petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
200 OK 30 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3561)
Hash a774396d409048f438bb7f4e60efa40f
1ed88fce7891815be868a0524e50a4685476226f
c927921b991884bc96cf6cbc00d14dbeafa9000415c8b58f23110eb53033e4e9
Analyzer Verdict Alert fortinet Phishing
GET /n/27/4/z-nrg/nz/index.html HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:19 GMT
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: jjYx7c2h9j-pP3sQArsiY2ygIG0cr0bdTjssheaariyq4MWGCDRcdg==
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bcdebf7a2bad5db595e8a0c1abb2ddcb
249dda2fa5e37b8a8f3a8c797193bf0874b6eedc
9b43ec48b16f96449208a0094c4d660806a2a2d344b5862dbff4c393bf3f9f9f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9B43EC48B16F96449208A0094C4D660806A2A2D344B5862DBFF4C393BF3F9F9F"
Last-Modified: Thu, 01 Sep 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3127
Expires: Fri, 02 Sep 2022 18:30:26 GMT
Date: Fri, 02 Sep 2022 17:38:19 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash b593eb39329cfe060d55be5e4a5405e2
78e46c1028e9f94f8569303ad2d90d7df13a059a
08a810103557efe55ca4425ff0cf82593f1f54633df899127eaec9bee05d4d04
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, Alert, Content-Length, Content-Type, Backoff
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 02 Sep 2022 16:41:51 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 69Oa6cqf8CTAUcVfi_qdGlFn9eg58pJQUl6M7RsJk3xIP06K_5wUCA==
Age: 3388
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
IP
File type PEM certificate\012- , ASCII text
Hash 742edb4038f38bc533514982f3d2e861
cc3a20c8dc2a8c632ef9387a2744253f1e3fdef1
b6bfa49d3d135035701231db2fffc0c0643444394009a94c6a1b4d829d6b8345
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 20 Aug 2022 23:18:05 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 02 Sep 2022 01:15:17 GMT
etag: "742edb4038f38bc533514982f3d2e861"
x-cache: Hit from cloudfront
via: 1.1 501ad2910f631f0520a6d389d6f053e8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: wIjfkwK8fCBfTTLYy1LztqCb8Uwic2xvUA4R2jkrzmz_kpB0B80n5Q==
age: 58982
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Sep 2022 17:38:20 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
petrol.clientoffer.site/n/27/assets/css/fonts.css
200 OK 315 B URL HTTP/1.1 petrol.clientoffer.site/n/27/assets/css/fonts.css
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash bf204738cc45ba40ddbc1833f7e3fd08
c1cd4d940ed2679bf940e09e5048c914d224cf52
f5e322bbdb5b74a13a08dbe967d05a3554e3547d48aa1789663d677056921ad8
GET /n/27/assets/css/fonts.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:31 GMT
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: tE3g5yPihxoWygg74QFg5OIcWnAwvzG9aU1kfNFAJGnCED_MSj4KFA==
Age: 17749
petrol.clientoffer.site/n/27/4/z-nrg/nz/js/teaser_nojquery.js
200 OK 1.0 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/js/teaser_nojquery.js
IP
Hash d4965532d96c2523a7153f3c1fefc466
2ae12831b5515dd10bfb7796f05228ef926d0d55
bc28164cfaffb986af6d84738442b09e72460c7fdd664bad4998f138202e7d99
Analyzer Verdict Alert fortinet Phishing
GET /n/27/4/z-nrg/nz/js/teaser_nojquery.js HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: W/"63120282-e9c"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: NzMoMUnpGzsGBKI68OQqdS8URhHGciGYD68o5ZpnJ93SGcaX78KFfQ==
petrol.clientoffer.site/n/27/4/z-nrg/nz/css/main.css
200 OK 6.0 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/css/main.css
IP
Hash e527201d3799a2e9ea272fbdbe37f73f
7ee4b37d659a817c5d5a35fec1ac9fad931a27b2
8f4593f8fdaf94649f21166d61dedecc18384946c7eb6812179f16995fa9d200
GET /n/27/4/z-nrg/nz/css/main.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: W/"63120282-898b"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: zy8qKpkO9kv_kokPCiiDggI9ZtKtL5TL8o36fHcj6jlXxDzbkKCS-g==
petrol.clientoffer.site/ssi/elements/base/comments/style.css
200 OK 1.7 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/style.css
IP
Hash 91475322340fa642a4531f400dfcc171
59a816a13752c6db0c6c7d3cc86b99ec155ffea1
133c168dd64dbdb5534630d44d3bde6f3899553c65f236f90583a05c91686591
GET /ssi/elements/base/comments/style.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:31 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: W/"6311c1f6-14cc"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: B9sd96IaJQ5pQa0pj4pbXeuheZxJvYsz1GysFJB_OtVXlvTpXmh9DA==
Age: 17749
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 20cc30f2a41f9c5e824ea46460548950
c153b447d44cbbe8f30d7f490605d1a430af20a1
0f8bb96e7dfd8a6bb3d7eae1a958195cb8ca9f20e0ad8cd952c34267ff0625f3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
petrol.clientoffer.site/n/27/4/z-nrg/nz/css/style.min.css
200 OK 2.8 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/css/style.min.css
IP
Hash f80dbd8f3dd302e79ad2d52a0eaee8ff
3d37eab7ce4ec5672e9aecb86fd7608866452931
cbe252fcd06ab3f0e3598e75abcb41f125720f8a8b3fd80bd7a656fd625cf033
GET /n/27/4/z-nrg/nz/css/style.min.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: W/"63120282-34a2"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: GuUKc6rxJ9G8u8TjC-eskSKaqdCdmXkASzV4-iw3YgNIJFM6pqL1zA==
petrol.clientoffer.site/ssi/elements/base/comments/fbcoms.min.css
200 OK 828 B URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/fbcoms.min.css
IP
Hash ee995f01cddcc3b3c717067caec705c3
088cec3db9935a70070a50b5db5e41eccff6520c
e75f19dace54b1fd8e08a5743d9ee3413be9aadc8b9df423e6db0875075487b1
GET /ssi/elements/base/comments/fbcoms.min.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 828
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:31 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-33c"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: P4rrOhAMFdtoX6WOIfNI1OieriwJSdBctA_7X2GhrtEcHsQfrAZIyg==
Age: 17749
petrol.clientoffer.site/ssi/elements/base/comments/fbcom.js
200 OK 362 B URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/fbcom.js
IP
Hash d91c65ab07c7b659532f735bc3266d35
e04379a0f107ef0639cfb9bb85448e091d4242b4
36bec173b109104f5817846a3d09bcdb07bf1c0c85c8ad6be8577861258a0b90
Analyzer Verdict Alert fortinet Phishing
GET /ssi/elements/base/comments/fbcom.js HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:33 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: W/"6311c1f6-4de"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Q_SZ7qk5e_PHuYkRUZ-ptGGMVK8TbVGdxlZ1xIUwsQRbbvo7_itJzA==
Age: 17747
petrol.clientoffer.site/ssi/elements/base/comments/comment7.jpg
200 OK 1.5 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment7.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash 13e3863ddf9ec66e74794a43955a82aa
176abd806ea55961d5f035d0589861864752eaa5
a98374e6ddf8e424cf2e60899912358531a04e42f74943f717730dc8349fe096
GET /ssi/elements/base/comments/comment7.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1461
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:34 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-5b5"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 1MihsNNA3NWPz7eDtQrvo8Pom4M84fEl7_7hmb87SKHFMoZ5Ck4pzA==
