Overview

URLmonthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
IP 3.212.250.95 (United States)
ASN#14618 AMAZON-AES
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-31 18:11:52 UTC
StatusLoading report..
IDS alerts0
Blocklist alert3
urlquery alerts No alerts detected
Tags None

Domain Summary (29)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
r3.o.lencr.org (7) 344 2020-12-02 08:52:13 UTC 2023-01-30 17:12:04 UTC 23.36.76.226
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-30 17:13:18 UTC 34.117.237.239
ocsp.sca1b.amazontrust.com (6) 1015 2016-02-14 02:37:56 UTC 2019-03-27 04:05:54 UTC 54.230.245.100
create.lidstatic.com (1) 24133 2015-09-23 19:42:02 UTC 2023-01-31 07:45:59 UTC 172.67.41.229
api.trustedform.com (3) 23021 2012-10-29 05:30:13 UTC 2023-01-31 07:45:59 UTC 3.92.140.101
cdn.trustedform.com (1) 24659 2020-08-26 23:38:48 UTC 2023-01-31 07:45:59 UTC 54.230.111.60
cdnjs.cloudflare.com (2) 235 2012-05-23 12:49:49 UTC 2023-01-31 02:26:46 UTC 104.17.24.14
code.jquery.com (1) 634 2012-05-21 17:28:02 UTC 2023-01-30 17:12:05 UTC 69.16.175.42
ocsp.digicert.com (7) 86 2012-05-21 07:02:23 UTC 2023-01-31 01:22:54 UTC 93.184.220.29
create.leadid.com (4) 14598 2014-01-22 13:55:11 UTC 2023-01-31 07:45:59 UTC 50.16.132.247
stackpath.bootstrapcdn.com (2) 2467 2018-04-05 04:41:29 UTC 2023-01-30 23:28:58 UTC 104.18.10.207
monthlysweeps.us (10) 0 2017-12-18 20:14:21 UTC 2023-01-30 18:06:59 UTC 3.212.250.95 Unknown ranking
cdn.jsdelivr.net (2) 439 2012-09-30 00:15:09 UTC 2023-01-30 17:47:48 UTC 151.101.193.229
static.hotjar.com (1) 641 2014-11-01 05:14:27 UTC 2023-01-30 17:12:04 UTC 54.230.111.39
in.hotjar.com (1) 1746 2018-07-03 09:33:18 UTC 2023-01-30 17:13:17 UTC 34.253.22.133
ocsp.pki.goog (5) 175 2017-06-14 07:23:31 UTC 2023-01-30 17:12:02 UTC 142.250.74.131
ads.pro-market.net (1) 47212 2012-05-22 07:59:48 UTC 2023-01-31 07:45:58 UTC 95.101.10.74
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-30 17:15:40 UTC 52.88.112.71
img-getpocket.cdn.mozilla.net (2) 1631 2017-09-01 03:40:57 UTC 2023-01-30 22:05:30 UTC 34.120.237.76
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-30 17:12:02 UTC 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-30 17:40:18 UTC 34.160.144.191
ocsp.globalsign.com (1) 2075 2012-05-25 06:20:55 UTC 2023-01-30 17:21:08 UTC 104.18.21.226
ldsapi.tmginteractive.com (5) 85617 2017-02-02 01:31:46 UTC 2023-01-30 18:07:02 UTC 209.151.244.116
monthlysweeps.us (10) 0 2017-12-18 20:14:21 UTC 2023-01-30 18:06:59 UTC 107.23.100.94 Unknown ranking
fonts.googleapis.com (1) 8877 2012-05-23 12:41:44 UTC 2023-01-30 20:34:06 UTC 142.250.74.106
ocsp.sectigo.com (1) 487 2018-12-17 11:31:55 UTC 2023-01-30 21:19:56 UTC 104.18.32.68
tmgassets.azureedge.net (11) 0 2022-06-26 22:01:19 UTC 2023-01-30 18:07:01 UTC 13.107.238.53 Domain (azureedge.net) ranked at: 2986
ocsp.usertrust.com (1) 899 2012-05-21 15:43:18 UTC 2023-01-30 17:12:24 UTC 172.64.155.188
vars.hotjar.com (1) 1014 2020-11-05 10:13:14 UTC 2023-01-30 17:44:06 UTC 54.230.111.85

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-31 2 monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/1694 (...) Phishing
2023-01-31 2 monthlysweeps.us/assets/js/datepicker.js Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 3.212.250.95
Date UQ / IDS / BL URL IP
2023-02-06 21:11:00 +0000 0 - 0 - 3 monthlysweeps.us/go/to/cabunn/key/4c0aa3ee841 (...) 3.212.250.95
2023-02-06 18:55:48 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:46 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:29 +0000 0 - 0 - 6 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:51:43 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/1b23ce61749 (...) 3.212.250.95


Last 5 reports on ASN: AMAZON-AES
Date UQ / IDS / BL URL IP
2023-03-21 13:34:06 +0000 0 - 3 - 2 petite-flying-daemonosaurus.glitch.me/chjbhcf (...) 34.196.66.68
2023-03-21 13:25:35 +0000 0 - 0 - 1 juicynovels.com/lastArchive/mvoicea/53106e7b7 (...) 52.86.6.113
2023-03-21 13:25:22 +0000 0 - 3 - 0 sleepy-festive-chicken.glitch.me/ 34.230.219.115
2023-03-21 13:25:17 +0000 0 - 0 - 1 mailstat.us/tr/t/fiaujn4kagd3kagd/4/https:/t. (...) 184.73.182.153
2023-03-21 13:24:41 +0000 0 - 1 - 1 sp-storage.spccinta.com/installer/2.16.0.376/ (...) 54.174.1.219


Last 5 reports on domain: monthlysweeps.us
Date UQ / IDS / BL URL IP
2023-03-20 22:57:45 +0000 0 - 0 - 1 monthlysweeps.us/go/to/e91247/key/3f3e591250a (...) 54.144.195.192
2023-03-20 22:15:00 +0000 0 - 0 - 2 monthlysweeps.us/go/to/e91247/key/3f3e591250a (...) 3.228.163.244
2023-03-20 00:16:06 +0000 0 - 0 - 3 monthlysweeps.us/go/to/4mmjuy/key/b0d1864016f (...) 54.144.195.192
2023-03-20 00:16:01 +0000 0 - 0 - 6 monthlysweeps.us/go/to/4mmjuy/key/b0d1864016f (...) 3.228.163.244
2023-03-20 00:15:53 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/b0d1864016f (...) 3.228.163.244


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-14 11:27:04 +0000 0 - 0 - 6 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 107.23.100.94
2023-01-14 11:27:03 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 107.23.100.94
2023-01-14 11:27:00 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 3.212.250.95
2023-01-13 11:17:20 +0000 0 - 0 - 6 monthlysweeps.us/go/to/ss28jn/key/9c9c2fa157c (...) 107.23.100.94
2023-01-13 11:17:18 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/9c9c2fa157c (...) 107.23.100.94

JavaScript

Executed Scripts (47)

Executed Evals (9)
#1 JavaScript::Eval (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
#2 JavaScript::Eval (size: 39) - SHA256: 0aeb75f562fc45c7f813112b57573ff29a3c5f562fbd9f0455099a12816409d3
tmgShowingLiveViewOnly_1338743879 = true;
#3 JavaScript::Eval (size: 22) - SHA256: e62188d211f8522a0d02bbc2b5e8fea05d32dd1b03c4602c86673da2007d97dd
0,
function(g) {
    Xe(g, 1)
}
#4 JavaScript::Eval (size: 22) - SHA256: 0af0cb21968fe023d8ea63ee97d9b7172bb86ffeab2023aa51326d793e379a00
0,
function(g) {
    Xe(g, 2)
}
#5 JavaScript::Eval (size: 64) - SHA256: 2c6fcc10d170735ea0103cebd297129fae592327ed69dbf1773991fe63c4d8d0
0,
function(g, O, t) {
    (O = (t = (O = R(g), R(g)), g.B[O]) && P(g, O), Q)(g, t, O)
}
#6 JavaScript::Eval (size: 27) - SHA256: 52b43864b9f1786d8c0d2d679562e90dc2a00c9d68ea80188a37d9b01d23dd47
lOptionDocumentNumber_10023
#7 JavaScript::Eval (size: 14) - SHA256: 0510de046e8325540849bad09f31eaaa3e9256fafd330c5d57327dc948812a33
/*@cc_on!@*/ !1
#8 JavaScript::Eval (size: 15175) - SHA256: 52415b490c74147de83cd4e6511775e9ff84415d86d21f3756f27c0523b0d509
(function() {
    var b, l = function(p, m, r, h) {
