Report - 3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0

Report Overview

URL

3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0
IP

35.159.51.213

ASN

#16509 AMAZON-02
Submitted

2022-11-12T03:29:17Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

0
Threat Detection Systems

14

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
www.google-analytics.com (1)	40	2012-10-03T03:04:21Z	2023-03-10T13:35:34Z	379	20685	142.250.74.174
ocsp.globalsign.com (1)	2075	2012-07-20T19:46:16Z	2023-03-10T05:11:21Z	359	1410	104.18.21.226
www.google.com (1)	7	2015-05-10T13:11:19Z	2023-03-10T12:19:40Z	411	1194	142.250.74.132
region1.google-analytics.com (1)	unknown	2022-03-17T12:26:33Z	2023-03-10T05:19:43Z	705	569	216.239.34.36
stats.g.doubleclick.net (2)	96	2013-06-10T22:21:11Z	2023-03-10T12:41:09Z	1248	1434	142.251.1.157
3vsmdh0yz31vwcemst.com (14)	unknown	2022-10-26T17:28:52Z	2023-01-21T11:27:42Z	13832	1180573	35.159.51.213
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-10T05:10:00Z	782	2373	34.102.187.140
rstat.rockmostbet.com (3)	596584	2019-06-28T09:50:38Z	2023-03-09T22:07:41Z	1375	12117	162.55.5.93
fonts.gstatic.com (5)	unknown	2014-09-09T02:40:21Z	2023-03-10T14:37:36Z	2466	97839	216.58.207.195
ocsp.sectigo.com (1)	487	2019-11-29T12:50:24Z	2023-03-10T14:35:32Z	340	963	172.64.155.188
fonts.googleapis.com (1)	8877	2013-06-10T22:14:26Z	2023-03-10T12:25:49Z	483	746	142.250.74.10
r3.o.lencr.org (12)	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	4056	71131	23.36.76.226
ocsp.digicert.com (8)	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	2728	5606	93.184.220.29
static.scarabresearch.com (1)	14309	2018-03-27T09:32:15Z	2023-03-10T13:07:54Z	392	11706	54.230.111.73
my.rtmark.net (2)	9054	2015-02-04T10:54:57Z	2023-03-10T07:03:43Z	1037	1906	139.45.195.8
www.gstatic.com (1)	unknown	2016-07-26T11:37:06Z	2023-03-10T12:47:01Z	455	163572	142.250.74.163
ocsp.godaddy.com (1)	698	2012-05-20T21:28:57Z	2023-03-10T05:13:22Z	340	2285	192.124.249.36
mostauthor.com (9)	927193	2019-12-26T15:28:29Z	2023-03-09T22:07:42Z	6193	7435	185.26.99.196
code.jivosite.com (2)	30079	2012-07-22T04:03:39Z	2023-03-10T09:21:26Z	804	10683	92.223.124.24
cdn.scarabresearch.com (1)	11242	2017-08-01T09:10:31Z	2023-03-10T06:53:58Z	397	23219	54.230.111.107
ocsp.pki.goog (13)	175	2018-07-01T08:43:07Z	2023-03-10T05:11:10Z	4459	21171	142.250.74.3
www.googletagmanager.com (1)	75	2013-05-22T04:07:37Z	2023-03-10T13:03:15Z	388	56710	142.250.74.168
front.cdn-mb.com (3)	769991	2021-03-29T10:31:30Z	2023-03-09T22:07:41Z	1247	318791	104.21.9.158
mc.yandex.ru (8)	2672	2012-05-21T11:38:30Z	2023-03-10T13:34:13Z	8376	79494	93.158.134.119
www.google.no (2)	25607	2016-04-05T21:50:59Z	2023-03-10T07:09:08Z	1042	1388	142.250.74.3
code.jivo.ru (6)	unknown	2022-03-30T17:10:58Z	2023-03-10T13:11:29Z	2606	90242	92.223.126.57
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413	5843	34.160.144.191
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606	127	52.89.114.252
connect.facebook.net (1)	139	2012-05-22T04:51:28Z	2023-03-10T05:15:22Z	380	28602	31.13.72.12
ocsp2.globalsign.com (1)	1544	2012-05-23T20:10:04Z	2023-03-10T05:13:37Z	357	1897	104.18.20.226
webchannel-content.eservice.emarsys.net (1)	13932	2019-10-25T09:15:02Z	2023-03-10T06:53:58Z	610	313925	34.117.30.199
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333	229	34.117.237.239
img-getpocket.cdn.mozilla.net (7)	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3801	81146	34.120.237.76
node-sber1-az1-6.jivosite.com (1)	unknown	2022-10-10T07:34:32Z	2023-03-09T22:07:46Z	462	3509	188.72.107.240

