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953
IP
ASN #47171 Unibet Services Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /stan/redirecttocampaign.do?cmpId=2397257&affiliateId=1&unibetTarget=/no/pop/casino/2022/index.html&targetDomain=https://welcome.mariacasino.nu&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&sref=ADC&ADC=5623198-1579691880-0_Adcash&affiliateId=1&pid=92607737&bid=37953&landingPageUrl=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953 HTTP/1.1
Host: www.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; clientId=browser_desktop
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 301 Moved Permanently
date: Tue, 24 Jan 2023 23:34:32 GMT
content-length: 0
location: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
cache-control: max-age=0, no-cache, no-store, must-revalidate, proxy-revalidate
expires: Tue, 24 Jan 2023 23:34:32 GMT
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash e8e27e3c9829f3446e83415eca8c5b37
e7563783fbdac88bd11a673238e786576556225f
8e7199a597749c04c1c2d6b2e9d2483e089b6f724964b49bf82f6756442c8ec0
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=104908
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:32 GMT
Etag: "63cf61d4-117"
Expires: Thu, 26 Jan 2023 04:43:00 GMT
Last-Modified: Tue, 24 Jan 2023 04:43:00 GMT
Server: nginx
Content-Length: 279
welcome.mariacasino.nu/no/pop/casino/2022/livecasino.png
200 OK 21 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/livecasino.png
IP
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 87dc3fc9a40a9b0e8fd7c0519ac24f54
908b0ca475f8da1d0380a6cb5caabafce2466aec
a0fd031aa160b2679253c5952576a692e002c6be963c5935af3692ff50206eb4
GET /no/pop/casino/2022/livecasino.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: image/png
content-length: 20783
cache-control: public, max-age=900, immutable
content-md5: h9w/yaQKmw6P18BRmsJPVA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4DF7B00"
x-ms-request-id: 2a37beda-301e-0078-10f7-03b1fa000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35719
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b3dfabc-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/mga.png
200 OK 1.5 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/mga.png
IP
File type PNG image data, 152 x 60, 8-bit colormap, non-interlaced\012- data
Hash f34e781d7ad22dc774b98ac82a2b46f6
b66cb9753b0f76a7590f62d3c6b8f645bdbae786
7898ba2cec328d50a75400c1e5a6f1f23974f4c0cc433472a24f28a82c7d01c7
GET /no/pop/casino/2022/mga.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: image/png
content-length: 1454
cache-control: public, max-age=900, immutable
content-md5: 8054HXrSLcd0uYrIKitG9g==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4FEBE45"
x-ms-request-id: aeb20fbe-701e-0034-08f7-0321ca000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35718
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b3ffabc-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/slots.png
200 OK 6.3 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/slots.png
IP
File type PNG image data, 151 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 6be047bdf3d103b2414f7f6ab64d96b8
57818bdfe16383abe584b5c30de5f35eb55ebf20
38e2d3e7f261032cf0c558e28555c6425c30aa14014f31bbaad7d5176b7d4449
GET /no/pop/casino/2022/slots.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: image/png
content-length: 6303
cache-control: public, max-age=900, immutable
content-md5: a+BHvfPRA7JBT39qtk2WuA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4ED5BA7"
x-ms-request-id: da131072-401e-003f-7bf7-03daa1000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35719
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b3cfabc-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/games.png
200 OK 8.8 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/games.png
IP
File type PNG image data, 234 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash fbd364c184d1c2af246dd5a3079ce9ed
5c572431ced831a518e0c4adfed4372254f1eac1
2a09f891fb138e893fbc2fe522761e47307376143582e41016bf8aa54c4fdb77
GET /no/pop/casino/2022/games.png HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: image/png
content-length: 8838
cache-control: public, max-age=900, immutable
content-md5: +9NkwYTRwq8kbdWjB5zp7Q==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4D87720"
x-ms-request-id: 56be89e7-801e-0020-22f7-0369a5000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35718
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b3efabc-OSL
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1005c9e99dc8d4390861d6730c7a403b
0e3858ae26a1c01e0160e3b60e400bea202ebd05
4ff7ceb81a3dad4fefd3a15ece4ce13898624c01bf5a0cb4fdd90958978ed6b9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 1005c9e99dc8d4390861d6730c7a403b
0e3858ae26a1c01e0160e3b60e400bea202ebd05
4ff7ceb81a3dad4fefd3a15ece4ce13898624c01bf5a0cb4fdd90958978ed6b9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
File type ASCII text, with very long lines (32030)
Hash 04ba0252a9f264db106d4eaab8df4ccb
cf52d9b3df7839c5c64fbf33aafeced74b3db750
397852429e768ffbd12a78ce4b94f14e3ab4afabf84acb07c0bb5b7798e6e0b2
GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30244
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 20 Jan 2023 06:39:53 GMT
expires: Sat, 20 Jan 2024 06:39:53 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 406479
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
200 OK 956 B URL HTTP/2 a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
IP
ASN #47171 Unibet Services Limited
Hash fd48e87ecd4d06d9c5df490b91dc813e
a65a437db44444634e4f41732c590c1d14433b3f
2f786ae3f4577ed970f60aa7a9edf726300a740fdb360a8364db7ff4b7ca8e47
GET /unibet/bannerflow/scripts/master_tag.js HTTP/1.1