            for (h = (p | (r = [], 0)) - 1; 0 <= h; h--) r[(p | 0) - 1 - (h | 0)] = m >> 8 * h & 255;
            return r
        },
        Q = function(p, m, r) {
            if (428 == m || 176 == m) p.B[m] ? p.B[m].concat(r) : p.B[m] = p8(r, p);
            else {
                if (p.Y && 191 != m) return;
                120 == m || 346 == m || 443 == m || 294 == m || 336 == m ? p.B[m] || (p.B[m] = mS(p, m, 30, r)) : p.B[m] = mS(p, m, 137, r)
            }
            191 == m && (p.l = d(false, 32, p), p.Z = void 0)
        },
        g0 = function(p, m, r, h) {
            function H() {}
            return r = sz(p, function(g) {
                H && (m && I(m), h = g, H(), H = void 0)
            }, (h = void 0, !!m))[0], {
                invoke: function(g, O, t, F) {
                    function k() {
                        h(function(K) {
                            I(function() {
                                g(K)
                            })
                        }, t)
                    }
                    if (!O) return O = r(t), g && g(O), O;
                    h ? k() : (F = H, H = function() {
                        I((F(), k))
                    })
                }
            }
        },
        r0 = function(p, m) {
            (m.push(p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3]), m.push(p[4] << 24 | p[5] << 16 | p[6] << 8 | p[7]), m).push(p[8] << 24 | p[9] << 16 | p[10] << 8 | p[11])
        },
        Oz = function(p, m) {
            return (m = J(p), m & 128) && (m = m & 127 | J(p) << 7), m
        },
        mS = function(p, m, r, h, H, g, O, t) {
            return ((O = (h = [(H = hk, -97), -76, 1, -9, -92, -60, h, -40, 38, (t = r & 7, -88)], a[p.K](p.Dc)), O)[p.K] = function(F) {
                t += 6 + (g = F, 7 * r), t &= 7
            }, O).concat = function(F) {
                return ((g = (F = +t + h[t + 19 & 7] * (F = m % 16 + 1, m) * F - 57 * m * m * g - F * g + 57 * g * g - 4503 * g - -4332 * m * g + (H() | 0) * F + 1 * m * m * F, void 0), F = h[F], h)[(t + 45 & 7) + (r & 2)] = F, h)[t + (r & 2)] = -76, F
            }, O
        },
        p8 = function(p, m, r) {
            return (r = a[m.K](m.eq), r[m.K] = function() {
                return p
            }, r).concat = function(h) {
                p = h
            }, r
        },
        tk = function(p, m, r, h, H) {
            for (H = (h = 0, p)[2] | 0, p = p[3] | 0; 14 > h; h++) m = m >>> 8 | m << 24, m += r | 0, r = r << 3 | r >>> 29, m ^= H + 1656, p = p >>> 8 | p << 24, r ^= m, p += H | 0, p ^= h + 1656, H = H << 3 | H >>> 29, H ^= p;
            return [r >>> 24 & 255, r >>> 16 & 255, r >>> 8 & 255, r >>> 0 & 255, m >>> 24 & 255, m >>> 16 & 255, m >>> 8 & 255, m >>> 0 & 255]
        },
        HO = function(p, m, r, h, H) {
            (H = P(p, (h = (H = (m &= (r = m & 3, 4), R(p)), R)(p), H)), m && (H = Fe("" + H)), r) && z(p, h, l(2, H.length)), z(p, h, H)
        },
        bY = function(p) {
            return p
        },
        eR = function(p, m, r, h, H) {
            if (H = p[0], H == C) m.A = 25, m.N(p);
            else if (H == G) {
                r = p[1];
                try {
                    h = m.W || m.N(p)
                } catch (g) {
                    w(g, m), h = m.W
                }
                r(h)
            } else if (H == lY) m.N(p);
            else if (H == X) m.N(p);
            else if (H == d0) {
                try {
                    for (h = 0; h < m.L.length; h++) try {
                        r = m.L[h], r[0][r[1]](r[2])
                    } catch (g) {}
                } catch (g) {}(0, p[1])(function(g, O) {
                    m.j(g, true, O)
                }, (m.L = [], function(g) {
                    (E(m, (g = !m.I.length, [K8])), g) && A(true, m, false)
                }))
            } else {
                if (H == y) return h = p[2], Q(m, 499, p[6]), Q(m, 33, h), m.N(p);
                H == K8 ? (m.P = [], m.s = [], m.B = null) : H == Qb && "loading" === U.document.readyState && (m.h = function(g, O) {
                    function t() {
                        O || (O = true, g())
                    }
                    U.document.addEventListener("DOMContentLoaded", (O = false, t), u), U.addEventListener("load", t, u)
                })
            }
        },
        J = function(p) {
            return p.X ? oD(p, p.R) : d(true, 8, p)
        },
        DG = function(p, m, r) {
            if (3 == p.length) {
                for (r = 0; 3 > r; r++) m[r] += p[r];
                for (p = 0, r = [13, 8, 13, 12, 16, 5, 3, 10, 15]; 9 > p; p++) m[3](m, p % 3, r[p])
            }
        },
        oD = function(p, m) {
            return (m = m.create().shift(), p.X.create()).length || p.R.create().length || (p.R = void 0, p.X = void 0), m
        },
        xE = function(p, m, r, h) {
            try {
                h = p[((m | 0) + 2) % 3], p[m] = (p[m] | 0) - (p[((m | 0) + 1) % 3] | 0) - (h | 0) ^ (1 == m ? h << r : h >>> r)
            } catch (H) {
                throw H;
            }
        },
        ID = function(p, m, r) {
            if ("object" == (m = typeof p, m))
                if (p) {
                    if (p instanceof Array) return "array";
                    if (p instanceof Object) return m;
                    if ((r = Object.prototype.toString.call(p), "[object Window]") == r) return "object";
                    if ("[object Array]" == r || "number" == typeof p.length && "undefined" != typeof p.splice && "undefined" != typeof p.propertyIsEnumerable && !p.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == r || "undefined" != typeof p.call && "undefined" != typeof p.propertyIsEnumerable && !p.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == m && "undefined" == typeof p.call) return "object";
            return m
        },
        Y = function(p, m, r) {
            (Q(p, r, m), m)[Qb] = 2796
        },
        f8 = function(p, m, r, h, H, g) {
            if (!p.W) {
                p.G++;
                try {
                    for (h = (H = (g = p.H, 0), void 0); --m;) try {
                        if (r = void 0, p.X) h = oD(p, p.X);
                        else {
                            if ((H = P(p, 428), H) >= g) break;
                            h = P((r = (Q(p, 176, H), R(p)), p), r)
                        }
                        W(false, p, (h && h[K8] & 2048 ? h(p, m) : M(0, p, [v, 21, r]), m), false)
                    } catch (O) {