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed
2022-11-11	medium	3vsmdh0yz31vwcemst.com	Sinkholed

HTTP Transactions (116)

URL IP Response Size

3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0

35.159.51.213

308 Permanent Redirect

164

URL HTTP/1.1

3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0
IP

35.159.51.213:0
ASN

#16509 AMAZON-02

Magic

HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators

Size

164
Hash

f23c4815ecaef1588f16ac735c0e15d6

026bf8cdd5076014b6fc822878e0086eb44da556

43a81fb3d47b34e7d42d6b8444f592ed9251b8e57db8f67d32419aa40b1480d0

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /partners/casino-reg?cid=1795397351&pid=14628&sip=0 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 308 Permanent Redirect
Server: nginx
Date: Sat, 12 Nov 2022 03:29:04 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

3d0727e32cd103ddd4b73f28c81758aa

197a7bf43d63723fc532c23c6dced68d5cc36652

d3f75d03561d6a47d19370292e821a86e58381466f0c69386a21175de55882ff

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D3F75D03561D6A47D19370292E821A86E58381466F0C69386A21175DE55882FF"
Last-Modified: Fri, 11 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11043
Expires: Sat, 12 Nov 2022 06:33:07 GMT
Date: Sat, 12 Nov 2022 03:29:04 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

4edf853c470fcec0ab277c78527f3c2d

de93530ce15337e671c488d9fe05e7091d4956f0

b9d7976b398b1243ff8a571ddd3975d3a1317d69101061bdb1a755b3b56620e6

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2115
Cache-Control: max-age=113858
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:04 GMT
Etag: "636e247f-1d7"
Expires: Sun, 13 Nov 2022 11:06:42 GMT
Last-Modified: Fri, 11 Nov 2022 10:31:27 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

34.102.187.140:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

d130218d0e2841f39c99610fe1a2ab90

29fbe1e177ee55c7a61ae0a206afff271cf5f945

6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 12 Nov 2022 02:43:59 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2705
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

5076aaa9f4ccd602540286ce0590cb9a

bbf7936a8413a564478971d9e19beb6338cbc869

00e3b967c579b0ccf709b78d497a43d95646b16eb50925fef1e2694c58f290b2

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "00E3B967C579B0CCF709B78D497A43D95646B16EB50925FEF1E2694C58F290B2"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13279
Expires: Sat, 12 Nov 2022 07:10:23 GMT
Date: Sat, 12 Nov 2022 03:29:04 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

67d5a988edcda47bc3b3b3f65d32b4b6

d4f0e0da8b3690cc7da925026d3414b68c7d954f

55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: WSaiiw5niBVXOr5Mqyvs8ph9j+zD6eTcPbQyi3vv6GG+cJVWFELAA31iZMP9luecciTAzprqcvg=
x-amz-request-id: NQ8YR4MS7S4CKRDM
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 12 Nov 2022 03:12:50 GMT
age: 974
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 03:29:04 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

34.102.187.140:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Cache-Control, Retry-After, Content-Length, Expires, ETag, Pragma, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 12 Nov 2022 03:24:58 GMT
cache-control: public,max-age=3600
age: 246
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