Host: a1s-cdn.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: application/javascript
content-length: 956
last-modified: Mon, 25 Apr 2022 12:19:34 GMT
etag: "3bc-5dd7996cc0ce1"
cache-control: max-age=1800, public, must-revalidate
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s-cdn.unibet.com; Path=/; SameSite=None; Secure
accept-ranges: bytes
X-Firefox-Spdy: h2
service.maxymiser.net/cdn/unibet/js/mmcore.js
404 Not Found 10 B URL HTTP/2 service.maxymiser.net/cdn/unibet/js/mmcore.js
IP
Hash 7605968e79d0ca095ab1231486d2b814
a007b420d19ceefa840f0373e050e3b51a4ab480
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
GET /cdn/unibet/js/mmcore.js HTTP/1.1
Host: service.maxymiser.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
accept-ranges: bytes
content-length: 10
server: AkamaiNetStorage
cache-control: max-age=1800
date: Tue, 24 Jan 2023 23:34:32 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js
200 OK 44 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js
IP
File type exported SGML document, ASCII text, with very long lines (32764)
Hash 57198fa839fd954656487c5a3bef02a7
060e710714194b067e8a17554de1f056f3c5fa64
0144349d38a845bda08cbc2654f89da13986be57ce76fa7f49488907aa392edd
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "bf8d7656a2457e257e3cf75a01e6a4b7:1554112914"
last-modified: Mon, 01 Apr 2019 10:01:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 43737
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:32 GMT
date: Tue, 24 Jan 2023 23:34:32 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
200 OK 228 B URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
IP
Hash f9f61cf08520dbe652f9085c0c5e1a43
f9333020f4b2f0446c5ce4fd69f14433102a71c5
b27cb6d5a43aa222ba4bb45dfeec4211d1ed558d1d552ec160660c01db213782
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "accfdd9d5be1d7142fabad440365d15f:1554112916"
last-modified: Mon, 01 Apr 2019 10:01:56 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 228
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:32 GMT
date: Tue, 24 Jan 2023 23:34:32 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
200 OK 13 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
IP
File type ASCII text, with very long lines (558)
Hash fbdf335868cbf423af02de87750c1a45
8405d2f9b1b98d830e1b5bb2d8b9cf31460a9cc4
ddc30198d101ed4d7f85eb14fcc0331154807320fe2b2443b814bedc43c4ace4
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "18eab16a639a4773572307713440a929:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:32 GMT
date: Tue, 24 Jan 2023 23:34:32 GMT
content-length: 12666
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/main.js
200 OK 155 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/main.js
IP
File type Unicode text, UTF-8 text, with very long lines (652)
Size 155 kB (155181 bytes)
Hash 1fcf4110c159b46debcc537072dce35b
b775907a745cc51b20640762ff8da475d83f5790
6af42033983735a2ef14278d651ef7eb6221ae1a454bc33f1fa0039fdc40060f
GET /no/pop/casino/2022/main.js HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: HUKMSjGdEVR6I7ylcruk3g==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA4F7BA6F"
x-ms-request-id: 5a127d26-401e-0062-37f7-03d025000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 502023
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b38fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash bf1791a3587ee14626e45cfb4c010e5b
6b1294eabae5cb1d606f3eed242c63249b4e38a3
310ceee3888b572cf3517bcef67ff43c4ca69fdb816bd133d05dfff26fc055e7
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4363
Cache-Control: max-age=114307
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:32 GMT
Etag: "63cf7580-1d7"
Expires: Thu, 26 Jan 2023 07:19:39 GMT
Last-Modified: Tue, 24 Jan 2023 06:06:56 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471
dpm.demdex.net/id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1674603271096
200 OK 499 B URL HTTP/1.1 dpm.demdex.net/id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1674603271096
IP
File type JSON data\012- , ASCII text, with very long lines (791), with no line terminators
Hash 8893564b992eb956232741bc29f8d9c4
fe42e027974536fcaabf0715181ad310e90f8d7d
aa438447f8c1669a02cbea1988a2f2c31f5b8252453ec47d2cc87d6324aa868a
GET /id?d_visid_ver=3.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=F431E3BC5593E3887F000101%40AdobeOrg&d_nsid=0&ts=1674603271096 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v045-09e3db1c5.edge-irl1.demdex.com 6 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=25524941725783358590635236489523851417; Max-Age=15552000; Expires=Sun, 23 Jul 2023 23:34:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: RkYcV0p0TUo=
Content-Length: 499
Connection: keep-alive
a1s.unibet.com/orval/tracking/lastclick.min.js
200 OK 824 B URL HTTP/2 a1s.unibet.com/orval/tracking/lastclick.min.js
IP
ASN #47171 Unibet Services Limited
Hash c3fdcf0f1cb0fe850cc7901497764146
b7ade1ac5bd789c2fa32567d5c58eda8c2e6e226
3a7218eabd1822542e4b4258a0833b56e6c0d7c1c32e21ca28abe3f6059dd87e
GET /orval/tracking/lastclick.min.js HTTP/1.1
Host: a1s.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 05 Aug 2022 12:55:42 GMT
etag: W/"705-5e57dfbd5830d"
cache-control: max-age=1800, public, must-revalidate
content-encoding: gzip
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s.unibet.com; Path=/; SameSite=None; Secure
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
200 OK 30 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
IP
File type ASCII text, with very long lines (543)
Hash d994c7b5e7b348492e630f9e201eed6c
927a06e00f5a9c23d2f9348c013cec4b459effac
7ca2a3f0bb133f07fb5c826b58e48089d90b0ce6e5ab0dce5de73550c5110d80
