POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4CD1772D378248E886EE96F55D956FF0856BA3F2EAE9F15A10136E68F450CA70"
Last-Modified: Fri, 12 Jul 2024 11:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11153
Expires: Fri, 12 Jul 2024 22:52:14 GMT
Date: Fri, 12 Jul 2024 19:46:21 GMT
Connection: keep-alive

GET / HTTP/1.1
Host: rule34video.arielfuuk.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx/1.24.0 (Ubuntu)
Date: Fri, 12 Jul 2024 19:46:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Referrer-Policy: no-referrer
Location: http://href.li/?http://runative-syndicate.com/api/v1/direct/0c83054d59f7412da4bd091bc04cb177?extid={extid}

GET /api/v1/direct/0c83054d59f7412da4bd091bc04cb177?extid={extid} HTTP/1.1
Host: runative-syndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Fri, 12 Jul 2024 19:46:22 GMT
content-length: 0
pragma: no-cache
expires: 0
vary: *
x-api-version: 2
location: https://u-9125.topduppy.info/api/rtb-pops/go?id=3061558223756713&sig=e343ae8c839c3d348ed562a8159c03&u=aHR0cHM6Ly9nc3RndWouY29tL2N1aGRsP3doPVhyQXZmV1VkY1Q2ZlVKRHNERXNxU2wtcSZjbGlja2lkPXtjbGlja19pZH0mc2kxPXtzdWJfaWR9
x-request-id: a9ea3cc9c65b37c2
set-cookie: ts_uid=64b476e0-3ce5-4b5b-a550-6200ca9f9a9e; expires=Sun, 12 Jan 2025 19:46:22 GMT; domain=.runative-syndicate.com; path=/; HttpOnly; secure; SameSite=None
ts_last_click_id=ZUIED56PPE3yTNce_-s0VhKCRcDrApAvyPDMsFLl4EDZcAA4IAb_oK2v811zbeyCxgUkpQNzBNUy1ZR7XQqBrRM8DYfWcnxu_ACgiw_gUIDRUi; expires=Fri, 19 Jul 2024 19:46:22 GMT; domain=.runative-syndicate.com; path=/; HttpOnly; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.runative-syndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
X-Firefox-Spdy: h2

GET /api/rtb-pops/go?id=3061558223756713&sig=e343ae8c839c3d348ed562a8159c03&u=aHR0cHM6Ly9nc3RndWouY29tL2N1aGRsP3doPVhyQXZmV1VkY1Q2ZlVKRHNERXNxU2wtcSZjbGlja2lkPXtjbGlja19pZH0mc2kxPXtzdWJfaWR9 HTTP/1.1
Host: u-9125.topduppy.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 12 Jul 2024 19:46:22 GMT
content-type: text/html; charset=UTF-8
location: https://gstguj.com/cuhdl?wh=XrAvfWUdcT6fUJDsDEsqSl-q&clickid=NnF6N3xkYXp8OWhjbXFufFcxb3FtZz09fDMwNjE1NTgyMjM3NTY3MTN8MA==&si1=3537333333383339395f3137323433
referrer-policy: no-referrer
set-cookie: pop-u-id=a5ed0a6e450ab6228bdda831b9f31632a%3A2%3A%7Bi%3A0%3Bs%3A8%3A%22pop-u-id%22%3Bi%3A1%3Bs%3A33%3A%22dc26782a937912f526d0857215db6ed83%22%3B%7D; expires=Wed, 11-Jul-2029 19:46:22 GMT; Max-Age=157680000; path=/; HttpOnly; SameSite=None
pop-u-uni-dc2678=d868806d8b779204f967f45534c862b0a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22pop-u-uni-dc2678%22%3Bi%3A1%3Bs%3A2%3A%22no%22%3B%7D; expires=Sat, 13-Jul-2024 19:46:22 GMT; Max-Age=86400; path=/; HttpOnly; SameSite=None
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpa03oLq6AFJ9XahQEnUPZY3%2B6HDlIMAOB3bTR1rBReUypjFL9kSH235pwT1%2FBrvpW0YkmNtNs%2By9bodMnESAOpwxXgmuo5NSMNbifIvkIqcchqKOFCrwCc%2BjfbeoCOiR%2BeCmzuAgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a2389fa9a85b4fd-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "3E28EA2CEDE92DAE0F7BFCD98EAF9BD016AB8ECC4EA81B7E8F7B90BA4E20AA40"
Last-Modified: Wed, 10 Jul 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16674
Expires: Sat, 13 Jul 2024 00:24:17 GMT
Date: Fri, 12 Jul 2024 19:46:23 GMT
Connection: keep-alive

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "3E28EA2CEDE92DAE0F7BFCD98EAF9BD016AB8ECC4EA81B7E8F7B90BA4E20AA40"
Last-Modified: Wed, 10 Jul 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16674
Expires: Sat, 13 Jul 2024 00:24:17 GMT
Date: Fri, 12 Jul 2024 19:46:23 GMT
Connection: keep-alive

GET / HTTP/1.1
Host: runative-syndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Server: nginx
Date: Fri, 12 Jul 2024 19:46:25 GMT
Connection: keep-alive
X-Request-Id: 6ee041dcfb70fe7d
Cache-Control: no-transform
X-Robots-Tag: none, noindex, nofollow
Report-To: { "url": "https://pxl.runative-syndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }

GET /cuhdl?wh=XrAvfWUdcT6fUJDsDEsqSl-q&clickid=NnF6N3xkYXp8OWhjbXFufFcxb3FtZz09fDMwNjE1NTgyMjM3NTY3MTN8MA==&si1=3537333333383339395f3137323433 HTTP/1.1
Host: gstguj.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Fri, 12 Jul 2024 19:46:22 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tF0n7lYr8gCXMsuupxmYpiz15yuAULCle0%2BYGZJBBgjo4oxIAD2Y%2FWs%2BtWbEs5Bc45r1vE1W%2BNghZvMb7CYeRdMD1cufHQVXwLyE738rSIfVINZVCKdSx2mFEOo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8a2389fb795756bd-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET /?http://runative-syndicate.com/api/v1/direct/0c83054d59f7412da4bd091bc04cb177?extid={extid} HTTP/1.1
Host: href.li
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 12 Jul 2024 19:46:21 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding
content-encoding: br
x-ac: 3.arn _dca MISS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2