Age: 17746
petrol.clientoffer.site/ssi/elements/base/comments/comment10.jpg
200 OK 1.4 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment10.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash 733b1af1054c6b374e7a2e283c0488c3
1f98a33203a064b43b101966e5b5c439d65b1d18
48771158b0cefed12d509da968dc6ad98fed75d6317982854f012d68bb6b7755
GET /ssi/elements/base/comments/comment10.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1383
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:33 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-567"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: AMbC1mJz_CmgXSGdg2MWSZw5pYPGUZVfi56eatFbRJZwIOV3brjGSA==
Age: 17747
petrol.clientoffer.site/ssi/elements/base/comments/comment1.jpg
200 OK 1.4 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment1.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash 8a7c43a73eddd2e9ece5f84986c8d38a
4ee82a68568735d8d55cd23573a02a27e250766a
701f4a6b59464cd1c4d3d5a4a3a03b7b325e9e05e5c40b895857e9a53b24172f
GET /ssi/elements/base/comments/comment1.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1405
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:36 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-57d"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: zOnNbnHXtNUN9HkJr5G6TIFoyuAh-LZaxK2qKgEYi8Hq0LWFIp0JwQ==
Age: 17744
petrol.clientoffer.site/ssi/elements/base/comments/comment5.jpg
200 OK 1.6 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment5.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash e1e1c4d1673d0daca69e4d04bcffe826
22a7bafb65fc73960b19cbaa172d76a2c72892cf
de8bfe8399e33d61c93d69aa93632a5bbfc49600d8b9a9a970278141bcaf11b2
GET /ssi/elements/base/comments/comment5.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1589
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:35 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-635"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: cbVvmPDkzbhq_-zz4R9iyYbGArWz4eiGlDiHbBLB0LMJ_Lmv5tdG0g==
Age: 17745
petrol.clientoffer.site/assets/img/logo/qzt_white.png
200 OK 5.2 kB URL HTTP/1.1 petrol.clientoffer.site/assets/img/logo/qzt_white.png
IP
File type PNG image data, 132 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash bb16bbfca8cdaa042353a79845eeba47
d9bd97b057f4434ecf041129ab978ecf2bec51ce
1639d12a6a23397077fe402a82cad1f71e15e811d621bc235f60a65960d38869
GET /assets/img/logo/qzt_white.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 5187
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 07:48:49 GMT
Last-Modified: Thu, 01 Sep 2022 14:05:29 GMT
ETag: "6310bc29-1443"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: gVN-EGc-s0c9c1MEzP7hFNHLBrZ-4Sk8qynyPcRrgswaakPQHVaPFA==
Age: 35371
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 93ecdd49c10ccd5bea27ff4af5ada0bb
41d40ba331d6dc920ebc3064196795edeeca0c2b
79f5a2744fb791662fb42d57feaf8d0f2dd6d05f65985b2454b5c10a301b644b
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Fri, 02 Sep 2022 17:38:20 GMT
Server: ECS (dcb/7F83)
X-Cache: Miss from cloudfront
Via: 1.1 bb1da7862c4968b28920b91b324095c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: dU69LipO5smMyNb50J6pC0fwUHDzWWxz8tsFRbCjz3aKp-6y_0s5Wg==
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 59bdc2e0a449c6388eb0c96da3586600
c61d2414961c4f05c9bcf400d6a1d9792fbe9093
2b3c911dddbf9fad01ea3232354ac2f0e6731541ab3a7e916ef09682dd43cf4e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
st.formulead.com/assets/img/spinner/double-ring.gif
200 OK 93 kB URL HTTP/2 st.formulead.com/assets/img/spinner/double-ring.gif
IP
File type GIF image data, version 89a, 256 x 256\012- data
Hash 2f2ad9512c7ad4ea794d3a5d6adbd69e
76c48ce3db2dca18e28b2648ef34e7735f294772
7d77afe35414413c958c359b06daa7dad9c2a385d116e5870aafb772261cdd98
GET /assets/img/spinner/double-ring.gif HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/gif
content-length: 92622
server: nginx/1.19.0
date: Fri, 02 Sep 2022 12:34:57 GMT
last-modified: Wed, 31 Aug 2022 08:58:37 GMT
etag: "630f22bd-169ce"
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: NHMc829UWfJOvCwpj7ewQ5WJ4AJXAuFqGOhTuC2Qn6v66LNPBruKNQ==
age: 18202
X-Firefox-Spdy: h2
petrol.clientoffer.site/n/27/4/z-nrg/nz/css/normalize.css
200 OK 897 B URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/css/normalize.css
IP
File type ASCII text, with very long lines (1880)
Hash 8ca792972dc5202bd0a1ffd73769645f
d24a12992541a21bd6552ef17184ff6951c6e9cf
e7507a2706c28513cc4fc8a05c85ae7eea9e2a5937c2fcfd7a2e75b59390d605
GET /n/27/4/z-nrg/nz/css/normalize.css HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/css/style.min.css
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: W/"63120282-75b"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: nIsU3PJnIQ16_C7VT3GtBRwt7dBSpLbFEemzW7DLwF8O8rExs1SHOA==
petrol.clientoffer.site/ssi/elements/base/comments/comment4.jpg
200 OK 1.3 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment4.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash d1f670b5035713dd517347062a64512e
d5981f937557e33953188bfb65399cf2c2385e5f
5ebcec7153928cb12479835071596036b6bf204d5f015f58b7f0687a1e806b97
GET /ssi/elements/base/comments/comment4.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1307
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:33 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-51b"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: vFZrsdwchodjHDeBPF88GELXbEUlZAFY9VDMwiKqi--XlpDAFQ62Sw==
Age: 17747
petrol.clientoffer.site/ssi/elements/base/comments/rev1-a.jpg
200 OK 1.7 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/rev1-a.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Hash db2bd208a83dd1e61d8c5eb29d17fc5e
e0bd1558f696d871213fb6e7366bb737c9a7dfdf
247aa5d457438d0701a6985631b571826d33a719e0c1b38535ea1e9c023f91e9
GET /ssi/elements/base/comments/rev1-a.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1683
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:35 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-693"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: FX2wrfx_DtQX_mDUKV1AhbVrY4EFtDcVesBDESJHEAgZ13G_psldIQ==
Age: 17745
petrol.clientoffer.site/ssi/elements/base/comments/comment8.jpg
200 OK 1.2 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment8.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Hash 4bc4bb8a43aea3578af4a4cffc1ea983
276c96f4d6d1bdf03381d33c92323ca71e795aae
490adcb33271e416d05908764cad72e1f8b6571d0d8b77998633e675c975e344
GET /ssi/elements/base/comments/comment8.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1160
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:34 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-488"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: i85K0vyM-nNMeMRN7YE956i5vRftfw1ILIBkEFvQ4Um4uxwNOjyLow==
Age: 17746
petrol.clientoffer.site/ssi/elements/base/comments/guyiphone.jpg