                        P(p, 216) ? M(22, p, O) : Q(p, 216, O)
                    }
                    if (!m) {
                        if (p.H$) {
                            f8((p.G--, p), 473199118497);
                            return
                        }
                        M(0, p, [v, 33])
                    }
                } catch (O) {
                    try {
                        M(22, p, O)
                    } catch (t) {
                        w(t, p)
                    }
                }
                p.G--
            }
        },
        Jk = function(p, m) {
            return p[m] << 24 | p[(m | 0) + 1] << 16 | p[(m | 0) + 2] << 8 | p[(m | 0) + 3]
        },
        aD = function(p, m, r, h, H, g) {
            function O() {
                if (p.D == p) {
                    if (p.B) {
                        var t = [y, r, h, void 0, H, g, arguments];
                        if (2 == m) var F = A(false, p, (E(p, t), false));
                        else if (1 == m) {
                            var k = !p.I.length;
                            E(p, t), k && A(false, p, false)
                        } else F = eR(t, p);
                        return F
                    }
                    H && g && H.removeEventListener(g, O, u)
                }
            }
            return O
        },
        RD = function(p, m, r) {
            return p.j(function(h) {
                r = h
            }, false, m), r
        },
        U = this || self,
        sz = function(p, m, r, h) {
            return (h = Z[p.substring(0, 3) + "_"]) ? h(p.substring(3), m, r) : SR(m, p)
        },
        u = {
            passive: true,
            capture: true
        },
        SR = function(p, m) {
            return p(function(r) {
                r(m)
            }), [function() {
                return m
            }]
        },
        d = function(p, m, r, h, H, g, O, t, F, k, K, D, e, x) {
            if ((x = P(r, 428), x) >= r.H) throw [v, 31];
            for (g = (h = (k = (H = x, 0), m), r.lX).length; 0 < h;) F = H >> 3, t = r.P[F], K = H % 8, e = 8 - (K | 0), e = e < h ? e : h, p && (D = r, D.Z != H >> 6 && (D.Z = H >> 6, O = P(D, 191), D.C = tk([0, 0, O[1], O[2]], D.Z, D.l)), t ^= r.C[F & g]), k |= (t >> 8 - (K | 0) - (e | 0) & (1 << e) - 1) << (h | 0) - (e | 0), h -= e, H += e;
            return Q(r, 428, (p = k, (x | 0) + (m | 0))), p
        },
        I = U.requestIdleCallback ? function(p) {
            requestIdleCallback(function() {
                p()
            }, {
                timeout: 4
            })
        } : U.setImmediate ? function(p) {
            setImmediate(p)
        } : function(p) {
            setTimeout(p, 0)
        },
        cO = function(p, m, r, h, H, g) {
            for (H = (r = R((m = (h = (g = p[q0] || {}, R(p)), g.W$ = R(p), g.V = [], p.D == p) ? (J(p) | 0) - 1 : 1, p)), 0); H < m; H++) g.V.push(R(p));
            for (g.B$ = P(p, r); m--;) g.V[m] = P(p, g.V[m]);
            return g.o = P(p, h), g
        },
        n8 = function(p, m, r, h, H) {
            for (H = (p.eq = (p.Dc = (p.P$ = (p.k6 = (p.lX = p[G], zz), PO), C8(p.K, {get: function() {
                        return this.concat()
                    }
                })), a[p.K](p.Dc, {
                    value: {
                        value: {}
                    }
                })), h = 0, []); 393 > h; h++) H[h] = String.fromCharCode(h);
            (E(p, (E(p, (E(p, (Y(p, function(g) {
                w0(g, 1)
            }, (Y(p, (Q(p, 51, (Y(p, (Q((Y((Y(p, (Q(p, 294, ((Y(p, (Y(p, function(g, O, t) {
                W(false, g, O, true) || (O = R(g), t = R(g), Q(g, t, function(F) {
                    return eval(F)
                }(Tz(P(g.D, O)))))
            }, (Y((Q(p, 460, (Y(p, (Y(p, function(g, O) {
                (g = (O = R(g), P(g.D, O)), g)[0].removeEventListener(g[1], g[2], u)
            }, ((p.Qw = (Y(p, (Y(p, (Q(p, 82, (Y(p, (Y(p, (Y(p, (Y(p, (((Q(p, 346, (Q(p, (Y(p, (Q(p, 120, [(Y(p, function(g, O, t) {
                Q(g, (t = R(g), O = R(g), O), "" + P(g, t))
            }, (Q((Q(p, 33, (Y(p, (Q(p, 49, (Y((Y(p, function(g, O, t, F) {
                Q(g, (F = P(g, (O = (t = (F = R((O = R(g), g)), R)(g), P)(g, O), F)), t), O in F | 0)
            }, (Y(p, function() {}, (Q(p, 443, (Q((Q(p, (p.Y = !((p.O = 1, p.g = 0, p.X = (p.G = 0, h = (p.J = 0, p.S = 0, p.P = [], p.mQ = [], (p.KS = function(g) {
                this.D = g
            }, p).C = void 0, p.F = 0, (p.u = false, p).D = p, p.l = void 0, ((p.pS = (p.v = ((p.s = [], p).R = (p.L = [], void 0), p.h = null, 8001), 0), p.Im = false, p).W = void 0, p.I = [], p).B = (p.H = 0, p.T = void 0, p.A = (p.Z = void 0, 25), []), window.performance || {}), void 0), p).Zc = h.timeOrigin || (h.timing || {}).navigationStart || 0, 1), 428), 0), p), 176, 0), [])), 306)), 44)), p), function(g, O, t, F, k, K, D) {
                for (F = (D = P(g, (t = (K = R(g), k = Oz(g), ""), 281)), D.length), O = 0; k--;) O = ((O | 0) + (Oz(g) | 0)) % F, t += H[D[O]];
                Q(g, K, t)
            }, 9), 2048)), function(g, O, t, F) {
                (t = (F = R(g), R(g)), O = R(g), g).D == g && (O = P(g, O), t = P(g, t), P(g, F)[t] = O, 191 == F && (g.Z = void 0, 2 == t && (g.l = d(false, 32, g), g.Z = void 0)))
            }), 328), {})), p), 0, p), 329)), 160), 0, 0]), function(g, O, t, F) {
                Q(g, (t = P(g, (F = P(g, (O = (t = R(g), R)(g), O)), t)), O), F + t)
            }), 104), Y(p, function(g, O, t, F, k, K) {
                W(false, g, O, true) || (F = cO(g.D), K = F.B$, O = F.W$, t = F.V, F = F.o, k = t.length, K = 0 == k ? new K[F] : 1 == k ? new K[F](t[0]) : 2 == k ? new K[F](t[0], t[1]) : 3 == k ? new K[F](t[0], t[1], t[2]) : 4 == k ? new K[F](t[0], t[1], t[2], t[3]) : 2(), Q(g, O, K))
            }, 299), Y(p, function(g) {
                HO(g, 3)
            }, 455), Y(p, function(g, O, t, F, k) {
                for (k = (t = Oz((F = R(g), g)), O = 0, []); O < t; O++) k.push(J(g));
                Q(g, F, k)
            }, 219), 216), 644), B(4))), p).w_ = 0, Y)(p, function(g, O, t, F) {
                Q(g, (F = (O = (t = R(g), R)(g), R(g)), F), P(g, t) || P(g, O))
            }, 393), function(g, O) {
                Gz((O = P(g, R(g)), g).D, O)
            }), 343), function(g) {
                w0(g, 4)
            }), 217), function(g, O, t, F) {
                Q(g, (O = P(g, (t = (t = R((O = R(g), g)), F = R(g), P(g, t)), O)) == t, F), +O)