2a6f221333f4d0633c5d492adf89f854

25ed6192d61c074841159c65f0778d0145092d95

5da5c0633b78d8356564ff7bbcdefd72455fd191025fd3a230a2a69dbd2f1af1

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5DA5C0633B78D8356564FF7BBCDEFD72455FD191025FD3A230A2A69DBD2F1AF1"
Last-Modified: Thu, 10 Nov 2022 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5418
Expires: Sat, 12 Nov 2022 04:59:22 GMT
Date: Sat, 12 Nov 2022 03:29:04 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

f7ff606fbc8634c858bbc04b69f55cf6

2441de2cba649239efd0dae7a878d7ef2245c0b4

95154e0dbb7e827b8f893cc141f986c29634ead618256470d753429aa65a0548

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1242
Cache-Control: max-age=107910
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:04 GMT
Etag: "636e10ac-1d7"
Expires: Sun, 13 Nov 2022 09:27:34 GMT
Last-Modified: Fri, 11 Nov 2022 09:06:52 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

85d88bfb8fca121bbd41e00f1f3b4369

063343a8a4707d752db8d8ea779d0d681fa1c214

98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4219
Cache-Control: max-age=120244
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:04 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 12:53:08 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 279

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

85d88bfb8fca121bbd41e00f1f3b4369

063343a8a4707d752db8d8ea779d0d681fa1c214

98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4219
Cache-Control: max-age=120244
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:04 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 12:53:08 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 279

cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js

54.230.111.107

200 OK

22699

URL HTTP/1.1

cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
IP

54.230.111.107:0
ASN

#16509 AMAZON-02

Magic

C source, ASCII text, with very long lines (539)

Size

22699
Hash

bfcc64224f8c6e43e026afb16bd0f4f8

4b1a0dbd96c3047a917ba024690ffc4d544b8b00

c87358a7c76c044147379c9415f96488045b936666093c83fd0e57e08316548e

HTTP Headers

                                        GET /js/11DAF087E87A3DFD/scarab-v2.js HTTP/1.1
Host: cdn.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Timing-Allow-Origin: *
Date: Sat, 12 Nov 2022 03:05:16 GMT
Cache-Control: max-age=3600,public
ETag: "aa53180343ab25d32aa7294158ca3216--gzip"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wRl-I6xSXrsd-dOwTpKyddiPajpWGcpgeVHPpLkzRFkrQwzLg4xbJw==
Age: 1447

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

85d88bfb8fca121bbd41e00f1f3b4369

063343a8a4707d752db8d8ea779d0d681fa1c214

98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3264
Cache-Control: max-age=119288
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 12:37:13 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (amb/6BC2)
X-Cache: HIT
Content-Length: 279

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

85d88bfb8fca121bbd41e00f1f3b4369

063343a8a4707d752db8d8ea779d0d681fa1c214

98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4220
Cache-Control: max-age=120244
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 12:53:09 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 279

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.3:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

b474f74278f0bc7d8a7d6a66c3dcc2dd

6aad727d11a42fefbcabe6af4f0d32c42c946043

db18a18706d236333a7e8671728aea6adbe89e54905799cb5dc8d32feadf2e53

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

static.scarabresearch.com/wpjs/wploader.js?ts=2758

54.230.111.73

200 OK

11117

URL HTTP/1.1

static.scarabresearch.com/wpjs/wploader.js?ts=2758
IP

54.230.111.73:0
ASN

#16509 AMAZON-02

Magic

Unicode text, UTF-8 text, with very long lines (26064)

Size

11117
Hash

5a9d4022e839d5c9142b7713905a32f6

28d50e8c56816de249444cb574dcabb1fe5d0593

a3f92910377fdb07f6137a07cba50d2c74e6b10d1aa9f2b07d6575a852d587e3

HTTP Headers

                                        GET /wpjs/wploader.js?ts=2758 HTTP/1.1
Host: static.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 10 Oct 2022 11:09:48 GMT
x-amz-version-id: DzVXMgBeksdrQfAKjc.ckmkVhMlLjwqT
Server: AmazonS3
Content-Encoding: gzip
Date: Fri, 11 Nov 2022 05:21:47 GMT
Cache-Control: max-age=86400
ETag: W/"1bb200ba7add3c5d4bfb6f3822bfe5af"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 5FtJjfw9SEc6MA8Z6i-yjd-8EbjFqzqNrpMaJuG4XIN01dMdWxkBew==
Age: 79638

www.googletagmanager.com/gtm.js?id=GTM-5PMSX62

142.250.74.168

200 OK

55947

URL HTTP/2

www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
IP

142.250.74.168:0
ASN

#15169 GOOGLE

Magic

Unicode text, UTF-8 text, with very long lines (13644)