200 OK 137 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/guyiphone.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=720, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=960], progressive, precision 8, 960x720, components 3\012- data
Size 137 kB (136915 bytes)
Hash dd8774375e394460704d201cc9183468
9b17b330fae8a45162e594f1e6e20668079f75f6
7537819dfcae5087f73030b210f9ecb6e9561593e656162973c214af01bbf492
GET /ssi/elements/base/comments/guyiphone.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 136915
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:37 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-216d3"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wBRMtC5-9W_HHFHyjbbwUbNOpZ8Od1nDmQ8A7Ez2uhdmWrBkNLZdxA==
Age: 17743
petrol.clientoffer.site/ssi/elements/base/comments/girl5.jpg
200 OK 1.4 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/girl5.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash b3aba087230e9009ab500a2c3cd32f67
180ba2ba0f3a41dc96c3d4266db37d96adc0b248
e9e064bbaab7738127c4966595fb2dadfe872941f64e0c04e60914c074e66f82
GET /ssi/elements/base/comments/girl5.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1412
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:36 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-584"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: hq-DHGwUkvP4b01IJYd2ojmH593hhANHyStCSP5JI1H_vKrgJoEgEA==
Age: 17744
petrol.clientoffer.site/n/27/4/z-nrg/nz/images/prizemob.png
200 OK 35 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/images/prizemob.png
IP
File type PNG image data, 550 x 332, 8-bit colormap, non-interlaced\012- data
Hash a839b323a69826aeee7b1fe51648523e
965614880dd22b1d67553be114119e34e51ee00d
8c43f8327a942bac45f5c6796d45862b358ba348baeee2550ed43271afc75cb8
GET /n/27/4/z-nrg/nz/images/prizemob.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 34930
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: "63120282-8872"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: -Uh-ZM_EE8F1SfMl3WlvJV3G_Zx-tv4BdGWBM_nEzzqijKLxsxoH8Q==
petrol.clientoffer.site/n/27/4/z-nrg/nz/images/header.png
200 OK 13 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/images/header.png
IP
File type PNG image data, 1068 x 178, 8-bit colormap, non-interlaced\012- data
Hash ec0b67242eed8bf79b31d028e3f0174c
b7e6c512255c731195c438ade832be4d4c90b6c1
48f16603213ce18c16841925bcfca4a3e9b8554120baec72e613bef6b316513b
GET /n/27/4/z-nrg/nz/images/header.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 12989
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: "63120282-32bd"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ENzlDwmN6Wg5DPk5v3rGsd9Cm7dJGeWLGHXTFq5cQHIEvcQkxNClYw==
petrol.clientoffer.site/n/27/4/z-nrg/nz/images/header-wap.png
200 OK 9.8 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/images/header-wap.png
IP
File type PNG image data, 760 x 150, 8-bit colormap, non-interlaced\012- data
Hash df3c81f55d34d489ab9fa5d39ff769ef
918eec50fae0e32aab3f46ca97265c2d655ed204
c78fd29b18025b93264c63e858dc316ddefd580f93f5c14c9e251640ed0701b0
GET /n/27/4/z-nrg/nz/images/header-wap.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 9783
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: "63120282-2637"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: eFJmGrOPzfUO8EUAr4aEZhmiabhRtu5V35gSIpDX_8_CuBXTVbn-lQ==
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a2bd4dd15f44c8ff43c28d91e7af6886
5b73c60b27e87b9fb8276cd83bb3129ad865b58c
10e95b04c575d15ab3194b5d49da2dc12e72616aac54ff3a097ce98713258730
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "10E95B04C575D15AB3194B5D49DA2DC12E72616AAC54FF3A097CE98713258730"
Last-Modified: Thu, 01 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15608
Expires: Fri, 02 Sep 2022 21:58:28 GMT
Date: Fri, 02 Sep 2022 17:38:20 GMT
Connection: keep-alive
petrol.clientoffer.site/n/27/4/z-nrg/nz/images/background.jpg
200 OK 55 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/images/background.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1917x1281, components 3\012- data
Hash 8dabef81a4a058c58a9ff386f49eb94e
0f1b35a1cbdd705723326ec27d1f073455679b06
e3fea1416be38ef2f551365401ee86538463b99438c98ae09ec44f0be8f737ec
GET /n/27/4/z-nrg/nz/images/background.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/css/style.min.css
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 55300
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: "63120282-d804"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: vwfg-yavzGuRNCS5ZFLvTExqxRdH9V6ipzKNxYB3_500ZFP7ywShvA==
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a2bd4dd15f44c8ff43c28d91e7af6886
5b73c60b27e87b9fb8276cd83bb3129ad865b58c
10e95b04c575d15ab3194b5d49da2dc12e72616aac54ff3a097ce98713258730
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "10E95B04C575D15AB3194B5D49DA2DC12E72616AAC54FF3A097CE98713258730"
Last-Modified: Thu, 01 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15608
Expires: Fri, 02 Sep 2022 21:58:28 GMT
Date: Fri, 02 Sep 2022 17:38:20 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a2bd4dd15f44c8ff43c28d91e7af6886
5b73c60b27e87b9fb8276cd83bb3129ad865b58c
10e95b04c575d15ab3194b5d49da2dc12e72616aac54ff3a097ce98713258730
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "10E95B04C575D15AB3194B5D49DA2DC12E72616AAC54FF3A097CE98713258730"
Last-Modified: Thu, 01 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18772
Expires: Fri, 02 Sep 2022 22:51:12 GMT
Date: Fri, 02 Sep 2022 17:38:20 GMT
Connection: keep-alive
cdn.formulead.com/v/country
200 OK 51 B URL HTTP/1.1 cdn.formulead.com/v/country
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 91440c116c92d75cfc02cd72bd060a82
591d3adc1d1d80e012b0dd0214df1f0438ae37f5
1b35c679adcfb2f8fbf92afcaf9f7a741f3c6273503a54b6c55448e1b2807c80
GET /v/country HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 51
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"33-WR063B0dgOASsN0CFN8fBDiuN/U"
set-cookie: qst.sid=s%3Adx4IaSfqdCD1pn37rhhy7lphY-Hl-jZ8.PdRLscGO%2Bglujvgy3VPTOfApdUn%2BiqrwQ4JsF9erTo8; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/css/main.min.css
200 OK 94 kB URL HTTP/1.1 cdn.formulead.com/css/main.min.css
IP
File type ASCII text, with very long lines (65518)
Hash 696d60deadf94d2655e0849094fab2fb
c38ea3c192a0ade3cd5999e9ffe846524ea0c383
b37ed1d3763b12d7f7282c0e4034715d8016d206a498d70f1a377e56e02bee02
GET /css/main.min.css HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Content-Type: text/css; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Accept-Ranges: bytes
Cache-Control: public, max-age=2678400
Last-Modified: Fri, 26 Aug 2022 11:57:09 GMT
ETag: W/"b15a1-182da035a08"
Vary: Accept-Encoding
Content-Encoding: gzip
petrol.clientoffer.site/ssi/elements/base/check.png
200 OK 348 B URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/check.png
IP
File type PNG image data, 35 x 35, 8-bit colormap, non-interlaced\012- data