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "9c4992909a83d52617e9948d1d1c4141:1554112914"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 29629
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:33 GMT
date: Tue, 24 Jan 2023 23:34:33 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
200 OK 1.2 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
IP
File type ASCII text, with very long lines (502)
Hash 0fc50fe0077c2d091ca05aa91daba75f
6a05d944d25fe2dbf36c1fb33a5096bcb1ada25c
4b469a08c52c411065253103c02ea37609c225f2b4c7c3842d90d0c6caa694f3
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "5e8dc588959123c3ee5de9ac168d5c74:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1199
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:33 GMT
date: Tue, 24 Jan 2023 23:34:33 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-MediumWeb.woff
200 OK 49 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-MediumWeb.woff
IP
File type Web Open Font Format, TrueType, length 48766, version 3.6\012- data
Hash f62793caeb7e5b111d7508b00c0826c2
d003c52a07685156de00186014c777b7dde81573
bac888a26184354a6038eb4ba3d87fdc3315c6e7fe0c19ec7cd1737f1720fc5a
GET /no/pop/casino/2022/BlenderPro-MediumWeb.woff HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19382%7CMCMID%7C25497521895009284880638980971321625858%7CMCAAMLH-1675208071%7C6%7CMCAAMB-1675208071%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674610471s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1674603271294r0.4293952303053159; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: application/font-woff
content-length: 48766
cache-control: public, max-age=900, immutable
content-md5: 9ieTyut+WxEddQiwDAgmwg==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: "0x8DAD20EA49C613A"
x-ms-request-id: d866c426-a01e-0018-6bf7-03cd65000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35468
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94993c57fabc-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-ThinWeb.woff
200 OK 50 kB URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/BlenderPro-ThinWeb.woff
IP
File type Web Open Font Format, TrueType, length 49636, version 3.6\012- data
Hash 37ba84aebad11c2e0acd496eedb0bb76
42942446e1cfab8d0eaf7d23899203b2b2b64fe7
2d7cc2c9c9fef717010fcfa8fa6518079eaec1e63975a74b4fb78afb14d6ee5e
GET /no/pop/casino/2022/BlenderPro-ThinWeb.woff HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19382%7CMCMID%7C25497521895009284880638980971321625858%7CMCAAMLH-1675208071%7C6%7CMCAAMB-1675208071%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674610471s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1674603271294r0.4293952303053159; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: application/font-woff
content-length: 49636
cache-control: public, max-age=900, immutable
content-md5: N7qErrrRHC4KzUlu7bC7dg==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: "0x8DAD20EA4AE38F0"
x-ms-request-id: aeb213ea-701e-0034-5af7-0321ca000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35468
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94993c56fabc-OSL
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 78ed7b7d814d987601b30851546309b5
12a653dabfd738fef99fad2295eec55e4651bc7c
a55164c954f0255d6d360ac0fac8b4598f8e0e01ec646105eed2e9b0abf5e2bd
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 18 Jan 2023 19:33:54 GMT
expires: Thu, 18 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 532839
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 3e7fdf1ab4be9ee80518d0400683f0d3
dd2ec6511ba05e7fb89d32a1ad407db5eaa1520b
eb789178a0b528aad87a5bf0d05aecd45e7623ebaf198820f9310887757e1d5f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
200 OK 81 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
IP
File type ASCII text, with very long lines (62112)
Hash 7bc5f35337ca782e37804e0ba7fe3765
03055b2a6c3f685b806641649e287ad019bd147a
023e14424768b1b9cc71cdd3063fdaa955bea17c4bdf0a84a1d1e0907328ab46
GET /gtm.js?id=GTM-PF2RVHC HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 24 Jan 2023 23:34:33 GMT
expires: Tue, 24 Jan 2023 23:34:33 GMT
cache-control: private, max-age=900
last-modified: Tue, 24 Jan 2023 22:24:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81152
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
buzzonclick.com/jump/next.php?r=5623198&sub1=5652304&rdk=rk1
200 OK 19 kB URL HTTP/2 buzzonclick.com/jump/next.php?r=5623198&sub1=5652304&rdk=rk1
IP
Hash 9399d1d543ac32164bfefebe0a0e2324
05c15a9693c248906546d368e4b72baac38d08fc
b401f5868eceb640a4ef3eacdd00b30c5b4d3ed56176a64ac368de629f76d575
GET /jump/next.php?r=5623198&sub1=5652304&rdk=rk1 HTTP/1.1
Host: buzzonclick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: openresty
date: Tue, 24 Jan 2023 23:34:31 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 3024908b02f82742a89d8568a83877e2
e1450831d7476802cc6fcde0ac62516f0375ca8e
fe34f40ed6f3964bf9a3a30df2992025fe38ad96367a2597beeba28a811f5fd6
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3704
Cache-Control: max-age=119043
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Etag: "63cf8a95-1d7"
Expires: Thu, 26 Jan 2023 08:38:36 GMT
Last-Modified: Tue, 24 Jan 2023 07:36:53 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 78ed7b7d814d987601b30851546309b5
12a653dabfd738fef99fad2295eec55e4651bc7c
a55164c954f0255d6d360ac0fac8b4598f8e0e01ec646105eed2e9b0abf5e2bd
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=25497521895009284880638980971321625858&ts=1674603271373
200 OK 2 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=25497521895009284880638980971321625858&ts=1674603271373
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /id?d_visid_ver=3.2.0&d_fieldgroup=A&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&mid=25497521895009284880638980971321625858&ts=1674603271373 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://welcome.mariacasino.nu