Size

55947
Hash

52fd58414c38494d6a3c75e214b4d368

4e6769d1504e02a19e95f5f22e7227f77ce846ab

57020b450896f0b0a2570a884a4891de6d3b158cfeb0154a0ea050045cf5d2a8

HTTP Headers

                                        GET /gtm.js?id=GTM-5PMSX62 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 12 Nov 2022 03:29:05 GMT
expires: Sat, 12 Nov 2022 03:29:05 GMT
cache-control: private, max-age=900
last-modified: Sat, 12 Nov 2022 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 55947
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

rstat.rockmostbet.com/public/rstat_pixel_spa.js

162.55.5.93

200 OK

10303

URL HTTP/2

rstat.rockmostbet.com/public/rstat_pixel_spa.js
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

C source, ASCII text

Size

10303
Hash

f1b5cdd115d84254efb1d1cce82933d7

05cd06e570be5aaeee38c3139bb8b77173d0ce7b

fd390c721adddf0b2b6e8e3a28fd3f072a4b95c7af5d1fc02c10c95ab2050d7c

HTTP Headers

                                        GET /public/rstat_pixel_spa.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
content-type: application/javascript
etag: "rkzpry7y7"
last-modified: Mon, 07 Nov 2022 18:23:58 GMT
server: Caddy
x-content-type-options: nosniff
content-length: 10303
date: Sat, 12 Nov 2022 03:29:05 GMT
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.3:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

b474f74278f0bc7d8a7d6a66c3dcc2dd

6aad727d11a42fefbcabe6af4f0d32c42c946043

db18a18706d236333a7e8671728aea6adbe89e54905799cb5dc8d32feadf2e53

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

push.services.mozilla.com/

52.89.114.252

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

52.89.114.252:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: j/tn+96ZXDC4c9QhgH1PxQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: i/JZOa1zejuizUP4RoKKjSaK9Z4=

front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js

104.21.9.158

200 OK

316428

URL HTTP/2

front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js
IP

104.21.9.158:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

316428
Hash

a10e2e853210c05d9af796517747c586

6b4c762f4279ab71637e87d73da80f3ac2189fe1

6f87096e1b0593e3873a657e1359a77fd32bba728b34b6ea7a02b0578ec11311

HTTP Headers

                                        GET /spa-static/1.4.1006/static/js/main.f903f749.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Sat, 12 Nov 2022 03:29:05 GMT
content-type: application/javascript
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-5bdb8"
expires: Sat, 12 Nov 2022 07:26:38 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 147
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QaVcKeGjqSly0bLJxw6L9KRaT9%2FMYbKgxsyPWYu7XeqTfeW%2FQ1vq8T6%2FnlXUw%2Fsnm9mRFxbQWMdzbCqWfLePYvppKsMF3fpxQ9Zsiq2Tae3dqjzrpvrfwQBP9X%2FU3W84KyLF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 768c2e664fdb1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.sectigo.com/