Hash 1aecb247e31cfe8ecdf4c1a30fd32799
8ca486751ab6c31c1acaa7868ee26f7d5dd98f83
9f15d5a161e11ec46c3474002d4ae27144633b19413b3ad8608ce11eefb810ad
GET /ssi/elements/base/check.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 348
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 15:22:33 GMT
Last-Modified: Fri, 02 Sep 2022 13:18:02 GMT
ETag: "6312028a-15c"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: oexzIz5PXCPF0khHDuipFaAGC2Fg7179sYMntNiroBowvLJQmliiMw==
Age: 8147
petrol.clientoffer.site/ssi/elements/base/comments/comment6.jpg
200 OK 1.6 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/comment6.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash 1547bb14a090e26493220e1ac226c956
1f6a7c79b3b167810acf4cf0ee291b08ec9f019b
3f39d61ca486889335b7d2327da4d0c5fa5f5631899a7f020ff7992b40eed55f
GET /ssi/elements/base/comments/comment6.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1631
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:34 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-65f"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 07d5d44815808d5d5a6f43984a987698.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wpf9Xv6ps6prohTC_glHR2I9iJlqlhW2R8V1HcCKTA_84pOTDZyw5A==
Age: 17746
petrol.clientoffer.site/n/27/4/z-nrg/nz/images/prize.png
200 OK 40 kB URL HTTP/1.1 petrol.clientoffer.site/n/27/4/z-nrg/nz/images/prize.png
IP
File type PNG image data, 580 x 467, 8-bit colormap, non-interlaced\012- data
Hash f2b6d454f92f248528d54a971ea87da4
04cf3e461b51f0741d3107d70c6777ac1333179d
7327772edf543458a21a64e0e274a440a446e0286b8f18ce3d9026f222d61370
GET /n/27/4/z-nrg/nz/images/prize.png HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 39753
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 13:17:54 GMT
ETag: "63120282-9b49"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: UK8EsuI2FcGm3FWkkmeK9NzXexzzAP2H7zrkwPoNk5DC9qTrAO6EfA==
petrol.clientoffer.site/ssi/elements/base/comments/guy4.jpg
200 OK 1.7 kB URL HTTP/1.1 petrol.clientoffer.site/ssi/elements/base/comments/guy4.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data
Hash b5170ef71e82c3b9dd3cb0de6b06d36d
c36c6365a983ce3e211817f3edb0260e500b87af
207761ada2128a5b781713077cf76116149b47ba3222c3b6cf88e99dd58857ec
GET /ssi/elements/base/comments/guy4.jpg HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 1728
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 12:42:36 GMT
Last-Modified: Fri, 02 Sep 2022 08:42:30 GMT
ETag: "6311c1f6-6c0"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 8UmHVrZtEYKCHEcRuayjTTPlg60Zq5C2EX0g_WPQmCPBWNdbFHY0QA==
Age: 17744
st.formulead.com/assets/js/helpers.js
200 OK 15 kB URL HTTP/2 st.formulead.com/assets/js/helpers.js
IP
Hash d8d991154a92ad44bd51f83d9d304fc7
ab73c711b748c1daff92c7f95a6ae03c60ea32d7
9adf3aabd12fed3bd5919a9fd2642bc065ade564db30520016f52a4ba29927c6
GET /assets/js/helpers.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
date: Fri, 02 Sep 2022 12:15:51 GMT
last-modified: Wed, 31 Aug 2022 08:58:37 GMT
etag: W/"630f22bd-fd16"
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5xN2srfdMQDd1px_iJHe0HKfK-pMrXS17ZwV2zTXoJI-NyLi4K2Qwg==
age: 19349
X-Firefox-Spdy: h2
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/p.js
200 OK 426 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/p.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 426 kB (425890 bytes)
Hash 64994f48800db613d5603bd36ff46663
d870a44070ebee3be886f9acccfb2605ebbf6f60
39e17d76431732602903dcfc20b56b8efba19bf1752d1c839f7a95b81e3336ab
GET /p/5bbb0ba263dcf80100a2e07f/p.js HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
set-cookie: lid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
plc=5bbb0ba263dcf80100a2e07f; Path=/; Expires=Sun, 01 Sep 2024 17:38:20 GMT; Secure; SameSite=None
qst.sid=s%3AsIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik; Path=/; HttpOnly
Vary: Accept-Encoding
Content-Encoding: gzip
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, ETag, Backoff, Last-Modified, Pragma, Cache-Control, Expires, Content-Type, Content-Length, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Fri, 02 Sep 2022 17:38:16 GMT
Cache-Control: max-age=3600
Expires: Fri, 02 Sep 2022 18:18:56 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 2afd697fc5d0058ea30d6c4b939e714c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Pg1wqaYdAGVrym_kObYEnQ1wXLraqH4yDHWTaHmoEhGNI-NHSOebsA==
Age: 4
cdn.formulead.com/fonts/Roboto-Regular.ttf
200 OK 171 kB URL HTTP/1.1 cdn.formulead.com/fonts/Roboto-Regular.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob\012- data
Size 171 kB (171272 bytes)
Hash 11eabca2251325cfc5589c9c6fb57b46
096c9245b6a192d1403a82848e104a65f578a8ec
017c0be9aaa6d0359737e1fa762ad304c0e0107927faff5a6c1f415c7f5244ed
GET /fonts/Roboto-Regular.ttf HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: https://cdn.formulead.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Content-Type: font/ttf
Content-Length: 171272
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Accept-Ranges: bytes
Cache-Control: public, max-age=2678400
Last-Modified: Fri, 26 Aug 2022 11:57:09 GMT
ETag: W/"29d08-182da035a08"
ocsp.digicert.com/
200 OK 471 B IP
Hash 21daf45cdda2eb462873226bb5c1f0fb
4d4621bbf1461f35f7e536c1dbd9de71978ffa23
8164c742d013bdc2836cac1167acfe482547347ab6a1daefa15475f694dae057
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4365
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:20 GMT
Last-Modified: Fri, 02 Sep 2022 16:25:35 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471
cdn.formulead.com/fonts/Roboto-Bold.ttf
200 OK 170 kB URL HTTP/1.1 cdn.formulead.com/fonts/Roboto-Bold.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.137; 2017Roboto-Bo\012- data
Size 170 kB (170348 bytes)
Hash e07df86cef2e721115583d61d1fb68a6
3dd713113ff2d79b94d2df343e2e28fa8e7279cf
c9cc991deb5d27f267830a19f2301eb164d9e61ec08669c1a1a291c5620ff40a
GET /fonts/Roboto-Bold.ttf HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: https://cdn.formulead.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:20 GMT
Content-Type: font/ttf
Content-Length: 170348
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Accept-Ranges: bytes
Cache-Control: public, max-age=2678400
Last-Modified: Fri, 26 Aug 2022 11:57:09 GMT
ETag: W/"2996c-182da035a08"
petrol.clientoffer.site/favicon.ico
200 OK 1.2 kB URL HTTP/1.1 petrol.clientoffer.site/favicon.ico
IP
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 2b41416e68dcc31606e749cc9da0e7e4
7801b077f31134407e429aa5d3cfd65ed2197e59
934e627d59f1a7b1d98df885aa0d09603b4027b25d29e5ddeaadd15fdd318c6b
GET /favicon.ico HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/index.html
HTTP/1.1 200 OK
Content-Type: image/x-icon
Content-Length: 1150
Connection: keep-alive
Server: nginx/1.19.0
Date: Thu, 01 Sep 2022 19:57:08 GMT
Last-Modified: Thu, 01 Sep 2022 14:05:39 GMT
ETag: "6310bc33-47e"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 6tYiKsPw_IsgHFp7oA_dqiRPsRcVbEmupwNtwHRiqxE4O4EGEqXWRg==