access-control-allow-credentials: true
date: Tue, 24 Jan 2023 23:34:33 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash d43304199bad40026b0a60471f61f8eb
a755b53590e11ce8a8c28fbac7ced23dddca53c2
cfeb59fea10c5790cea59f5e396d48cdb0ed7de8bd53af9f62a3f9ec5ab76e03
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5363
Cache-Control: max-age=129678
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 23:34:33 GMT
Etag: "63cfada4-118"
Expires: Thu, 26 Jan 2023 11:35:51 GMT
Last-Modified: Tue, 24 Jan 2023 10:06:28 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 280
script.crazyegg.com/pages/scripts/0012/9242.js?465167
200 OK 2.6 kB URL HTTP/2 script.crazyegg.com/pages/scripts/0012/9242.js?465167
IP
File type ASCII text, with very long lines (6791), with no line terminators
Hash 534a90aa1339e1aa99302d3737819214
c729daffc55dbccf65d76a4c0091476d0b80ceac
ecb69e6c6d6a22fd0a55bb4b28f1473bd1058f0ae0660a86bc582600e14cf943
GET /pages/scripts/0012/9242.js?465167 HTTP/1.1
Host: script.crazyegg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
ce-version: 11.5.19
cache-control: public, max-age=300, s-maxage=1209600
cf-bgj: minify
cf-polished: origSize=6088
last-modified: Tue, 24 Jan 2023 18:58:00 GMT
timing-allow-origin: *
cf-cache-status: HIT
age: 16593
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec949a5846b4f3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
a10682170820.cdn.optimizely.com/client_storage/a10682170820.html
200 OK 1.0 kB URL HTTP/2 a10682170820.cdn.optimizely.com/client_storage/a10682170820.html
IP
File type HTML document, ASCII text, with very long lines (1985)
Hash f55700c7a0aeda20f6432e03f3eced66
55a3a245ce7b5fa5ef1b2fa5068f79a29a2c9d23
af9ced77e9dd057f46ec8c1965f8e66f4e3c182856529fe602f8b40d06cdc9c8
GET /client_storage/a10682170820.html HTTP/1.1
Host: a10682170820.cdn.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Fb0qi9LMAcgJc75pI4cTYrXNRF36d+yf0/HvDw/EaBy2JPgbmjcvL74FQ+jInXh7iBQjKn2IxbU=
x-amz-request-id: EWKPHZ27P09GQM57
x-amz-replication-status: COMPLETED
last-modified: Tue, 24 Jan 2023 16:30:07 GMT
etag: "2bdc9494099946012e7749fbaee9b9e6"
x-amz-server-side-encryption: AES256
x-amz-meta-pci_enabled: False
x-amz-version-id: 2zfbZfdBBu4UlQ0oXN6Ncp4Z9dI3PlzS
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
vary: Accept-Encoding
cache-control: max-age=120
x-akamai-transformed: 9 - 0 pmb=mRUM,2
content-encoding: gzip
date: Tue, 24 Jan 2023 23:34:33 GMT
content-length: 1041
server-timing: cdn-cache; desc=HIT, edge; dur=1, cdn;desc="AkamaiION";dur=0,rtt;desc="2";dur=0,cdnip;desc="104.110.8.48";dur=0,cdnmap;desc="a4728.x.akamaiedge.net";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s55743219451288?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%2023%3A34%3A31%202%200&mid=25497521895009284880638980971321625858&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=11%3A34%20PM%7CTuesday&v6=11%3A34%20PM%7CTuesday&v11=GBP&c14=New&v14=New&c16=1674603272&v21=Not%20Logged-In&c73=maria&c74=25497521895009284880638980971321625858&v99=25497521895009284880638980971321625858&v120=popunder&v121=1%3A81750185%3A92607737-37953&v122=NONE&v124=2397257&v125=81750185_134547E0B874426CBA71B52DAA21D1F4&v126=92607737&v127=37953&v134=1674603271&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
200 OK 43 B URL HTTP/2 unibetlondonltd.d3.sc.omtrdc.net/b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s55743219451288?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%2023%3A34%3A31%202%200&mid=25497521895009284880638980971321625858&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=11%3A34%20PM%7CTuesday&v6=11%3A34%20PM%7CTuesday&v11=GBP&c14=New&v14=New&c16=1674603272&v21=Not%20Logged-In&c73=maria&c74=25497521895009284880638980971321625858&v99=25497521895009284880638980971321625858&v120=popunder&v121=1%3A81750185%3A92607737-37953&v122=NONE&v124=2397257&v125=81750185_134547E0B874426CBA71B52DAA21D1F4&v126=92607737&v127=37953&v134=1674603271&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1
IP
File type GIF image data, version 89a, 2 x 2\012- data
Hash ad480fd0732d0f6f1a8b06359e3a42bb
a544538683a2dfe574eeb2e358ac8fcc78289d50
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
GET /b/ss/unibetlondonsinglepagebrandsprod/1/JS-2.22.4/s55743219451288?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%2023%3A34%3A31%202%200&mid=25497521895009284880638980971321625858&aamlh=6&ce=UTF-8&pageName=LP%3A2018%20-%20MariaCasino%20-%20Bingo&g=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&cc=GBP&ch=bf_landingpage&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=https%3A%2F%2Fwelcome.mariacasino.nu%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%3Fmktid%3D1%3A81750185%3A92607737-37953%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26bid%3D37953%26campaignId%3D2397257%26pid%3D92607737&v1=welcome.mariacasino.nu%3A%3A%3Adesktop%3Ano%3Apop%3Acasino%3A2022%3Aindex.html&c2=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&v2=bf_landingpage&v3=welcome.mariacasino.nu&v4=No%20CMS%5ENo%20ClientID%5ENo%20Locale%5ENo%20Juristiction&c6=11%3A34%20PM%7CTuesday&v6=11%3A34%20PM%7CTuesday&v11=GBP&c14=New&v14=New&c16=1674603272&v21=Not%20Logged-In&c73=maria&c74=25497521895009284880638980971321625858&v99=25497521895009284880638980971321625858&v120=popunder&v121=1%3A81750185%3A92607737-37953&v122=NONE&v124=2397257&v125=81750185_134547E0B874426CBA71B52DAA21D1F4&v126=92607737&v127=37953&v134=1674603271&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=F431E3BC5593E3887F000101%40AdobeOrg&AQE=1 HTTP/1.1
Host: unibetlondonltd.d3.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
date: Tue, 24 Jan 2023 23:34:33 GMT