172.64.155.188

200 OK

471

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

471
Hash

21817fa3c60612398404dbe75d383a1a

2d5e08988401c8d0adb24fb26987a0ee26544b4e

12cf02219c8cf9fe9b31f48e19ec88ff888a4ca87a7af1c47eff60a9c5865bfe

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 03:29:05 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 18:25:29 GMT
Expires: Thu, 17 Nov 2022 18:25:28 GMT
Etag: "2d5e08988401c8d0adb24fb26987a0ee26544b4e"
Cache-Control: max-age=485182,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 768c2e682c00b521-OSL

my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01

139.45.195.8

200 OK

697

URL HTTP/2

my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
IP

139.45.195.8:0
ASN

#9002 RETN Limited

Magic

ASCII text

Size

697
Hash

6425f508eacb60db81c6d0b38ae56a58

d27caed071b054a15ab2291a11a4bfe12e097d7a

e94404dcfeb2d07ed1a6c0ad4230d5bc5754c0c965736d4ebc3224af415094d0

HTTP Headers

                                        GET /p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 03:29:05 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

d84a911b820c140cf4e3da2af665b63c

fbee3b2193231404844c0ecb6e8f72d02d30e997

7f0381e9de205bbe3e0cab3e7e40afced0d58bb25b8df4715d1406c702624d14

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5565
Cache-Control: max-age=91695
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Etag: "636dc073-1d7"
Expires: Sun, 13 Nov 2022 04:57:20 GMT
Last-Modified: Fri, 11 Nov 2022 03:24:35 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

www.google-analytics.com/analytics.js

142.250.74.174

200 OK

20039

URL HTTP/2

www.google-analytics.com/analytics.js
IP

142.250.74.174:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (1325)

Size

20039
Hash

47e6f374ca946fddd5b59871b325736c

baa9282efc8785e84d247c3bff518eaa45f101c4

16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e

HTTP Headers

                                        GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 12 Nov 2022 02:41:09 GMT
expires: Sat, 12 Nov 2022 04:41:09 GMT
cache-control: public, max-age=7200
age: 2876
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

connect.facebook.net/en_US/fbevents.js

31.13.72.12

200 OK

27337

URL HTTP/2

connect.facebook.net/en_US/fbevents.js
IP

31.13.72.12:0
ASN

#32934 FACEBOOK

Magic

ASCII text, with very long lines (64348)

Size

27337
Hash

0ac10debd3a9ea8147a26d045bb93e6e

ff45f3442508e8695f2303701682ebdb6e016464

5dee7b453b2c72c07ff1d62432493a044507835a8031ea62edf2fa7cc26219b9

HTTP Headers

                                        GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: jVEcxUS6/n3V5ec4muRKqs0GM/XJML6r2FrGSeJhQf2eIQ/mOrA4q/B74hUYaonV5fAxHaYn1AAqzzpPm6cohg==
priority: u=3,i
content-length: 27337
x-fb-trip-id: 1904183273
date: Sat, 12 Nov 2022 03:29:05 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

d84a911b820c140cf4e3da2af665b63c

fbee3b2193231404844c0ecb6e8f72d02d30e997

7f0381e9de205bbe3e0cab3e7e40afced0d58bb25b8df4715d1406c702624d14

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5565
Cache-Control: max-age=91695
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 03:29:05 GMT
Etag: "636dc073-1d7"
Expires: Sun, 13 Nov 2022 04:57:20 GMT
Last-Modified: Fri, 11 Nov 2022 03:24:35 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

ocsp.globalsign.com/gseccovsslca2018

104.18.21.226

200 OK

939

URL HTTP/1.1

ocsp.globalsign.com/gseccovsslca2018
IP

104.18.21.226:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

939
Hash

12af49097cdb29eec2b1046758d0a7f7

b3ab08e63d7f49f3a545017baa700f22335ba80a

50a391b5793865d050cc91ad79efac69878f1582148d894ff17bf3049434d67f

HTTP Headers

                                        POST /gseccovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 03:29:05 GMT
Content-Type: application/ocsp-response
Content-Length: 939
Connection: keep-alive
Expires: Wed, 16 Nov 2022 01:49:37 GMT
ETag: "b3ab08e63d7f49f3a545017baa700f22335ba80a"
Last-Modified: Sat, 12 Nov 2022 01:49:38 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 14
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 768c2e69395ab51e-OSL

rstat.rockmostbet.com/band/t4k.json?