Age: 78073
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-iivmxswc,x-request-id,x-session-id
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:21 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 67921e2bd7c620bdd4db5ed1e73d3146
1deaa030ab490c63f94bde4c7ada5e2f849fb506
7fcee2496cdc63c9779941621d9e61acd006910947ccb6c7e98f383b0bf4574c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu-
200 OK 585 B URL HTTP/2 www.google.com/recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu-
IP
File type ASCII text, with very long lines (884), with no line terminators
Hash 778a4624b4d0b9c4fd52df4f0aeacdf9
9e7df0c218b3d1d270ab12eb8803ae4ffe8f416e
6c0888fb6199276de3faae6d9da55d9ea38c8017c18294eb869f33347883f357
GET /recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu- HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Fri, 02 Sep 2022 17:38:21 GMT
date: Fri, 02 Sep 2022 17:38:21 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 585
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial
200 OK 4.4 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (18304), with no line terminators
Hash 75edc4d6ac681217486b37a312e24a9b
5435dbf535923f62f3c65c0e96365eaf1357424e
ebd6a3fbabe61a0f9662c08de0e6c69d1c7b9eb87d18e01832837eb2136542d2
GET /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=initial HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
X-Request-Id: 0fabc7fe1409be4e981e39ce
X-iivmxswc: 98e6196ceda4f15c546c8b1c886b5b0339c3def90e4694a560a6afb1a3ff3c93
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:21 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: stp=1; Path=/; Expires=Sun, 01 Sep 2024 17:38:21 GMT; Secure; SameSite=None
ck_tsp=2022-09-02T17%3A38%3A21.267Z; Path=/; Expires=Sun, 01 Sep 2024 17:38:21 GMT; Secure; SameSite=None
sip=91.90.42.154; Path=/; Expires=Sun, 01 Sep 2024 17:38:21 GMT; Secure; SameSite=None
ETag: W/"4848-UnZkEOWH0E0Gq/7YFe6/MmCt5CY"
Vary: Accept-Encoding
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash dc076b754adaddcb000f3f987b6c5df2
01e9b40591692b8b2a6a94729e9481c7e600d248
9dbf2e71e1cbad91a71154b729e8ef496eda7544828a8bfd4f64e6dd70c4f64d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: DJq5ot4ZnmmZM8B4kZ/Ocw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: InWM3rR0Foe0dl7CDAFpHIv4tu0=
petrol.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Regular.woff
200 OK 52 kB URL HTTP/1.1 petrol.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Regular.woff
IP
File type Web Open Font Format, CFF, length 51572, version 0.0\012- data
Hash 6a324f29ef3efabd2176f8b697ad71ed
dd696f0c713eb491c6e16bec9fda63f3f23999ba
6d64c461708b8f11e06451c96779d22fc2b8de582214c77493ecc57c32ede06e
Analyzer Verdict Alert fortinet Phishing
GET /n/assets/fonts/myriad-pro/MyriadPro-Regular.woff HTTP/1.1
Host: petrol.clientoffer.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://petrol.clientoffer.site/n/27/4/z-nrg/nz/css/style.min.css
HTTP/1.1 200 OK
Content-Type: application/font-woff
Content-Length: 51572
Connection: keep-alive
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 00:19:46 GMT
Last-Modified: Thu, 01 Sep 2022 14:06:00 GMT
ETag: "6310bc48-c974"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: qFPxQTi1OXdA6GZc97DKJrnOsv3EXy4VAiKxAnt5kDtKFGHniJYNQQ==
Age: 62316
cdn.formulead.com/v/fingerprint-cache?vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs=803716228
200 OK 110 B URL HTTP/1.1 cdn.formulead.com/v/fingerprint-cache?vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs=803716228
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash bad7f8dd7c7e0222df76f8164f37d7f0
e6f37c1e21f83b5e26660d2beee029c5fdfdf447
c167a02d8d16558f88713a894be5587558e1876b822e73e1a9eef21815bd233f
GET /v/fingerprint-cache?vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs=803716228 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-09-02T17%3A38%3A21.267Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 110
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"6e-5vN8HiH4O14mZg0r7uApxf399Ec"
set-cookie: qst.sid=s%3AS2MSWslR8nVHrS62lwUogVfZsCKiXr6B.Ub3%2FrTklnhgtj4qqU6XSy9vOTC%2B6Ju19Mhs%2BAwre2I0; Path=/; HttpOnly
Vary: Accept-Encoding
st.formulead.com/assets/js/dl_modified.js
200 OK 1.5 kB URL HTTP/2 st.formulead.com/assets/js/dl_modified.js
IP
Hash 27c7549ed36b48a5f506324a46920ab8
d8e25e0590945cbe41079657cf084b84fedc02f4
f056c6050713a07fe7ba8def36a46af1db84c1a69842d8306d9d63e57397bb08
GET /assets/js/dl_modified.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
date: Fri, 02 Sep 2022 14:10:42 GMT
last-modified: Wed, 31 Aug 2022 08:58:37 GMT
etag: W/"630f22bd-132f"
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: cw3t2mTj1WYYf4TEI0bmOSs3y5fi9JzpbIsGnNzjzyStUtLHVxf1vg==
age: 12460
X-Firefox-Spdy: h2
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-iivmxswc,x-request-id,x-session-id
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-flow-id,x-lead-id,x-offer-id,x-ofvuinwk,x-placement-id,x-session-id,x-zqhkygow
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12f00eac4bda78b5d4c4bc00e96be439
5d6d88dbf72f208bc33c9af693440aec02e5f11c
4a85dc99793413780fdfde032e83995c0a15775eb09123f53a1ba9b789f91a55
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4A85DC99793413780FDFDE032E83995C0A15775EB09123F53A1BA9B789F91A55"
Last-Modified: Wed, 31 Aug 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3989
Expires: Fri, 02 Sep 2022 18:44:51 GMT
Date: Fri, 02 Sep 2022 17:38:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12f00eac4bda78b5d4c4bc00e96be439
5d6d88dbf72f208bc33c9af693440aec02e5f11c
4a85dc99793413780fdfde032e83995c0a15775eb09123f53a1ba9b789f91a55
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4A85DC99793413780FDFDE032E83995C0A15775EB09123F53A1BA9B789F91A55"
Last-Modified: Wed, 31 Aug 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3989
Expires: Fri, 02 Sep 2022 18:44:51 GMT
Date: Fri, 02 Sep 2022 17:38:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12f00eac4bda78b5d4c4bc00e96be439
5d6d88dbf72f208bc33c9af693440aec02e5f11c
4a85dc99793413780fdfde032e83995c0a15775eb09123f53a1ba9b789f91a55
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4A85DC99793413780FDFDE032E83995C0A15775EB09123F53A1BA9B789F91A55"
Last-Modified: Wed, 31 Aug 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3989
Expires: Fri, 02 Sep 2022 18:44:51 GMT
Date: Fri, 02 Sep 2022 17:38:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12f00eac4bda78b5d4c4bc00e96be439
5d6d88dbf72f208bc33c9af693440aec02e5f11c
4a85dc99793413780fdfde032e83995c0a15775eb09123f53a1ba9b789f91a55
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4A85DC99793413780FDFDE032E83995C0A15775EB09123F53A1BA9B789F91A55"
Last-Modified: Wed, 31 Aug 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3989
Expires: Fri, 02 Sep 2022 18:44:51 GMT
Date: Fri, 02 Sep 2022 17:38:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 12f00eac4bda78b5d4c4bc00e96be439
5d6d88dbf72f208bc33c9af693440aec02e5f11c