expires: Mon, 23 Jan 2023 23:34:33 GMT
last-modified: Wed, 25 Jan 2023 23:34:33 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3596183147331452928-4619802952296203339
vary: *
content-type: image/gif;charset=utf-8
content-length: 43
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 5da05ea8ba99a0df153d4b9dc90a79f6
87eeec927ca676bb8a810569b10b7f14a73070ef
890a189361f30b8da31ea884cdfe0a952b52250645a0fa72871ad8de3cb9d893
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 24 Jan 2023 23:34:33 GMT
Last-Modified: Tue, 24 Jan 2023 22:11:57 GMT
Server: ECS (nyb/1D20)
X-Cache: Miss from cloudfront
Via: 1.1 193a8c13b6e0a6b90db7172f6358335e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: eXMSOiSV8s4bBDLnxJFN-9HDdSjhC9EbypiNGSwpfIp5p6dO1ySJzA==
Age: 4956
unibet.demdex.net/dest5.html?d_nsid=0
200 OK 2.8 kB URL HTTP/1.1 unibet.demdex.net/dest5.html?d_nsid=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Hash ccbdcb1e84c241950763ec4cd516cdfc
55dfa8d4b09c5c3a80fcd101152f6ebed3d27a2c
de9ccb9b168945a24f20edc28c39be4135b328129ba8ee378401a7aedc925d12
GET /dest5.html?d_nsid=0 HTTP/1.1
Host: unibet.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Tue, 24 Jan 2023 23:34:33 GMT
DCS: dcs-prod-irl1-1-v045-0a637d725.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 28 Oct 2022 11:02:56 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: nrBzPHGpSuc=
Content-Length: 2791
Connection: keep-alive
cm.everesttech.net/cm/dd?d_uuid=25524941725783358590635236489523851417
302 0 B URL HTTP/1.1 cm.everesttech.net/cm/dd?d_uuid=25524941725783358590635236489523851417
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cm/dd?d_uuid=25524941725783358590635236489523851417 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302
Date: Tue, 24 Jan 2023 23:34:33 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~Y9BrCQAAAJn30AN-; Domain=.everesttech.net; Expires=Wed, 24-Jan-2024 23:34:33 GMT; Path=/
everest_session_v2=Y9BrCQAAAJn30QN-; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
Server: AMO-cookiemap/1.1
dpm.demdex.net/ibs:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
302 Found 0 B URL HTTP/1.1 dpm.demdex.net/ibs:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ibs:dpid=411&dpuuid=Y9BrCQAAAJn30AN- HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.mariacasino.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-1-v045-02fbabcd7.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=58410619565589325620617867252137488046; Max-Age=15552000; Expires=Sun, 23 Jul 2023 23:34:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: DgeewAT8SZI=
Content-Length: 0
Connection: keep-alive
tapi.optimizely.com/api/targeting/10682170820/11101493565/oeu1674603271294r0.4293952303053159
200 OK 2.6 kB URL HTTP/1.1 tapi.optimizely.com/api/targeting/10682170820/11101493565/oeu1674603271294r0.4293952303053159
IP
File type JSON data\012- , ASCII text, with very long lines (27117), with no line terminators
Hash 5a6097108f89b730163e427800563d7d
ea0d27538078b24ad001c9f289d50406e3c8621b
7eb9eafb04bb36fada9f39aa5bc64afdca3894e39bcc06707648f350f4db9a88
GET /api/targeting/10682170820/11101493565/oeu1674603271294r0.4293952303053159 HTTP/1.1
Host: tapi.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Server: nginx/1.15.12
X-Powered-By: Express
Content-Encoding: gzip
Cache-Control: max-age=1200
Date: Tue, 24 Jan 2023 23:34:33 GMT
Content-Length: 2568
Connection: keep-alive
Vary: Origin
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
200 OK 59 B URL HTTP/1.1 dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y9BrCQAAAJn30AN-
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y9BrCQAAAJn30AN- HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://welcome.mariacasino.nu/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-2-v045-01a6f2a00.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: ghyENn0BS38=
Content-Length: 59
Connection: keep-alive
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
200 OK 1.4 kB URL HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
IP
Hash ab8cdc21adb95a3014aae857022fdce6
c90f3f115de66b8809a88a667225fa5746ca3dfa
2e3db22559903bd6ba695a18b440ff7eeb0a645dc4ab9257c3605f22d144ca51
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "6444bceb1b767bea75b4f47d793f7b05:1554112917"
last-modified: Mon, 01 Apr 2019 10:01:57 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1388
cache-control: max-age=3600
expires: Wed, 25 Jan 2023 00:34:33 GMT
date: Tue, 24 Jan 2023 23:34:33 GMT
access-control-allow-origin: https://welcome.mariacasino.nu
timing-allow-origin: *
X-Firefox-Spdy: h2
unibet.demdex.net/event?_ts=1674603271913
200 OK 28 B URL HTTP/1.1 unibet.demdex.net/event?_ts=1674603271913
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash e5bd7bffaebc3b6f39a51600d7d98448
3126b0beaa77359162cadfebc3ae83b4cf5d04f8
3f4e5ede55abc3d3c77d99cdc5019ccfaf8107ac33328b1e4d3b022cb10b15d8
POST /event?_ts=1674603271913 HTTP/1.1
Host: unibet.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-2-v045-0f9127447.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=70474243512436180852509769732618372401; Max-Age=15552000; Expires=Sun, 23 Jul 2023 23:34:33 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: WSw1U9RxQnk=
Content-Length: 28
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 82fbd81261170d0490531991464af825
78eabcfe98c56a9343c713ffdc83c89303c0a101
6db764f921d89e69f41b2da9d6fb14fecad3f8d8b45114930421efbc50aa8f46
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=103803
Date: Tue, 24 Jan 2023 23:34:33 GMT
Etag: "63cf5c3e-1d7"
Expires: Thu, 26 Jan 2023 04:24:36 GMT
Last-Modified: Tue, 24 Jan 2023 04:19:10 GMT
Server: ECS (bsa/EB24)
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: pV-M559gJnwqVkV_nlym-80b3YMsXoj8TFyhT4jP8_wqnHaSMF4QOA==