162.55.5.93

200 OK

URL HTTP/2

rstat.rockmostbet.com/band/t4k.json?
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

JSON data\012- , ASCII text, with no line terminators

Size

86
Hash

3b7aec6e51bcbd2d5fda97032ba0a9a2

7a09d20e64f40614a39a23e000c9595240226499

031894bc9258aeef2d6ce8bae0b4e85b19f199fc21101fbaff23d5dbe3db5436

HTTP Headers

                                        POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 659
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 03:29:05 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997037527248928768; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 3
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2

rstat.rockmostbet.com/band/t4k.json?

162.55.5.93

200 OK

URL HTTP/2

rstat.rockmostbet.com/band/t4k.json?
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

JSON data\012- , ASCII text, with no line terminators

Size

86
Hash

6247851ccb128c77e9ae6ed291560e26

194cb53aef7b73acec21985b2017c14ac335ed3e

36966a33ddb06ad9a6044b9786e5e8026894e705c08115d119aa50d623e4a6ef

HTTP Headers

                                        POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 747
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 03:29:05 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997037527248928768; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 1
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2

mc.yandex.ru/metrika/tag.js

93.158.134.119

200 OK

73397

URL HTTP/2

mc.yandex.ru/metrika/tag.js
IP

93.158.134.119:0
ASN

#13238 YANDEX LLC

Magic

Unicode text, UTF-8 (with BOM) text, with very long lines (587)

Size

73397
Hash

6bb9990fc521832208f25ccf5261b719

be8acfb80dfc034d5cbd7dabb318ea8853762c10

677f03256dacdc519c12971fd422fe1afa0ecca3864f4e8f7aa0bed4eecd9c38

HTTP Headers

                                        GET /metrika/tag.js HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-length: 73397
date: Sat, 12 Nov 2022 03:29:05 GMT
access-control-allow-origin: *
etag: "63575841-11eb5"
expires: Sat, 12 Nov 2022 04:29:05 GMT
last-modified: Tue, 25 Oct 2022 06:30:09 GMT
cache-control: max-age=3600
content-encoding: br
content-type: application/javascript
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

3vsmdh0yz31vwcemst.com/api/v1/logo

35.159.51.213

200 OK

141

URL HTTP/2

3vsmdh0yz31vwcemst.com/api/v1/logo
IP

35.159.51.213:0
ASN

#16509 AMAZON-02

Magic

data

Size

141
Hash

75926fabb45a9fe1dc3f0cb59e0b8e87

5c0961563a8b1a8dd6ed23097a0d3bb5288a374b

6a5f0458a3af0ed42f43a295a55dfa555cdaf948407ce36ddea85dee65553090

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /api/v1/logo HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: dye0fnnkfe2hnr2zi3ee
x-client-device-id: cxxvgmh1i3yrdmvt8jhg
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668223744.1.0.1668223744.0.0.0; _ga=GA1.2.913967725.1668223745; rst-uid=6997037527248928768; _gid=GA1.2.1072228301.1668223745; _gaclientid=913967725.1668223745; _gasessionid=20221112|07312618; _gahitid=1668223745078; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; cid=1795397351; prid=most_partner.1795397351; pid=14628; sip=0; PHPSESSID=6tm6h56dprg7s8duujffqa4p8c; lunetics_locale=bn; tz=Europe%2FOslo
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 03:29:05 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"9dfab82e3b4ec3d36c2d3f40883172cf"
x-request-id: fee1162079525d22621b3249eec61eab
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 03:29:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials

35.159.51.213

200 OK

243

URL HTTP/2

3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials
IP

35.159.51.213:0
ASN

#16509 AMAZON-02

Magic

data

Size

243
Hash

1e8546c3d385a7a3aa4e1eb6c5b68834

9c56ecf33831bf0c3a981cfd841e6e89272bb5bc

86b03ddab65af827b693f75b5acc2dac15fb92690e72c3e79e8b0304aa9e1abe

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /api/v1/websocket/credentials HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: dye0fnnkfe2hnr2zi3ee
x-client-device-id: cxxvgmh1i3yrdmvt8jhg
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668223744.1.0.1668223744.0.0.0; _ga=GA1.1.913967725.1668223745; rst-uid=6997037527248928768
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 03:29:05 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 13a84d44d45e4d7be05dbf9377e5b4ac
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 03:29:05 GMT
set-cookie: PHPSESSID=6tm6h56dprg7s8duujffqa4p8c; expires=Mon, 12-Dec-2022 03:29:05 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 03:29:05 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 03:29:05 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