4a85dc99793413780fdfde032e83995c0a15775eb09123f53a1ba9b789f91a55
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4A85DC99793413780FDFDE032E83995C0A15775EB09123F53A1BA9B789F91A55"
Last-Modified: Wed, 31 Aug 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3989
Expires: Fri, 02 Sep 2022 18:44:51 GMT
Date: Fri, 02 Sep 2022 17:38:22 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9564bd06-b264-460b-96bb-6b37cf25a72b.jpeg
200 OK 17 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9564bd06-b264-460b-96bb-6b37cf25a72b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 12756903aaa74164feb5f8525398ca36
9fef9b071daea6793cbbdfe391254ac4326b1aa2
6d474a6d96aebfed43a4f6812f18a1be8d100c590f75eb0fbf4ec7277dd0c442
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9564bd06-b264-460b-96bb-6b37cf25a72b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 16818
x-amzn-requestid: 6950a3c5-2cdc-4a21-854c-10d925e32ecd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XiYLvHRSIAMFotQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630a6d7e-6e98b9a77e592bd01afb1d97;Sampled=0
x-amzn-remapped-date: Sat, 27 Aug 2022 19:16:14 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 3eBLhLH4APXLyj9kLHXNCFT9ccS_bnBp5INvMI93IFvOuBMERe_GgQ==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Sep 2022 13:36:12 GMT
age: 14530
etag: "9fef9b071daea6793cbbdfe391254ac4326b1aa2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd1bf889-bcbe-4ad4-950a-a32b2f875537.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd1bf889-bcbe-4ad4-950a-a32b2f875537.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 24d848f7606889b048b6334e70d8a5e0
85239ef4f2fee8d3345e599bc942cab63ff3aaf6
da6cf33b440b51f72a70f309d62fd581aed246b6a78b8f329fa3899db15ff86d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd1bf889-bcbe-4ad4-950a-a32b2f875537.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5889
x-amzn-requestid: 42237574-f86e-4ece-b986-6d0c5910fcc5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XzMVgHajoAMFmXg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63112756-48ff9d98464cf3c9680d97b4;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 21:42:46 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: _7BBSlQQucoO5poncTYuX4fcmS4WFg3UcVFXalckGCCNFKJ0h5UpsQ==
via: 1.1 95b0ac620fa3a80ee590ecf1cda1c698.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Sep 2022 22:31:42 GMT
etag: "85239ef4f2fee8d3345e599bc942cab63ff3aaf6"
content-type: image/jpeg
age: 68800
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3cef8f6-078d-43f5-ba9b-fcc5dc69a7f7.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3cef8f6-078d-43f5-ba9b-fcc5dc69a7f7.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cab49f59207f816d98a21cd3fc2c37d1
8a9278f8ff5d149420673649878ca1ee266a0783
aebe0748f049bcb801be83459d4bae66b9c1453de3b0ea7e6a63bea88b6e7a5a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3cef8f6-078d-43f5-ba9b-fcc5dc69a7f7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13104
x-amzn-requestid: da627f0c-5cde-4a37-878c-dcada8a25f64
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XzL6_EYoIAMFiYw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631126ac-10dbcb432e6d1af46cffaefe;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 21:39:56 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: EYnLT-zi94yLohu6F2sovFoJ7UPSlEwh8CTMXR3d9aqGb00jm1f8oQ==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Sep 2022 22:32:41 GMT
age: 68741
etag: "8a9278f8ff5d149420673649878ca1ee266a0783"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06f2c9c2-de63-41e1-8359-5a5923a2b1e8.webp
200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06f2c9c2-de63-41e1-8359-5a5923a2b1e8.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5ba50b2fd1814c5ffc95aef40c69ce8c
cbb4546228115cccc122b16209e70171bef5c1f2
de822c8549508b28a07d29b203ae3ef356470df906cba727fc765f1bd14bb866
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06f2c9c2-de63-41e1-8359-5a5923a2b1e8.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9252
x-amzn-requestid: 7feebba8-f6b9-4b79-9726-5a7534da277e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XzLyVG5DoAMF_Ug=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63112675-3123158f3dcfbd476537ca3c;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 21:39:01 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: BOa5zGQyJS9q9bHmtKzlNtyS9ToGPZJkDFo2uY2lzz8Lnd3cZLQEaA==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 ebe4011a81a36e2bf678f69ce1711330.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Sep 2022 22:48:18 GMT
age: 67804
etag: "cbb4546228115cccc122b16209e70171bef5c1f2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6b23082-fe08-4f5d-b709-47175510cf45.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6b23082-fe08-4f5d-b709-47175510cf45.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5e05660322f0368dd2bf8067d7e4554d
ec65cb47d86488f734c945a210d5f636a40fea2c
98875230ec45766102191bdc4180742fa3b8f3ad5ad1a128d12437105f86247e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6b23082-fe08-4f5d-b709-47175510cf45.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6196
x-amzn-requestid: a7d6ce70-06d7-498c-8024-80185a3fc3e4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XzLyLFmVIAMFkcQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63112674-3fad622927177e9236d7c50a;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 21:39:00 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: qAMCgNpYR80vXSDyHFOFcbT8VukBemR2AGoGNaCfYaszKshu-gv6zg==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Sep 2022 21:54:15 GMT
age: 71047
etag: "ec65cb47d86488f734c945a210d5f636a40fea2c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c0ef483-e545-4a1f-b9b9-88778330d881.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c0ef483-e545-4a1f-b9b9-88778330d881.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 955f2a35bd6b3802670e7fa8a7cda833
4c70d27f7c51b7fcae1d8a883bfc2e67a551ae6c
2fb517039f0704d2f6fe2fa78eae47c71c645add1c2276f8726248184ae45760
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c0ef483-e545-4a1f-b9b9-88778330d881.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10435
x-amzn-requestid: 813ec4ca-243d-46cb-a6a6-8ec58e5dd9f8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XzLjdHwnIAMFhzA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63112615-4733cfb83cf0e8734abc5716;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 21:37:25 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: n6DJbsUGTdXT42cNLTDq6Uz28H2SDhwq6drdKP4axAHsBz471X7r_g==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Sep 2022 21:37:26 GMT
etag: "4c70d27f7c51b7fcae1d8a883bfc2e67a551ae6c"
content-type: image/jpeg
age: 72056
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash f8f40ab577e9b39aac3516fe0416d0ad
c1187e79ec44c909ad4c9d4055ed9166ae8969a4
4d87285064b07020a52791b7f27c4dc09fb73aa4e58f4c4689a52e740ec6e741