            }), 462), function(g, O, t, F) {
                !W(false, g, O, true) && (O = cO(g), F = O.o, t = O.B$, g.D == g || F == g.KS && t == g) && (Q(g, O.W$, F.apply(t, O.V)), g.g = g.i())
            }), 363), 0)), function(g) {
                HO(g, 4)
            }), 486), function(g, O, t, F) {
                Q(g, (F = (t = P((t = (F = R(g), R(g)), O = R(g), g), t), P(g, F)), O), F[t])
            }), 340), 0), p).Sq = 0, 171)), function(g, O, t) {
                0 != P((t = P(g, (t = (O = R(g), R(g)), t)), g), O) && Q(g, 428, t)
            }), 88), U)), Y(p, function(g, O, t, F) {
                if (t = g.mQ.pop()) {
                    for (O = J(g); 0 < O; O--) F = R(g), t[F] = g.B[F];
                    g.B = (t[294] = g.B[294], t[49] = g.B[49], t)
                } else Q(g, 428, g.H)
            }, 424), p), function(g) {
                Xe(g, 4)
            }, 373), 94)), function(g, O, t, F) {
                Q(g, (O = (F = R(g), t = J(g), R)(g), O), P(g, F) >>> t)
            }), 206), Y)(p, function(g, O, t, F, k, K) {
                if (!W(true, g, O, true)) {
                    if (g = P((k = (K = (O = R((F = R(g), g)), R)(g), k = R(g), O = P(g, O), K = P(g, K), P(g, k)), g), F), "object" == ID(g)) {
                        for (t in F = [], g) F.push(t);
                        g = F
                    }
                    for (F = (K = (t = g.length, 0 < K ? K : 1), 0); F < t; F += K) O(g.slice(F, (F | 0) + (K | 0)), k)
                }
            }, 202), [])), function(g, O, t) {
                Q(g, (t = ID((t = P(g, (O = (t = R(g), R)(g), t)), t)), O), t)
            }), 249), p), function(g, O, t, F, k, K, D, e, x, f, q, S) {
                function n(c, T) {
                    for (; S < c;) D |= J(g) << S, S += 8;
                    return T = D & ((S -= c, 1) << c) - 1, D >>= c, T
                }
                for (x = (f = O = (q = (t = ((D = S = (K = R(g), 0), n)(3) | 0) + 1, n(5)), 0), []); O < q; O++) k = n(1), x.push(k), f += k ? 0 : 1;
                for (F = (O = ((f | 0) - 1).toString(2).length, []), f = 0; f < q; f++) x[f] || (F[f] = n(O));
                for (O = 0; O < q; O++) x[O] && (F[O] = R(g));
                for (e = []; t--;) e.push(P(g, R(g)));
                Y(g, function(c, T, L, V, kE) {
                    for (V = [], L = 0, kE = []; L < q; L++) {
                        if (!(T = F[L], x)[L]) {
                            for (; T >= V.length;) V.push(R(c));
                            T = V[T]
                        }
                        kE.push(T)
                    }(c.X = p8(e.slice(), c), c).R = p8(kE, c)
                }, K)
            }, 181), p), 336, [0, 0, 0]), function(g, O, t, F, k) {
                t = (O = P(g, (F = P(g, (k = (k = R((F = R((t = R(g), O = R(g), g)), g)), P(g, k)), F)), O)), P(g.D, t)), 0 !== t && (k = aD(g, 1, F, k, t, O), t.addEventListener(O, k, u), Q(g, 82, [t, O, k]))
            }), 354), 0)), function(g, O, t, F, k) {
                Q(g, (k = (O = (t = P(g, (k = (O = R((F = R(g), t = R(g), g)), R(g)), t)), P(g, O)), P(g, k)), F), aD(g, k, t, O))
            }), 501), 210)), [Qb])), [X, r])), [d0, m])), A)(true, p, true)
        },
        Ez = function(p, m, r, h) {
            return P(p, (Q(p, (f8((h = P(p, 428), p.P && h < p.H ? (Q(p, 428, p.H), Gz(p, r)) : Q(p, 428, r), p), m), 428), h), 33))
        },
        w0 = function(p, m, r, h) {
            z(p, (h = R(p), r = R(p), r), l(m, P(p, h)))
        },
        W = function(p, m, r, h, H, g, O, t, F) {
            if ((m.D = (m.O += (t = (g = (H = 4 == (F = (h || m.T++, 0 < m.F && m.u && m.Im && 1 >= m.G && !m.X && !m.h && (!h || 1 < m.v - r) && 0 == document.hidden), m.T)) || F ? m.i() : m.g, g - m.g), O = t >> 14, m.l && (m.l ^= O * (t << 2)), O), O || m.D), H) || F) m.g = g, m.T = 0;
            if (!F || g - m.S < m.F - (p ? 255 : h ? 5 : 2)) return false;
            return !(Q(m, 428, (m.v = r, p = P(m, h ? 176 : 428), m.H)), m.I.push([lY, p, h ? r + 1 : r]), m.h = I, 0)
        },
        Xe = function(p, m, r, h) {
            for (r = R(p), h = 0; 0 < m; m--) h = h << 8 | J(p);
            Q(p, r, h)
        },
        B = function(p, m) {
            for (m = []; p--;) m.push(255 * Math.random() | 0);
            return m
        },
        Fe = function(p, m, r, h, H) {
            for (H = (h = (p = p.replace(/\r\n/g, "\n"), r = 0), []); r < p.length; r++) m = p.charCodeAt(r), 128 > m ? H[h++] = m : (2048 > m ? H[h++] = m >> 6 | 192 : (55296 == (m & 64512) && r + 1 < p.length && 56320 == (p.charCodeAt(r + 1) & 64512) ? (m = 65536 + ((m & 1023) << 10) + (p.charCodeAt(++r) & 1023), H[h++] = m >> 18 | 240, H[h++] = m >> 12 & 63 | 128) : H[h++] = m >> 12 | 224, H[h++] = m >> 6 & 63 | 128), H[h++] = m & 63 | 128);
            return H
        },
        P = function(p, m) {
            if (void 0 === (p = p.B[m], p)) throw [v, 30, m];
            if (p.value) return p.create();
            return p.create(1 * m * m + -76 * m + 79), p.prototype
        },
        z = function(p, m, r, h, H, g) {
            if (p.D == p)
                for (H = P(p, m), 346 == m ? (m = function(O, t, F, k) {
                        if ((k = (F = H.length, F | 0) - 4 >> 3, H.iX) != k) {
                            k = (t = [0, 0, g[1], (H.iX = k, g)[2]], k << 3) - 4;
                            try {
                                H.am = tk(t, Jk(H, (k | 0) + 4), Jk(H, k))
                            } catch (K) {
                                throw K;
                            }
                        }
                        H.push(H.am[F & 7] ^ O)
                    }, g = P(p, 336)) : m = function(O) {
                        H.push(O)
                    }, h && m(h & 255), p = r.length, h = 0; h < p; h++) m(r[h])
        },
        Gz = function(p, m) {
            (p.mQ.push(p.B.slice()), p).B[428] = void 0, Q(p, 428, m)
        },
        Ak = function(p, m, r, h) {
            for (; p.I.length;) {
                h = (p.h = null, p.I.pop());
                try {
                    r = eR(h, p)
                } catch (H) {
                    w(H, p)
                }
                if (m && p.h) {
                    m = p.h, m(function() {
                        A(true, p, true)
                    });
                    break
                }
            }
            return r
        },
        Z, E = function(p, m) {
            p.I.splice(0, 0, m)
        },
        w = function(p, m) {
            m.W = ((m.W ? m.W + "~" : "E:") + p.message + ":" + p.stack).slice(0, 2048)