Age: 326
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 82fbd81261170d0490531991464af825
78eabcfe98c56a9343c713ffdc83c89303c0a101
6db764f921d89e69f41b2da9d6fb14fecad3f8d8b45114930421efbc50aa8f46
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=109676
Date: Tue, 24 Jan 2023 23:34:33 GMT
Etag: "63cf5c3e-1d7"
Expires: Thu, 26 Jan 2023 06:02:29 GMT
Last-Modified: Tue, 24 Jan 2023 04:19:10 GMT
Server: ECS (nyb/1D2C)
X-Cache: Miss from cloudfront
Via: 1.1 193a8c13b6e0a6b90db7172f6358335e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: MXWNgbCwKmcnKrkgNpTdKCJh-fhySDUTDaJNMIhq6l0WkDKej01HCA==
Age: 6199
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 82fbd81261170d0490531991464af825
78eabcfe98c56a9343c713ffdc83c89303c0a101
6db764f921d89e69f41b2da9d6fb14fecad3f8d8b45114930421efbc50aa8f46
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 24 Jan 2023 23:34:33 GMT
Last-Modified: Tue, 24 Jan 2023 23:29:06 GMT
Server: ECS (nyb/1D17)
X-Cache: Miss from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: BXQFrOxXkv9grNodWEamNHmyvv-M6b6qbzhkwkNKWySWXdift7SaXQ==
Age: 329
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 82fbd81261170d0490531991464af825
78eabcfe98c56a9343c713ffdc83c89303c0a101
6db764f921d89e69f41b2da9d6fb14fecad3f8d8b45114930421efbc50aa8f46
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=109676
Date: Tue, 24 Jan 2023 23:34:33 GMT
Etag: "63cf5c3e-1d7"
Expires: Thu, 26 Jan 2023 06:02:29 GMT
Last-Modified: Tue, 24 Jan 2023 04:19:10 GMT
Server: ECS (nyb/1D2C)
X-Cache: Miss from cloudfront
Via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ngYDNnpuXnJuEXptNFK7idOI8Nen76tnHqMTcdseznLSHBrG6QCtFQ==
Age: 6199
tapi.optimizely.com/api/js/odds/project/10682170820?project=10682170820
200 OK 168 B URL HTTP/1.1 tapi.optimizely.com/api/js/odds/project/10682170820?project=10682170820
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7b92c056eea084fe960d8794d6c70a77
79318285c26c4220bbaa81aefbca57f091a20461
cc75a166bb638f022304459d8a9060c384b03bdb1892e7e9f15b6cd6f17fd4d3
GET /api/js/odds/project/10682170820?project=10682170820 HTTP/1.1
Host: tapi.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Server: nginx/1.15.12
X-Powered-By: Express
Content-Length: 168
Expires: Tue, 24 Jan 2023 23:34:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 24 Jan 2023 23:34:34 GMT
Connection: keep-alive
X-Uncacheable: WTF
Vary: Origin
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
errors.client.optimizely.com/log
200 OK 13 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
File type ASCII text, with no line terminators
Hash 1424eb76249899d757e4d168341a50dc
42101e71440abd46c8112a96d4d5c0dd445120ce
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
OPTIONS /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://welcome.mariacasino.nu/
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Max-Age: 1800
Allow: POST,OPTIONS
Content-Type: text/plain
Date: Tue, 24 Jan 2023 23:34:34 GMT
Content-Length: 13
Connection: keep-alive
errors.client.optimizely.com/log
200 OK 13 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
File type ASCII text, with no line terminators
Hash 1424eb76249899d757e4d168341a50dc
42101e71440abd46c8112a96d4d5c0dd445120ce
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
OPTIONS /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://welcome.mariacasino.nu/
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Max-Age: 1800
Allow: POST,OPTIONS
Content-Type: text/plain
Date: Tue, 24 Jan 2023 23:34:34 GMT
Content-Length: 13
Connection: keep-alive
errors.client.optimizely.com/log
204 No Content 0 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 480
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers:
Content-Type: text/plain
Date: Tue, 24 Jan 2023 23:34:34 GMT
Connection: keep-alive
errors.client.optimizely.com/log
204 No Content 0 B URL HTTP/1.1 errors.client.optimizely.com/log
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /log HTTP/1.1
Host: errors.client.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 435
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers:
Content-Type: text/plain
Date: Tue, 24 Jan 2023 23:34:34 GMT
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash e09c726ff341fa441fe40948789d496a
f8655cca79a983abf1bc3c3e7930322b48ee03b3
02c93c1cdbc8ed47e07fd410085a45a903ae524315d5e599ecd5c313ff852231
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=115045
Date: Tue, 24 Jan 2023 23:34:34 GMT
Etag: "63cf8511-1d7"
Expires: Thu, 26 Jan 2023 07:31:59 GMT
Last-Modified: Tue, 24 Jan 2023 07:13:21 GMT
Server: ECS (nyb/1D05)
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: x0O2y1O-vNZ3fEcvaNI1pZIZI8X0y-2f6RYuYiW_FP0WXyZboZubpQ==
Age: 1118
logx.optimizely.com/v1/events
204 No Content 0 B URL HTTP/1.1 logx.optimizely.com/v1/events
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/events HTTP/1.1
Host: logx.optimizely.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 740
Origin: https://welcome.mariacasino.nu
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://welcome.mariacasino.nu
Access-Control-Expose-Headers: X-Results-Data-Source
Content-Type: text/plain
Date: Tue, 24 Jan 2023 23:34:34 GMT
Server: nginx/1.21.0
Timing-Allow-Origin: *
X-Request-Id: 64e74890-32c9-4d9e-829a-306c769c054a
Connection: keep-alive
boustahe.com/pfe/current/universal.min.js?v=3.1.413
200 OK 0 B URL HTTP/2 boustahe.com/pfe/current/universal.min.js?v=3.1.413
IP
GET /pfe/current/universal.min.js?v=3.1.413 HTTP/1.1
Host: boustahe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kuroviral.com/
Origin: https://kuroviral.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:27 GMT
content-type: application/javascript