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1658
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:22 GMT
Last-Modified: Fri, 02 Sep 2022 17:10:44 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 278
cdn.formulead.com/t/errors
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/t/errors
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /t/errors HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-session-id
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/t/errors
200 OK 16 B URL HTTP/1.1 cdn.formulead.com/t/errors
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
POST /t/errors HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
Content-Type: application/json
Content-Length: 153
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Vary: Accept-Encoding
event.trk-consulatu.com/register/event_log/zqd2ojv4ek
200 OK 0 B URL HTTP/2 event.trk-consulatu.com/register/event_log/zqd2ojv4ek
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /register/event_log/zqd2ojv4ek HTTP/1.1
Host: event.trk-consulatu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Sep 2022 17:38:22 GMT
content-length: 0
access-control-allow-headers: content-type
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: http://petrol.clientoffer.site
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-allow-methods: POST
access-control-max-age: 1800
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o1i6H4qxrrMCXuRdyTen5rOI6Ko%2Bn%2FFmd0ChEYtzRz%2BJPOo%2Fbq0AekokKkmpAwYvOKE2d9EUeb8LPy3XxwMyVZdpkcxNJlTuhPtKZ6gFxXYJs5ghwb3C8dR1UmjlNPY%2FsXDF3NNBnzXmTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 744804dafc2e0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
200 OK 481 B URL HTTP/1.1 cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
IP
File type JSON data\012- , ASCII text, with very long lines (481), with no line terminators
Hash 39d9dd489792e8b985f255668694eb3a
ecda93dba3c3805792d023351c54e21e827e7b4e
898a8076763da829e969148bb1e0bf1e91afb049446b734dead9626f05cb966e
GET /vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
X-Offer-Id: 5e1f1fd6db04380100ede242
X-Flow-Id: 5e1f1fd6db04380100ede242
X-Placement-Id: 5bbb0ba263dcf80100a2e07f
x-zqhkygow: 44ee832f9eb1738ede1adf44e1c1b1ab744443e236468d60e69548571a820518
x-ofvuinwk: 08948bbad0d47837949f06f827299ddca816cbce1b2c4a88787573d88c843b32
X-Lead-Id: 0fabc7fe1409be4e981e39ce
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:22 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Vary: Accept-Encoding
event.trk-consulatu.com/register/event_log/zqd2ojv4ek
200 OK 0 B URL HTTP/2 event.trk-consulatu.com/register/event_log/zqd2ojv4ek
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /register/event_log/zqd2ojv4ek HTTP/1.1
Host: event.trk-consulatu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://petrol.clientoffer.site/
Content-type: application/json
Origin: http://petrol.clientoffer.site
Content-Length: 103
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Sep 2022 17:38:22 GMT
content-length: 0
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-pushplatformapp-params:
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-pushplatformapp-alert: pushPlatformApp.pushSubscription.deleted
x-frame-options: DENY
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: http://petrol.clientoffer.site
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gzziYTIS8EgP7P6mMZgrjZM0l1iGP3oWJhlsqGCokIlcF%2F7PS5xtwib5mXg8TkEALtdYCjLu7sHNG1L7MQZWd90lp8CLerXE7yHEn8lFmuRfmJVyjo7%2F4K%2FVQfDmt%2FXHswMZxhcOGShyRw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 744804dbdcfb0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 660657162b524658006a1856e274a946
56c933c6682c0019f6dbd040da6b929044dc216a
9578fc0408868ae40d41af8d13787f4137853c056300524b5558b1c57d39b2b3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/recaptcha/releases/mBwkfBPLFWI0ygbsp8eJNMkw/recaptcha__en.js
200 OK 158 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/mBwkfBPLFWI0ygbsp8eJNMkw/recaptcha__en.js
IP
File type ASCII text, with very long lines (613)
Size 158 kB (157730 bytes)
Hash d27f59fd0d124cb313fe64dd5ba8b26c
05da0ecd3970a5a568305a51f1e38945cca7ab39
09b3f5846ef9e14fd2fb99c280cee6a25fc4c7c96e050e70cc754a96625de485
GET /recaptcha/releases/mBwkfBPLFWI0ygbsp8eJNMkw/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 157730
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 29 Aug 2022 16:27:28 GMT
expires: Tue, 29 Aug 2023 16:27:28 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 29 Aug 2022 04:01:21 GMT
content-type: text/javascript
age: 349855
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 7ce90d6fafa13d92fcf445b688f0389f
480461a46fc291cbcdf6218c7743779d7e862788
dd33483769f6c715aeb257c2955147c1a5a47b0af1684190247701465af8af6c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Sep 2022 17:38:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.formulead.com/v/reverse-dns-lookup
200 OK 88 B URL HTTP/1.1 cdn.formulead.com/v/reverse-dns-lookup
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 9e040edd17bb2e1b8595c5bca9c3781a
cb57e3f304d455c0b252e6a05bc0e55814c8c553
56c21491b74b93d01b73e9f45bde0ad2c392e0b4afbe710b7c324c7c090178e0
GET /v/reverse-dns-lookup HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-09-02T17%3A38%3A21.267Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:23 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 88
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"58-y1fj8wTUVcCyUuagW8DlWBTIxVM"
set-cookie: qst.sid=s%3AUYsZbXMH51ANFuhg_hCaQHUbFRY4eb3I.tX1v4Ih7QjTnSxiK6tWoHjrE0uQkBPB7KgoQEKCkZCg; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/t/page
200 OK 2 B IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /t/page HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-session-id
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:23 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 27 Aug 2022 12:31:58 GMT
expires: Sun, 27 Aug 2023 12:31:58 GMT
cache-control: public, max-age=31536000
age: 536785
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 02 Sep 2022 00:48:31 GMT
expires: Sat, 02 Sep 2023 00:48:31 GMT
cache-control: public, max-age=31536000
age: 60592
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.formulead.com/v/recaptcha3?token=03ANYolqs_ns0KSBt0j98db_gCM-sSuKXWq3Vmf9S37tbMBPerCGBzBiL1eFnNPGDEW_GaIxlggwPoNsKSIwOCS7T8rqkIr2tszM7kGHHlekxhrpaxRCtnDNeYVCJcYOZVbLBP5r1ynLvHVw9NU-mqVKIDjdPIefwlk6Nz7PKzhblQXcZfQCgygcbdtOiv1ratZq9_qXflVTe-XggsBjyRdzCJ3IJI_pFl_9wY1V0hItpoCNYtOg-85JmlPJDVLtQ9A27JHxIB05FEkYjIhRkRK1l5QWo9OtbyeYlzNXdfWdEYBBpG4TI2V8BtcPKZrNlpIqZXNoNZco1uuZbXduz4aj7hvl2dCwZFQGBzgwBaYBH-MIOSnLye0NUSQZ2EaBZ837OJGgZabSzr7YzKb3KTwyLK9_on9inrOHQu_bBvaKeLh4hQpRt8LXOZxRSAUi5W-s-QOJvxYJ24rvcuRfS-mMMgz7gQlzJ4lcqJKw6CWt6Hce2gKbwVcQrniO0EZwRuD9e4GjoapFqfoNphkLg2xdH9hcG2qov6sg&step=1