        },
        A = function(p, m, r, h, H, g) {
            if (m.I.length) {
                m.Im = (m.u = (m.u && 0(), true), p);
                try {
                    g = m.i(), m.T = 0, m.S = g, m.g = g, h = Ak(m, p), H = m.i() - m.S, m.J += H, H < (r ? 0 : 10) || 0 >= m.A-- || (H = Math.floor(H), m.s.push(254 >= H ? H : 254))
                } finally {
                    m.u = false
                }
                return h
            }
        },
        R = function(p, m) {
            if (p.X) return oD(p, p.R);
            return m = d(true, 8, p), m & 128 && (m ^= 128, p = d(true, 2, p), m = (m << 2) + (p | 0)), m
        },
        yb = function(p, m) {
            if ((m = (p = null, U).trustedTypes, !m) || !m.createPolicy) return p;
            try {
                p = m.createPolicy("bg", {
                    createHTML: bY,
                    createScript: bY,
                    createScriptURL: bY
                })
            } catch (r) {
                U.console && U.console.error(r.message)
            }
            return p
        },
        N = function(p, m, r) {
            r = this;
            try {
                n8(this, m, p)
            } catch (h) {
                w(h, this), m(function(H) {
                    H(r.W)
                })
            }
        },
        M = function(p, m, r, h, H, g) {
            if (!m.Y) {
                if (3 < (r = P(m, ((p = (0 == (h = P(m, ((g = void 0, r) && r[0] === v && (p = r[1], g = r[2], r = void 0), 294)), h.length) && (H = P(m, 176) >> 3, h.push(p, H >> 8 & 255, H & 255), void 0 != g && h.push(g & 255)), ""), r) && (r.message && (p += r.message), r.stack && (p += ":" + r.stack)), 49)), r)) {
                    m.D = (g = (p = (r -= (p = p.slice(0, (r | 0) - 3), (p.length | 0) + 3), Fe(p)), m.D), m);
                    try {
                        z(m, 346, l(2, p.length).concat(p), 9)
                    } finally {
                        m.D = g
                    }
                }
                Q(m, 49, r)
            }
        },
        C8 = function(p, m) {
            return a[p](a.prototype, {
                call: m,
                floor: m,
                document: m,
                pop: m,
                length: m,
                parent: m,
                prototype: m,
                stack: m,
                splice: m,
                replace: m,
                console: m,
                propertyIsEnumerable: m
            })
        },
        q0 = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        Qb = [],
        y = (N.prototype.H$ = (N.prototype.U = "toString", (N.prototype.Gi = void 0, N.prototype).fS = void 0, false), []),
        K8 = [],
        C = [],
        G = [],
        X = [],
        v = {},
        lY = [],
        d0 = [],
        hk = ((((b = ((r0, B, xE, function() {})(DG), N.prototype), b).Rm = function() {
            return Math.floor(this.J + (this.i() - this.S))
        }, b.hU = function(p, m, r) {
            return (m ^= m << 13, m ^= m >> 17, (m = (m ^ m << 5) & r) || (m = 1), p) ^ m
        }, N).prototype.K = "create", b.yw = function(p, m, r, h, H) {
            for (H = h = 0; H < p.length; H++) h += p.charCodeAt(H), h += h << 10, h ^= h >> 6;
            return (h = (h += h << 3, h ^= h >> 11, p = h + (h << 15) >>> 0, new Number(p & (1 << m) - 1)), h)[0] = (p >>> m) % r, h
        }, b).j = function(p, m, r, h, H) {
            if (r = "array" === ID(r) ? r : [r], this.W) p(this.W);
            else try {
                H = [], h = !this.I.length, E(this, [C, H, r]), E(this, [G, p, H]), m && !h || A(m, this, true)
            } catch (g) {
                w(g, this), p(this.W)
            }
        }, void 0),
        a = (b.i = (window.performance || {}).now ? function() {
            return this.Zc + window.performance.now()
        } : function() {
            return +new Date
        }, b.N5 = (b.g_ = function(p, m, r, h, H, g) {
            for (g = H = 0, h = []; H < p.length; H++)
                for (r = r << m | p[H], g += m; 7 < g;) g -= 8, h.push(r >> g & 255);
            return h
        }, function() {
            return Math.floor(this.i())
        }), v).constructor,
        PO = ((N.prototype.N = function(p, m) {
            return m = (p = {}, hk = function() {
                    return m == p ? 79 : 140
                }, {}),
                function(r, h, H, g, O, t, F, k, K, D, e, x, f, q, S) {
                    m = (k = m, p);
                    try {
                        if (t = r[0], t == X) {
                            H = r[1];
                            try {
                                for (O = (h = (e = atob(H), g = 0, []), 0); O < e.length; O++) x = e.charCodeAt(O), 255 < x && (h[g++] = x & 255, x >>= 8), h[g++] = x;
                                Q(((this.P = h, this).H = this.P.length << 3, this), 191, [0, 0, 0])
                            } catch (n) {
                                M(17, this, n);
                                return
                            }
                            f8(this, 8001)
                        } else if (t == C) r[1].push(P(this, 49), P(this, 443).length, P(this, 346).length, P(this, 120).length), Q(this, 33, r[2]), this.B[225] && Ez(this, 8001, P(this, 225));
                        else {
                            if (t == G) {
                                D = l((g = r[2], 2), (P(this, 120).length | 0) + 2), K = this.D, this.D = this;
                                try {
                                    q = P(this, 294), 0 < q.length && z(this, 120, l(2, q.length).concat(q), 10), z(this, 120, l(1, this.O), 109), z(this, 120, l(1, this[G].length)), e = 0, e -= (P(this, 120).length | 0) + 5, e += P(this, 51) & 2047, f = P(this, 346), 4 < f.length && (e -= (f.length | 0) + 3), 0 < e && z(this, 120, l(2, e).concat(B(e)), 15), 4 < f.length && z(this, 120, l(2, f.length).concat(f), 156)
                                } finally {
                                    this.D = K
                                }
                                if (F = (O = B(2).concat(P(this, 120)), O[1] = O[0] ^ 6, O[3] = O[1] ^ D[0], O[4] = O[1] ^ D[1], this).X5(O)) F = "!" + F;
                                else
                                    for (F = "", e = 0; e < O.length; e++) S = O[e][this.U](16), 1 == S.length && (S = "0" + S), F += S;