3vsmdh0yz31vwcemst.com/api/v1/settings

35.159.51.213

200 OK

94031

URL HTTP/2

3vsmdh0yz31vwcemst.com/api/v1/settings
IP

35.159.51.213:0
ASN

#16509 AMAZON-02

Magic

JSON data\012- , ASCII text, with very long lines (35619)

Size

94031
Hash

ffee31ec78271ac6ecdb8d389041cd04

19e9b96ec3245d1899d98523601c4a4c568fe269

f6a1ada653805c2cadd879937fe291947bdc75275a047edc38af49d3727504e5

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /api/v1/settings HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: dye0fnnkfe2hnr2zi3ee
x-client-device-id: cxxvgmh1i3yrdmvt8jhg
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1795397351&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668223744.1.0.1668223744.0.0.0; _ga=GA1.1.913967725.1668223745; rst-uid=6997037527248928768
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 03:29:05 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 6ada92154b2a18c5e52a2266821b05a5
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 03:29:05 GMT
set-cookie: PHPSESSID=vppubefek5p526d9i1if8iuh6n; expires=Mon, 12-Dec-2022 03:29:05 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 03:29:05 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 03:29:05 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

mc.yandex.ru/metrika/advert.gif

93.158.134.119

200 OK

URL HTTP/2

mc.yandex.ru/metrika/advert.gif
IP

93.158.134.119:0
ASN

#13238 YANDEX LLC

Magic

GIF image data, version 89a, 1 x 1\012- data

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (51)

#1 JS:Script (size: 408610)

#2 JS:Script (size: 178)

#3 JS:Script (size: 31907)

#4 JS:Script (size: 0)

#5 JS:Script (size: 565)

#6 JS:Script (size: 909)

#7 JS:Script (size: 287)

#8 JS:Script (size: 213968)

#9 JS:Script (size: 19785)

#10 JS:Script (size: 35989)

#11 JS:Script (size: 180)

#12 JS:Script (size: 697)

#13 JS:Script (size: 50230)

#14 JS:Script (size: 61871)

#15 JS:Script (size: 376248)

#16 JS:Script (size: 10303)

#17 JS:Script (size: 105275)

#18 JS:Script (size: 48184)

#19 JS:Script (size: 10181)

#20 JS:Script (size: 482)

#21 JS:Script (size: 17132)

#22 JS:Script (size: 11729)

#23 JS:Script (size: 300785)

#24 JS:Script (size: 505)

#25 JS:Script (size: 102837)

#26 JS:Script (size: 382)

#27 JS:Script (size: 607316)

#28 JS:Script (size: 441693)

#29 JS:Script (size: 502885)

#30 JS:Script (size: 365)

#31 JS:Script (size: 228142)

#32 JS:Script (size: 269580)

#33 JS:Script (size: 1110886)

#34 JS:Script (size: 37)

#35 JS:Script (size: 295)

#36 JS:Script (size: 97421)

#37 JS:Script (size: 69)

#1 JS:Eval (size: 22)

#2 JS:Eval (size: 209)

#3 JS:Eval (size: 21514)

#4 JS:Eval (size: 391)

#5 JS:Eval (size: 193)

#6 JS:Eval (size: 994)

#7 JS:Eval (size: 15556)

#8 JS:Eval (size: 64)

#9 JS:Eval (size: 194)

#10 JS:Eval (size: 193)

#11 JS:Eval (size: 22)

#12 JS:Eval (size: 193)

#13 JS:Eval (size: 194)

#1 JS:Write (size: 1111035)

HTTP Transactions (116)

URL HTTP/1.1

IP

ASN

Magic

Size