200 OK 170 B URL HTTP/1.1 cdn.formulead.com/v/recaptcha3?token=03ANYolqs_ns0KSBt0j98db_gCM-sSuKXWq3Vmf9S37tbMBPerCGBzBiL1eFnNPGDEW_GaIxlggwPoNsKSIwOCS7T8rqkIr2tszM7kGHHlekxhrpaxRCtnDNeYVCJcYOZVbLBP5r1ynLvHVw9NU-mqVKIDjdPIefwlk6Nz7PKzhblQXcZfQCgygcbdtOiv1ratZq9_qXflVTe-XggsBjyRdzCJ3IJI_pFl_9wY1V0hItpoCNYtOg-85JmlPJDVLtQ9A27JHxIB05FEkYjIhRkRK1l5QWo9OtbyeYlzNXdfWdEYBBpG4TI2V8BtcPKZrNlpIqZXNoNZco1uuZbXduz4aj7hvl2dCwZFQGBzgwBaYBH-MIOSnLye0NUSQZ2EaBZ837OJGgZabSzr7YzKb3KTwyLK9_on9inrOHQu_bBvaKeLh4hQpRt8LXOZxRSAUi5W-s-QOJvxYJ24rvcuRfS-mMMgz7gQlzJ4lcqJKw6CWt6Hce2gKbwVcQrniO0EZwRuD9e4GjoapFqfoNphkLg2xdH9hcG2qov6sg&step=1
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 35fda546e030f65c73fc8839796eae57
e765a9d22600836c844adb6f4ef7f5aa6338ef26
48a467bef122f7be0bc3c0a96dd6b240ba54279fe31444f994c8815c43550281
GET /v/recaptcha3?token=03ANYolqs_ns0KSBt0j98db_gCM-sSuKXWq3Vmf9S37tbMBPerCGBzBiL1eFnNPGDEW_GaIxlggwPoNsKSIwOCS7T8rqkIr2tszM7kGHHlekxhrpaxRCtnDNeYVCJcYOZVbLBP5r1ynLvHVw9NU-mqVKIDjdPIefwlk6Nz7PKzhblQXcZfQCgygcbdtOiv1ratZq9_qXflVTe-XggsBjyRdzCJ3IJI_pFl_9wY1V0hItpoCNYtOg-85JmlPJDVLtQ9A27JHxIB05FEkYjIhRkRK1l5QWo9OtbyeYlzNXdfWdEYBBpG4TI2V8BtcPKZrNlpIqZXNoNZco1uuZbXduz4aj7hvl2dCwZFQGBzgwBaYBH-MIOSnLye0NUSQZ2EaBZ837OJGgZabSzr7YzKb3KTwyLK9_on9inrOHQu_bBvaKeLh4hQpRt8LXOZxRSAUi5W-s-QOJvxYJ24rvcuRfS-mMMgz7gQlzJ4lcqJKw6CWt6Hce2gKbwVcQrniO0EZwRuD9e4GjoapFqfoNphkLg2xdH9hcG2qov6sg&step=1 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-09-02T17%3A38%3A21.267Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:24 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 170
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"aa-52Wp0iYAg2yESttvTvf1qmM47yY"
set-cookie: qst.sid=s%3AhQMgkXDgpix-nEi8uWfZwFBfgeQnJjBQ.hHuvKgUwQd%2BfglZsMx8Ygn2TWJo5t%2FHwLh%2Bctn2sMg4; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full
200 OK 12 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (65324), with no line terminators
Hash c2b506a9ff49c2f410e81ce37dbef36c
c77659c5c039f2dcdc867613d61ff5ce2c4d65a6
21bbd4c3b8af58e8bee267a0dc5b8f54a61ca099ca48f9cdb2d06b37a3f4176d
GET /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=petrol.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=sIZYF9vte17bY2Srst-WKnWyDpjSVKAG&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html&stp=1&feed_type=full HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
X-Request-Id: 0fabc7fe1409be4e981e39ce
X-iivmxswc: 98e6196ceda4f15c546c8b1c886b5b0339c3def90e4694a560a6afb1a3ff3c93
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-09-02T17%3A38%3A21.267Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:24 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: stp=1; Path=/; Expires=Sun, 01 Sep 2024 17:38:22 GMT; Secure; SameSite=None
ck_tsp=2022-09-02T17%3A38%3A22.535Z; Path=/; Expires=Sun, 01 Sep 2024 17:38:22 GMT; Secure; SameSite=None
sip=91.90.42.154; Path=/; Expires=Sun, 01 Sep 2024 17:38:22 GMT; Secure; SameSite=None
ETag: W/"13520-0OGYyzbvcJDpUUWAjMsck2UgmkM"
Vary: Accept-Encoding
Content-Encoding: gzip
cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-flow-id,x-lead-id,x-offer-id,x-ofvuinwk,x-placement-id,x-session-id,x-zqhkygow
Referer: http://petrol.clientoffer.site/
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:24 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
200 OK 483 B URL HTTP/1.1 cdn.formulead.com/vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html
IP
File type JSON data\012- , ASCII text, with very long lines (483), with no line terminators
Hash e461157135b68c3185db2c328a6bbe96
93ff7f74a6aca29909c49a6b70c9fb81bd8208d2
b9f959e499cb782bd71318db2836208af9670a6c4d243a4d32529285bab33005
GET /vl/ql/?qb_country=NZ&cl_city=Oslo&cl_country=NO&cl_ip=91.90.42.154&aff_offer_id=1&cl_browser=Firefox&cl_browser_tz=UTC&cl_device=DESKTOP&cl_language=en-US&cl_os=Linux&cl_ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp=293c4ae45796181754e835201e3b50fc&vl_fp_cljs_device=unknown&vl_fp_cljs_language=en-US&vl_fp_cljs_lead_count=0&vl_fp_comp_has_lied_browser=false&vl_fp_comp_has_lied_languages=false&vl_fp_comp_has_lied_os=false&vl_fp_comp_has_lied_resolution=false&vl_fp_comp_navigator_platform=Linux%20x86_64&vl_fp_comp_color_depth=24&vl_fp_comp_resolution=1280&vl_fp_comp_resolution=1024&vl_fp_comp_user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&vl_fp_lead_count=0&vl_rc3=true&vl_rc3_score=0.1&vl_rc3_host=petrol.clientoffer.site&sc_url=http%3A%2F%2Fpetrol.clientoffer.site%2Fn%2F27%2F4%2Fz-nrg%2Fnz%2Findex.html HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
X-Offer-Id: 5e1f1fd6db04380100ede242
X-Flow-Id: 5e1f1fd6db04380100ede242
X-Placement-Id: 5bbb0ba263dcf80100a2e07f
x-zqhkygow: 44ee832f9eb1738ede1adf44e1c1b1ab744443e236468d60e69548571a820518
x-ofvuinwk: 51c596cea8a1e025d65df060d4165925c420294142687eee770782f199a0c8ad
X-Lead-Id: 0fabc7fe1409be4e981e39ce
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:25 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Vary: Accept-Encoding
cdn.formulead.com/t/page
200 OK 16 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
POST /t/page HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:sIZYF9vte17bY2Srst-WKnWyDpjSVKAG.OQNtKqFcvTccbyfP5ZbnJV7xvxIIDDbnk3PTuYxYVik
Content-Type: application/json
Content-Length: 114
Origin: http://petrol.clientoffer.site
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Fri, 02 Sep 2022 17:38:26 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://petrol.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Vary: Accept-Encoding
fonts.googleapis.com/css?family=Montserrat:400,700
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:400,700
IP
GET /css?family=Montserrat:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 02 Sep 2022 17:38:20 GMT
date: Fri, 02 Sep 2022 17:38:20 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
st.formulead.com/assets/js/bioep.min.js
200 OK 0 B URL HTTP/2 st.formulead.com/assets/js/bioep.min.js
IP
GET /assets/js/bioep.min.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
date: Fri, 02 Sep 2022 12:15:51 GMT
last-modified: Wed, 31 Aug 2022 08:58:37 GMT
etag: W/"630f22bd-14c4"
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: HM9D99zb5YCMjYtspvSvO7hkg5vVqN0sUBvrpVw15-xVTtFO3u_FOw==
age: 19349
X-Firefox-Spdy: h2
trk-consulatu.com/scripts/push/script/z75dnkdk4q?url=petrol.clientoffer.site
200 OK 0 B URL HTTP/2 trk-consulatu.com/scripts/push/script/z75dnkdk4q?url=petrol.clientoffer.site
IP
GET /scripts/push/script/z75dnkdk4q?url=petrol.clientoffer.site HTTP/1.1
Host: trk-consulatu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://petrol.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 02 Sep 2022 17:38:22 GMT
content-type: application/javascript;charset=UTF-8
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2Bu2PlsG8xe%2F0TFutrSWNUzvFHmDk8cm4HL18V4bqMJqZeTavGxEawJc1mxmwL2wPv43eLTdDvDiZ3i0DMVygZ2clE8p5SwVqz7zU0pGvmHs3spwGJOWNW8VxM6Gc6snroyndQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 744804d92e2e0afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
18.155.153.64
104.21.23.37
23.36.76.226
34.78.252.25
93.184.220.29