last-modified: Tue, 24 Jan 2023 14:31:33 GMT
etag: W/"63cfebc5-18c6c"
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
for-j.com/tds3.html?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&sourceid=722514&tt=2
200 OK 0 B URL HTTP/2 for-j.com/tds3.html?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&sourceid=722514&tt=2
IP
GET /tds3.html?zoneid=5652304&ymid=1c7afac00da0d05822aecf275b879674&sourceid=722514&tt=2 HTTP/1.1
Host: for-j.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jennyvisits.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:30 GMT
content-type: text/html
last-modified: Wed, 02 Nov 2022 11:31:57 GMT
cf-cache-status: HIT
age: 1792700
expires: Fri, 24 Feb 2023 23:34:30 GMT
cache-control: public, max-age=2678400
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec948709f7b51b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bedrapiona.com/5/5499564/?oo=1&js_build=iclick-v1.473.0
200 OK 0 B URL HTTP/2 bedrapiona.com/5/5499564/?oo=1&js_build=iclick-v1.473.0
IP
GET /5/5499564/?oo=1&js_build=iclick-v1.473.0 HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kuroviral.com
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:28 GMT
content-type: application/json
x-trace-id: a8e1ba2b9a43e352801dd04c651a342a
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: https://kuroviral.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=69b453bf96004695a6dd8df21721d2ed; expires=Wed, 24 Jan 2024 23:34:28 GMT; path=/; secure; SameSite=None
oaidts=1674603268; expires=Wed, 24 Jan 2024 23:34:28 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/styles.css
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/styles.css
IP
GET /no/pop/casino/2022/styles.css HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: text/css; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: nHGY+uZf3VZaIBaHkSPKCQ==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: W/"0x8DAD20EA45DDAAB"
x-ms-request-id: 4ad10bc9-001e-002e-3ef7-034015000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35721
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b31fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/background.jpg
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/background.jpg
IP
GET /no/pop/casino/2022/background.jpg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/styles.css
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19382%7CMCMID%7C25497521895009284880638980971321625858%7CMCAAMLH-1675208071%7C6%7CMCAAMB-1675208071%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674610471s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1674603271294r0.4293952303053159; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: image/jpeg
content-length: 161606
access-control-allow-origin: *
cache-control: public, max-age=900, immutable
cf-bgj: h2pri
content-md5: qiee41e0FfUKFhJ9XBp8TQ==
etag: "0x8DAD20EA4B90CD2"
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 5e1e980c-701e-001b-01f7-032c01000000
x-ms-version: 2014-02-14
cf-cache-status: HIT
age: 35783
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94992c52fabc-OSL
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/no-payments.svg
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/no-payments.svg
IP
GET /no/pop/casino/2022/no-payments.svg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19382%7CMCMID%7C25497521895009284880638980971321625858%7CMCAAMLH-1675208071%7C6%7CMCAAMB-1675208071%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674610471s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1674603271294r0.4293952303053159; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: eFf1+jVlHZeVusUSI4yq9A==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA5185D10"
x-ms-request-id: 6aee9ace-401e-005d-3bf7-031886000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35745
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94996c61fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700
IP
GET /css?family=Droid+Sans%3Aregular%2C700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 24 Jan 2023 23:34:26 GMT
date: Tue, 24 Jan 2023 23:34:26 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
buzzonclick.com/jump/next.php?stamat=m%257C%252CQoiNWY2OqB1dQO0dEdHP3xP.ab2%252CS0kXXHXf2ck-DOZ9HRvwuJT99mPrzcjyKLEH6rCCDo3XafGTcCdMV04yYm82VmN6jqcS4pyk7rlUeMwK4Z7xNQ%252C%252C&cbpage=https://buzzonclick.com/jump/next.php?r=5623198&sub1=5652304&rdk=rk1&cbur=0.46261418655545017&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref=
302 Found 0 B URL HTTP/2 buzzonclick.com/jump/next.php?stamat=m%257C%252CQoiNWY2OqB1dQO0dEdHP3xP.ab2%252CS0kXXHXf2ck-DOZ9HRvwuJT99mPrzcjyKLEH6rCCDo3XafGTcCdMV04yYm82VmN6jqcS4pyk7rlUeMwK4Z7xNQ%252C%252C&cbpage=https://buzzonclick.com/jump/next.php?r=5623198&sub1=5652304&rdk=rk1&cbur=0.46261418655545017&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref=
IP
GET /jump/next.php?stamat=m%257C%252CQoiNWY2OqB1dQO0dEdHP3xP.ab2%252CS0kXXHXf2ck-DOZ9HRvwuJT99mPrzcjyKLEH6rCCDo3XafGTcCdMV04yYm82VmN6jqcS4pyk7rlUeMwK4Z7xNQ%252C%252C&cbpage=https://buzzonclick.com/jump/next.php?r=5623198&sub1=5652304&rdk=rk1&cbur=0.46261418655545017&cbtitle=&cbiframe=0&cbWidth=1280&cbHeight=939&cbdescription=&cbkeywords=&cbref= HTTP/1.1
Host: buzzonclick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 302 Found
server: openresty
date: Tue, 24 Jan 2023 23:34:31 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://buzzonclick.com/script/i.php?stamat=m%257C%252C%252CwiE-tiLitGU3B_-GH0dEdHP3xP.e7f%252Ct4s0oJEEc6oeQ76gDKcT1U3EwE72SlGKyvNp-EWOmu66ZtWyGedHltNspirJYaUXfxJXaIv8LALimvnbCPUwQD0aFzqbkp2GrRMnaJuTbd-cdmoaQ1aLsVYOHxvsAt3SJ5or2kokAPJbL_dBBcO1t28-5mwKHhHxnCbNDV5S2Hv6FUiruMUEfJftRvpMfGoRRE1cm07EP9VxDmgpOA516F4tRHIYZpdRZAkCTkZTYYAQA9HzfXkdCNQiXy3v8WZAIp4aU9_Wgs91BzcAN7Qe3UXSU6VABvikxxdqJ-IXxWEc9VUS7A2BMNMMYmLr9rmi7PYYPt4Ne6vbmFvoO_NSeqNTdhKyrJLLmtKNs6lOuuC3igBAnYAtLg48iBUmiJSyZk5q1RuVWvWk4aSfSFHDVCmaGAu846TzO49VnBGlbPb50GCmLsXNr7Tg-TKtP-Y1HiSEZcy5-sf4oIZfxrdJ86vrPjtvEFUHIV1vyvOdDhBhCyToPCDv2Tqes4iBslWAWOJp2caKuuCN2ESngiv4HPt3UbCpK_3B_WoDhxV4w4XT34YINsmxSTEBc908DBKJ