                                return P(this, (P((P(this, (Q(this, 49, (h = F, g.shift())), 443)).length = g.shift(), this), 346).length = g.shift(), 120)).length = g.shift(), h
                            }
                            if (t == lY) Ez(this, r[2], r[1]);
                            else if (t == y) return Ez(this, 8001, r[1])
                        }
                    } finally {
                        m = k
                    }
                }
        }(), N.prototype.uX = 0, N.prototype).X5 = function(p, m, r, h) {
            if (h = window.btoa) {
                for (m = (r = 0, ""); r < p.length; r += 8192) m += String.fromCharCode.apply(null, p.slice(r, r + 8192));
                p = h(m).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
            } else p = void 0;
            return p
        }, /./);
    N.prototype.Vw = 0;
    var zz, jR = X.pop.bind((N.prototype[d0] = [0, 0, 1, 1, 0, 1, 1], N.prototype[C])),
        Tz = ((zz = C8((PO[N.prototype.U] = jR, N.prototype.K), {get: jR
        }), N).prototype.x6 = void 0, function(p, m) {
            return (m = yb()) && 1 === p.eval(m.createScript("1")) ? function(r) {
                return m.createScript(r)
            } : function(r) {
                return "" + r
            }
        })(U);
    (Z = U.botguard || (U.botguard = {}), 40 < Z.m || (Z.m = 41, Z.bg = g0, Z.a = sz), Z).MDm_ = function(p, m, r) {
        return r = new N(p, m), [function(h) {
            return RD(r, h)
        }]
    };
}).call(this);
#9 JavaScript::Eval (size: 15561) - SHA256: d90538b891b0faa88bb08314660918942260c2ace5720f0bb44498bd13171c76
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var r = this || self,
        h = function(p, m) {
            if (!(p = (m = r.trustedTypes, null), m) || !m.createPolicy) return p;
            try {
                p = m.createPolicy("bg", {
                    createHTML: O,
                    createScript: O,
                    createScriptURL: O
                })
            } catch (g) {
                r.console && r.console.error(g.message)
            }
            return p
        },
        O = function(p) {
            return p
        };
    (0, eval)(function(p, m) {
        return (m = h()) && 1 === p.eval(m.createScript("1")) ? function(g) {
            return m.createScript(g)
        } : function(g) {
            return "" + g
        }
    }(r)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var b,l=function(p,m,r,h){for(h=(p|(r=[],0))-1;0<=h;h--)r[(p|0)-1-(h|0)]=m>>8*h&255;return r},Q=function(p,m,r){if(428==m||176==m)p.B[m]?p.B[m].concat(r):p.B[m]=p8(r,p);else{if(p.Y&&191!=m)return;120==m||346==m||443==m||294==m||336==m?p.B[m]||(p.B[m]=mS(p,m,30,r)):p.B[m]=mS(p,m,137,r)}191==m&&(p.l=d(false,32,p),p.Z=void 0)},g0=function(p,m,r,h){function H(){}return r=sz(p,function(g){H&&(m&&I(m),h=g,H(),H=void 0)},(h=void 0,!!m))[0],{invoke:function(g,O,t,F){function k(){h(function(K){I(function(){g(K)})},t)}if(!O)return O=r(t),g&&g(O),O;h?k():(F=H,H=function(){I((F(),k))})}}},r0=function(p,m){(m.push(p[0]<<24|p[1]<<16|p[2]<<8|p[3]),m.push(p[4]<<24|p[5]<<16|p[6]<<8|p[7]),m).push(p[8]<<24|p[9]<<16|p[10]<<8|p[11])},Oz=function(p,m){return(m=J(p),m&128)&&(m=m&127|J(p)<<7),m},mS=function(p,m,r,h,H,g,O,t){return((O=(h=[(H=hk,-97),-76,1,-9,-92,-60,h,-40,38,(t=r&7,-88)],a[p.K](p.Dc)),O)[p.K]=function(F){t+=6+(g=F,7*r),t&=7},O).concat=function(F){return((g=(F=+t+h[t+19&7]*(F=m%16+1,m)*F-57*m*m*g-F*g+57*g*g-4503*g- -4332*m*g+(H()|0)*F+1*m*m*F,void 0),F=h[F],h)[(t+45&7)+(r&2)]=F,h)[t+(r&2)]=-76,F},O},p8=function(p,m,r){return(r=a[m.K](m.eq),r[m.K]=function(){return p},r).concat=function(h){p=h},r},tk=function(p,m,r,h,H){for(H=(h=0,p)[2]|0,p=p[3]|0;14>h;h++)m=m>>>8|m<<24,m+=r|0,r=r<<3|r>>>29,m^=H+1656,p=p>>>8|p<<24,r^=m,p+=H|0,p^=h+1656,H=H<<3|H>>>29,H^=p;return[r>>>24&255,r>>>16&255,r>>>8&255,r>>>0&255,m>>>24&255,m>>>16&255,m>>>8&255,m>>>0&255]},HO=function(p,m,r,h,H){(H=P(p,(h=(H=(m&=(r=m&3,4),R(p)),R)(p),H)),m&&(H=Fe(""+H)),r)&&z(p,h,l(2,H.length)),z(p,h,H)},bY=function(p){return p},eR=function(p,m,r,h,H){if(H=p[0],H==C)m.A=25,m.N(p);else if(H==G){r=p[1];try{h=m.W||m.N(p)}catch(g){w(g,m),h=m.W}r(h)}else if(H==lY)m.N(p);else if(H==X)m.N(p);else if(H==d0){try{for(h=0;h<m.L.length;h++)try{r=m.L[h],r[0][r[1]](r[2])}catch(g){}}catch(g){}(0,p[1])(function(g,O){m.j(g,true,O)},(m.L=[],function(g){(E(m,(g=!m.I.length,[K8])),g)&&A(true,m,false)}))}else{if(H==y)return h=p[2],Q(m,499,p[6]),Q(m,33,h),m.N(p);H==K8?(m.P=[],m.s=[],m.B=null):H==Qb&&"loading"===U.document.readyState&&(m.h=function(g,O){function t(){O||(O=true,g())}U.document.addEventListener("DOMContentLoaded",(O=false,t),u),U.addEventListener("load",t,u)})}},J=function(p){return p.X?oD(p,p.R):d(true,8,p)},DG=function(p,m,r){if(3==p.length){for(r=0;3>r;r++)m[r]+=p[r];for(p=0,r=[13,8,13,12,16,5,3,10,15];9>p;p++)m[3](m,p%3,r[p])}},oD=function(p,m){return(m=m.create().shift(),p.X.create()).length||p.R.create().length||(p.R=void 0,p.X=void 0),m},xE=function(p,m,r,h){try{h=p[((m|0)+2)%3],p[m]=(p[m]|0)-(p[((m|0)+1)%3]|0)-(h|0)^(1==m?h<<r:h>>>r)}catch(H){throw H;}},ID=function(p,m,r){if("object"==(m=typeof p,m))if(p){if(p instanceof Array)return"array";if(p instanceof Object)return m;if((r=Object.prototype.toString.call(p),"[object Window]")==r)return"object";if("[object Array]"==r||"number"==typeof p.length&&"undefined"!=typeof p.splice&&"undefined"!=typeof p.propertyIsEnumerable&&!p.propertyIsEnumerable("splice"))return"array";if("[object Function]"==r||"undefined"!=typeof p.call&&"undefined"!=typeof p.propertyIsEnumerable&&!p.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==m&&"undefined"==typeof p.call)return"object";return m},Y=function(p,m,r){(Q(p,r,m),m)[Qb]=2796},f8=function(p,m,r,h,H,g){if(!p.W){p.G++;try{for(h=(H=(g=p.H,0),void 0);--m;)try{if(r=void 0,p.X)h=oD(p,p.X);else{if((H=P(p,428),H)>=g)break;h=P((r=(Q(p,176,H),R(p)),p),r)}W(false,p,(h&&h[K8]&2048?h(p,m):M(0,p,[v,21,r]),m),false)}catch(O){P(p,216)?M(22,p,O):Q(p,216,O)}if(!m){if(p.H$){f8((p.G--,p),473199118497);return}M(0,p,[v,33])}}catch(O){try{M(22,p,O)}catch(t){w(t,p)}}p.G--}},Jk=function(p,m){return p[m]<<24|p[(m|0)+1]<<16|p[(m|0)+2]<<8|p[(m|0)+3]},aD=function(p,m,r,h,H,g){function O(){if(p.D==p){if(p.B){var t=[y,r,h,void 0,H,g,arguments];if(2==m)var F=A(false,p,(E(p,t),false));else if(1==m){var k=!p.I.length;E(p,t),k&&A(false,p,false)}else F=eR(t,p);return F}H&&g&&H.removeEventListener(g,O,u)}}return O},RD=function(p,m,r){return p.j(function(h){r=h},false,m),r},U=this||self,sz=function(p,m,r,h){return(h=Z[p.substring(0,3)+"_"])?h(p.substring(3),m,r):SR(m,p)},u={passive:true,capture:true},SR=function(p,m){return p(function(r){r(m)}),[function(){return m}]},d=function(p,m,r,h,H,g,O,t,F,k,K,D,e,x){if((x=P(r,428),x)>=r.H)throw[v,31];for(g=(h=(k=(H=x,0),m),r.lX).length;0<h;)F=H>>3,t=r.P[F],K=H%8,e=8-(K|0),e=e<h?e:h,p&&(D=r,D.Z!=H>>6&&(D.Z=H>>6,O=P(D,191),D.C=tk([0,0,O[1],O[2]],D.Z,D.l)),t^=r.C[F&g]),k|=(t>>8-(K|0)-(e|0)&(1<<e)-1)<<(h|0)-(e|0),h-=e,H+=e;return Q(r,428,(p=k,(x|0)+(m|0))),p},I=U.requestIdleCallback?function(p){requestIdleCallback(function(){p()},{timeout:4})}:U.setImmediate?function(p){setImmediate(p)}:function(p){setTimeout(p,0)},cO=function(p,m,r,h,H,g){for(H=(r=R((m=(h=(g=p[q0]||{},R(p)),g.W$=R(p),g.V=[],p.D==p)?(J(p)|0)-1:1,p)),0);H<m;H++)g.V.push(R(p));for(g.B$=P(p,r);m--;)g.V[m]=P(p,g.V[m]);return g.o=P(p,h),g},n8=function(p,m,r,h,H){for(H=(p.eq=(p.Dc=(p.P$=(p.k6=(p.lX=p[G],zz),PO),C8(p.K,{get:function(){return this.concat()}})),a[p.K](p.Dc,{value:{value:{}}})),h=0,[]);393>h;h++)H[h]=String.fromCharCode(h);(E(p,(E(p,(E(p,(Y(p,function(g){w0(g,1)},(Y(p,(Q(p,51,(Y(p,(Q((Y((Y(p,(Q(p,294,((Y(p,(Y(p,function(g,O,t){W(false,g,O,true)||(O=R(g),t=R(g),Q(g,t,function(F){return eval(F)}(Tz(P(g.D,O)))))},(Y((Q(p,460,(Y(p,(Y(p,function(g,O){(g=(O=R(g),P(g.D,O)),g)[0].removeEventListener(g[1],g[2],u)},((p.Qw=(Y(p,(Y(p,(Q(p,82,(Y(p,(Y(p,(Y(p,(Y(p,(((Q(p,346,(Q(p,(Y(p,(Q(p,120,[(Y(p,function(g,O,t){Q(g,(t=R(g),O=R(g),O),""+P(g,t))},(Q((Q(p,33,(Y(p,(Q(p,49,(Y((Y(p,function(g,O,t,F){Q(g,(F=P(g,(O=(t=(F=R((O=R(g),g)),R)(g),P)(g,O),F)),t),O in F|0)},(Y(p,function(){},(Q(p,443,(Q((Q(p,(p.Y=!((p.O=1,p.g=0,p.X=(p.G=0,h=(p.J=0,p.S=0,p.P=[],p.mQ=[],(p.KS=function(g){this.D=g},p).C=void 0,p.F=0,(p.u=false,p).D=p,p.l=void 0,((p.pS=(p.v=((p.s=[],p).R=(p.L=[],void 0),p.h=null,8001),0),p.Im=false,p).W=void 0,p.I=[],p).B=(p.H=0,p.T=void 0,p.A=(p.Z=void 0,25),[]),window.performance||{}),void 0),p).Zc=h.timeOrigin||(h.timing||{}).navigationStart||0,1),428),0),p),176,0),[])),306)),44)),p),function(g,O,t,F,k,K,D){for(F=(D=P(g,(t=(K=R(g),k=Oz(g),""),281)),D.length),O=0;k--;)O=((O|0)+(Oz(g)|0))%F,t+=H[D[O]];Q(g,K,t)},9),2048)),function(g,O,t,F){(t=(F=R(g),R(g)),O=R(g),g).D==g&&(O=P(g,O),t=P(g,t),P(g,F)[t]=O,191==F&&(g.Z=void 0,2==t&&(g.l=d(false,32,g),g.Z=void 0)))}),328),{})),p),0,p),329)),160),0,0]),function(g,O,t,F){Q(g,(t=P(g,(F=P(g,(O=(t=R(g),R)(g),O)),t)),O),F+t)}),104),Y(p,function(g,O,t,F,k,K){W(false,g,O,true)||(F=cO(g.D),K=F.B$,O=F.W$,t=F.V,F=F.o,k=t.length,K=0==k?new K[F]:1==k?new K[F](t[0]):2==k?new K[F](t[0],t[1]):3==k?new K[F](t[0],t[1],t[2]):4==k?new K[F](t[0],t[1],t[2],t[3]):2(),Q(g,O,K))},299),Y(p,function(g){HO(g,3)},455),Y(p,function(g,O,t,F,k){for(k=(t=Oz((F=R(g),g)),O=0,[]);O<t;O++)k.push(J(g));Q(g,F,k)},219),216),644),B(4))),p).w_=0,Y)(p,function(g,O,t,F){Q(g,(F=(O=(t=R(g),R)(g),R(g)),F),P(g,t)||P(g,O))},393),function(g,O){Gz((O=P(g,R(g)),g).D,O)}),343),function(g){w0(g,4)}),217),function(g,O,t,F){Q(g,(O=P(g,(t=(t=R((O=R(g),g)),F=R(g),P(g,t)),O))==t,F),+O)}),462),function(g,O,t,F){!W(false,g,O,true)&&(O=cO(g),F=O.o,t=O.B$,g.D==g||F==g.KS&&t==g)&&(Q(g,O.W$,F.apply(t,O.V)),g.g=g.i())}),363),0)),function(g){HO(g,4)}),486),function(g,O,t,F){Q(g,(F=(t=P((t=(F=R(g),R(g)),O=R(g),g),t),P(g,F)),O),F[t])}),340),0),p).Sq=0,171)),function(g,O,t){0!=P((t=P(g,(t=(O=R(g),R(g)),t)),g),O)&&Q(g,428,t)}),88),U)),Y(p,function(g,O,t,F){if(t=g.mQ.pop()){for(O=J(g);0<O;O--)F=R(g),t[F]=g.B[F];g.B=(t[294]=g.B[294],t[49]=g.B[49],t)}else Q(g,428,g.H)},424),p),function(g){Xe(g,4)},373),94)),function(g,O,t,F){Q(g,(O=(F=R(g),t=J(g),R)(g),O),P(g,F)>>>t)}),206),Y)(p,function(g,O,t,F,k,K){if(!W(true,g,O,true)){if(g=P((k=(K=(O=R((F=R(g),g)),R)(g),k=R(g),O=P(g,O),K=P(g,K),P(g,k)),g),F),"object"==ID(g)){for(t in F=[],g)F.push(t);g=F}for(F=(K=(t=g.length,0<K?K:1),0);F<t;F+=K)O(g.slice(F,(F|0)+(K|0)),k)}},202),[])),function(g,O,t){Q(g,(t=ID((t=P(g,(O=(t=R(g),R)(g),t)),t)),O),t)}),249),p),function(g,O,t,F,k,K,D,e,x,f,q,S){function n(c,T){for(;S<c;)D|=J(g)<<S,S+=8;return T=D&((S-=c,1)<<c)-1,D>>=c,T}for(x=(f=O=(q=(t=((D=S=(K=R(g),0),n)(3)|0)+1,n(5)),0),[]);O<q;O++)k=n(1),x.push(k),f+=k?0:1;for(F=(O=((f|0)-1).toString(2).length,[]),f=0;f<q;f++)x[f]||(F[f]=n(O));for(O=0;O<q;O++)x[O]&&(F[O]=R(g));for(e=[];t--;)e.push(P(g,R(g)));Y(g,function(c,T,L,V,kE){for(V=[],L=0,kE=[];L<q;L++){if(!(T=F[L],x)[L]){for(;T>=V.length;)V.push(R(c));T=V[T]}kE.push(T)}(c.X=p8(e.slice(),c),c).R=p8(kE,c)},K)},181),p),336,[0,0,0]),function(g,O,t,F,k){t=(O=P(g,(F=P(g,(k=(k=R((F=R((t=R(g),O=R(g),g)),g)),P(g,k)),F)),O)),P(g.D,t)),0!==t&&(k=aD(g,1,F,k,t,O),t.addEventListener(O,k,u),Q(g,82,[t,O,k]))}),354),0)),function(g,O,t,F,k){Q(g,(k=(O=(t=P(g,(k=(O=R((F=R(g),t=R(g),g)),R(g)),t)),P(g,O)),P(g,k)),F),aD(g,k,t,O))}),501),210)),[Qb])),[X,r])),[d0,m])),A)(true,p,true)},Ez=function(p,m,r,h){return P(p,(Q(p,(f8((h=P(p,428),p.P&&h<p.H?(Q(p,428,p.H),Gz(p,r)):Q(p,428,r),p),m),428),h),33))},w0=function(p,m,r,h){z(p,(h=R(p),r=R(p),r),l(m,P(p,h)))},W=function(p,m,r,h,H,g,O,t,F){if((m.D=(m.O+=(t=(g=(H=4==(F=(h||m.T++,0<m.F&&m.u&&m.Im&&1>=m.G&&!m.X&&!m.h&&(!h||1<m.v-r)&&0==document.hidden),m.T))||F?m.i():m.g,g-m.g),O=t>>14,m.l&&(m.l^=O*(t<<2)),O),O||m.D),H)||F)m.g=g,m.T=0;if(!F||g-m.S<m.F-(p?255:h?5:2))return false;return!(Q(m,428,(m.v=r,p=P(m,h?176:428),m.H)),m.I.push([lY,p,h?r+1:r]),m.h=I,0)},Xe=function(p,m,r,h){for(r=R(p),h=0;0<m;m--)h=h<<8|J(p);Q(p,r,h)},B=function(p,m){for(m=[];p--;)m.push(255*Math.random()|0);return m},Fe=function(p,m,r,h,H){for(H=(h=(p=p.replace(/\\r\\n/g,"\\n"),r=0),[]);r<p.length;r++)m=p.charCodeAt(r),128>m?H[h++]=m:(2048>m?H[h++]=m>>6|192:(55296==(m&64512)&&r+1<p.length&&56320==(p.charCodeAt(r+1)&64512)?(m=65536+((m&1023)<<10)+(p.charCodeAt(++r)&1023),H[h++]=m>>18|240,H[h++]=m>>12&63|128):H[h++]=m>>12|224,H[h++]=m>>6&63|128),H[h++]=m&63|128);return H},P=function(p,m){if(void 0===(p=p.B[m],p))throw[v,30,m];if(p.value)return p.create();return p.create(1*m*m+-76*m+79),p.prototype},z=function(p,m,r,h,H,g){if(p.D==p)for(H=P(p,m),346==m?(m=function(O,t,F,k){if((k=(F=H.length,F|0)-4>>3,H.iX)!