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
IP
GET /no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737 HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: text/html; charset=utf-8
cache-control: public, max-age=900, immutable
content-md5: L2akXslp2trAwResQfYe7w==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
x-ms-request-id: 522a961d-f01e-0058-7d4c-30ca5d000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: MISS
vary: Accept-Encoding
set-cookie: btag=81750185_134547E0B874426CBA71B52DAA21D1F4;max-age=2592000; domain=.mariacasino.nu;path=/;secure;samesite=none;httponly
server: cloudflare
cf-ray: 78ec9494ca65fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/custom.js
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/custom.js
IP
GET /custom.js HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: application/javascript
content-md5: AaOIILzruhXFCZo/dsUAMw==
last-modified: Tue, 31 May 2022 08:03:43 GMT
etag: W/"0x8DA42DC14A64A3D"
x-ms-request-id: 56b93167-801e-0020-39f6-0369a5000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 36337
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b39fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/maria-logo.svg
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/maria-logo.svg
IP
GET /no/pop/casino/2022/maria-logo.svg HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:32 GMT
content-type: image/svg+xml
cache-control: public, max-age=900, immutable
content-md5: A/evXSZJMSEi63VEXU58wA==
last-modified: Tue, 29 Nov 2022 13:35:55 GMT
etag: W/"0x8DAD20EA476B63E"
x-ms-request-id: 5a1280b9-401e-0062-10f7-03d025000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35720
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec94968b3afabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
IP
GET /css?family=Roboto:300,400,500,700,900 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 24 Jan 2023 23:34:32 GMT
date: Tue, 24 Jan 2023 23:34:32 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
200 OK 0 B URL HTTP/2 kuroviral.com/2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html
IP
GET /2023/01/update-link-full-videos-of-ice-spice-leaked-eating-munch-on-twitter-and-reddit.html HTTP/1.1
Host: kuroviral.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:26 GMT
content-type: text/html; charset=UTF-8
link: <https://kuroviral.com/wp-json/>; rel="https://api.w.org/", <https://kuroviral.com/wp-json/wp/v2/posts/2933>; rel="alternate"; type="application/json", <https://kuroviral.com/?p=2933>; rel=shortlink
last-modified: Tue, 24 Jan 2023 23:00:59 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dfRuu4cLuh1eov%2Fak1kOtJK2%2FE%2BzgGg42CVDojmRNabUqNzPw7CWrfI19Wbwx4Feew04k3nZmvbsorjqCl%2Bwa71PQPKNq5rDS5YzVYHhf2fRW8ghbnKjHP9SdSlMVu4b"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 78ec946f3a8f1c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
boustahe.com/pfe/current/tag.min.js?z=5507411
200 OK 0 B URL HTTP/2 boustahe.com/pfe/current/tag.min.js?z=5507411
IP
GET /pfe/current/tag.min.js?z=5507411 HTTP/1.1
Host: boustahe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kuroviral.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 23:34:26 GMT
content-type: application/javascript
last-modified: Tue, 24 Jan 2023 14:31:33 GMT
etag: W/"63cfebc5-390a"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
welcome.mariacasino.nu/no/pop/casino/2022/favicon.ico
200 OK 0 B URL HTTP/2 welcome.mariacasino.nu/no/pop/casino/2022/favicon.ico
IP
GET /no/pop/casino/2022/favicon.ico HTTP/1.1
Host: welcome.mariacasino.nu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://welcome.mariacasino.nu/no/pop/casino/2022/index.html?mktid=1:81750185:92607737-37953&btag=81750185_134547E0B874426CBA71B52DAA21D1F4&bid=37953&campaignId=2397257&pid=92607737
Cookie: __ucbt=node01392v0p9yx9rvy6jlt1ef0vzd; uniattr=ST.0.T; uniattr_ref=; campaignId=2397257; framework.forceBigLandingArea=; affiliateId=1; B-TAG=81750185_134547E0B874426CBA71B52DAA21D1F4; BID=37953; PID=92607737; AFFILIATE_REQUEST_URL=https%3A%2F%2Fwww.mariacasino.nu%2Fstan%2Fcampaign.do%3FcmpId%3D2397257%26affiliateId%3D1%26unibetTarget%3D%2Fno%2Fpop%2Fcasino%2F2022%2Findex.html%26targetDomain%3Dhttps%3A%2F%2Fwelcome.mariacasino.nu%26btag%3D81750185_134547E0B874426CBA71B52DAA21D1F4%26sref%3DADC%26ADC%3D5623198-1579691880-0_Adcash%26affiliateId%3D1%26pid%3D92607737%26bid%3D37953; AFFILIATE_CAMPAIGN_ID=2397257; btag=81750185_134547E0B874426CBA71B52DAA21D1F4; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19382%7CMCMID%7C25497521895009284880638980971321625858%7CMCAAMLH-1675208071%7C6%7CMCAAMB-1675208071%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674610471s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; optimizelyEndUserId=oeu1674603271294r0.4293952303053159; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Tue, 24 Jan 2023 23:34:33 GMT
content-type: image/x-icon
cache-control: public, max-age=900, immutable
content-md5: dUZ66nye8JES1X2nEnkvHA==
last-modified: Tue, 29 Nov 2022 13:35:56 GMT
etag: W/"0x8DAD20EA4D12531"
x-ms-request-id: 1b22010b-f01e-0058-65f7-03ca5d000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
cf-cache-status: HIT
age: 35519
vary: Accept-Encoding
server: cloudflare
cf-ray: 78ec949a3cc0fabc-OSL
content-encoding: br
X-Firefox-Spdy: h2
172.67.167.104
104.18.9.13
18.201.4.185
139.45.197.234
13.37.25.97
104.110.7.230
95.100.12.199
85.184.96.5
35.156.167.37