=k){k=(t=[0,0,g[1],(H.iX=k,g)[2]],k<<3)-4;try{H.am=tk(t,Jk(H,(k|0)+4),Jk(H,k))}catch(K){throw K;}}H.push(H.am[F&7]^O)},g=P(p,336)):m=function(O){H.push(O)},h&&m(h&255),p=r.length,h=0;h<p;h++)m(r[h])},Gz=function(p,m){(p.mQ.push(p.B.slice()),p).B[428]=void 0,Q(p,428,m)},Ak=function(p,m,r,h){for(;p.I.length;){h=(p.h=null,p.I.pop());try{r=eR(h,p)}catch(H){w(H,p)}if(m&&p.h){m=p.h,m(function(){A(true,p,true)});break}}return r},Z,E=function(p,m){p.I.splice(0,0,m)},w=function(p,m){m.W=((m.W?m.W+"~":"E:")+p.message+":"+p.stack).slice(0,2048)},A=function(p,m,r,h,H,g){if(m.I.length){m.Im=(m.u=(m.u&&0(),true),p);try{g=m.i(),m.T=0,m.S=g,m.g=g,h=Ak(m,p),H=m.i()-m.S,m.J+=H,H<(r?0:10)||0>=m.A--||(H=Math.floor(H),m.s.push(254>=H?H:254))}finally{m.u=false}return h}},R=function(p,m){if(p.X)return oD(p,p.R);return m=d(true,8,p),m&128&&(m^=128,p=d(true,2,p),m=(m<<2)+(p|0)),m},yb=function(p,m){if((m=(p=null,U).trustedTypes,!m)||!m.createPolicy)return p;try{p=m.createPolicy("bg",{createHTML:bY,createScript:bY,createScriptURL:bY})}catch(r){U.console&&U.console.error(r.message)}return p},N=function(p,m,r){r=this;try{n8(this,m,p)}catch(h){w(h,this),m(function(H){H(r.W)})}},M=function(p,m,r,h,H,g){if(!m.Y){if(3<(r=P(m,((p=(0==(h=P(m,((g=void 0,r)&&r[0]===v&&(p=r[1],g=r[2],r=void 0),294)),h.length)&&(H=P(m,176)>>3,h.push(p,H>>8&255,H&255),void 0!=g&&h.push(g&255)),""),r)&&(r.message&&(p+=r.message),r.stack&&(p+=":"+r.stack)),49)),r)){m.D=(g=(p=(r-=(p=p.slice(0,(r|0)-3),(p.length|0)+3),Fe(p)),m.D),m);try{z(m,346,l(2,p.length).concat(p),9)}finally{m.D=g}}Q(m,49,r)}},C8=function(p,m){return a[p](a.prototype,{call:m,floor:m,document:m,pop:m,length:m,parent:m,prototype:m,stack:m,splice:m,replace:m,console:m,propertyIsEnumerable:m})},q0=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),Qb=[],y=(N.prototype.H$=(N.prototype.U="toString",(N.prototype.Gi=void 0,N.prototype).fS=void 0,false),[]),K8=[],C=[],G=[],X=[],v={},lY=[],d0=[],hk=((((b=((r0,B,xE,function(){})(DG),N.prototype),b).Rm=function(){return Math.floor(this.J+(this.i()-this.S))},b.hU=function(p,m,r){return(m^=m<<13,m^=m>>17,(m=(m^m<<5)&r)||(m=1),p)^m},N).prototype.K="create",b.yw=function(p,m,r,h,H){for(H=h=0;H<p.length;H++)h+=p.charCodeAt(H),h+=h<<10,h^=h>>6;return(h=(h+=h<<3,h^=h>>11,p=h+(h<<15)>>>0,new Number(p&(1<<m)-1)),h)[0]=(p>>>m)%r,h},b).j=function(p,m,r,h,H){if(r="array"===ID(r)?r:[r],this.W)p(this.W);else try{H=[],h=!this.I.length,E(this,[C,H,r]),E(this,[G,p,H]),m&&!h||A(m,this,true)}catch(g){w(g,this),p(this.W)}},void 0),a=(b.i=(window.performance||{}).now?function(){return this.Zc+window.performance.now()}:function(){return+new Date},b.N5=(b.g_=function(p,m,r,h,H,g){for(g=H=0,h=[];H<p.length;H++)for(r=r<<m|p[H],g+=m;7<g;)g-=8,h.push(r>>g&255);return h},function(){return Math.floor(this.i())}),v).constructor,PO=((N.prototype.N=function(p,m){return m=(p={},hk=function(){return m==p?79:140},{}),function(r,h,H,g,O,t,F,k,K,D,e,x,f,q,S){m=(k=m,p);try{if(t=r[0],t==X){H=r[1];try{for(O=(h=(e=atob(H),g=0,[]),0);O<e.length;O++)x=e.charCodeAt(O),255<x&&(h[g++]=x&255,x>>=8),h[g++]=x;Q(((this.P=h,this).H=this.P.length<<3,this),191,[0,0,0])}catch(n){M(17,this,n);return}f8(this,8001)}else if(t==C)r[1].push(P(this,49),P(this,443).length,P(this,346).length,P(this,120).length),Q(this,33,r[2]),this.B[225]&&Ez(this,8001,P(this,225));else{if(t==G){D=l((g=r[2],2),(P(this,120).length|0)+2),K=this.D,this.D=this;try{q=P(this,294),0<q.length&&z(this,120,l(2,q.length).concat(q),10),z(this,120,l(1,this.O),109),z(this,120,l(1,this[G].length)),e=0,e-=(P(this,120).length|0)+5,e+=P(this,51)&2047,f=P(this,346),4<f.length&&(e-=(f.length|0)+3),0<e&&z(this,120,l(2,e).concat(B(e)),15),4<f.length&&z(this,120,l(2,f.length).concat(f),156)}finally{this.D=K}if(F=(O=B(2).concat(P(this,120)),O[1]=O[0]^6,O[3]=O[1]^D[0],O[4]=O[1]^D[1],this).X5(O))F="!"+F;else for(F="",e=0;e<O.length;e++)S=O[e][this.U](16),1==S.length&&(S="0"+S),F+=S;return P(this,(P((P(this,(Q(this,49,(h=F,g.shift())),443)).length=g.shift(),this),346).length=g.shift(),120)).length=g.shift(),h}if(t==lY)Ez(this,r[2],r[1]);else if(t==y)return Ez(this,8001,r[1])}}finally{m=k}}}(),N.prototype.uX=0,N.prototype).X5=function(p,m,r,h){if(h=window.btoa){for(m=(r=0,"");r<p.length;r+=8192)m+=String.fromCharCode.apply(null,p.slice(r,r+8192));p=h(m).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else p=void 0;return p},/./);N.prototype.Vw=0;var zz,jR=X.pop.bind((N.prototype[d0]=[0,0,1,1,0,1,1],N.prototype[C])),Tz=((zz=C8((PO[N.prototype.U]=jR,N.prototype.K),{get:jR}),N).prototype.x6=void 0,function(p,m){return(m=yb())&&1===p.eval(m.createScript("1"))?function(r){return m.createScript(r)}:function(r){return""+r}})(U);(Z=U.botguard||(U.botguard={}),40<Z.m||(Z.m=41,Z.bg=g0,Z.a=sz),Z).MDm_=function(p,m,r){return r=new N(p,m),[function(h){return RD(r,h)}]};}).call(this);'));
}).call(this);

Executed Writes (2)
#1 JavaScript::Write (size: 830) - SHA256: 5b62a9896a10b6c4bd20703e45621be6e0d431ae9faa990749925e1aa935044f
< script >
    var TrackTime = ['18:11:42.535', '18:11:42.535', '18:11:42.535'] < /script><style>.tmg-loading span{margin:0 auto;display:block;width:130px;font-size:large;font-variant:petite-caps;font-family:initial;text-align:center;}</style > < div id = 'tmgloading'
class = 'tmg-loading' > < span > Loading... < /span></div > < script > function TMG_CheckForClick() {
    try {
        var redirectTo = '#',
            tmpPlacement = '13488000';
        if ('#' != redirectTo) {
            var lurl = decodeURIComponent(redirectTo); - 1 != lurl.indexOf('http://') || -1 != lurl.indexOf('https://') ? window.location.href = lurl : eval(lurl)
        }
    } catch (r) {}
    return !0
} < /script><script src='https:/ / ldsapi.tmginteractive.com / GenericPlacementScriptDiv.aspx ? tmgrt = ancs & mainPlacement = 13488000 & hasLoadOptimation = 0 & hasMinAssets = 1 & placement = 13488000 & publisher = 139136 & affid = 1249169444874962 & subid = 1249169444874962 ' type='
text / javascript '></script>
#2 JavaScript::Write (size: 15083) - SHA256: 2029eab1be1dbda630c8e884c790dfae773d373228e4a835435b943ad4975a82
< style type = 'text/css' > .TMG - Creative - MoreInfo - Container {
        background - color: # fdecd7!important;
        border: 1 px solid # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar {
        background - color: # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar - Icon {
        color: # c4a176!important;
    }.TMG - Creative - MoreInfo - Container a {
        color: # dca926!important;
    }.TmgOffersArea {
        width: 370 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;padding:0px 0px 0px 0px;margin:0px 0px 0px 0px;}.TmgOfferTopSpace{width:370px!important;float:left!important;height:0px!important;}.TmgOfferHeaderImage{width:370px!important;float:left!important;display:none;border:0px solid # FFF!important;
    }.TmgOfferHeaderImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBlankTop {
        width: 370 px!important;float: left!important;margin: 5 px 0 px
    }.TmgOffers {
        width: 370 px!important;float: left!important;
    }.TmgOffer {
        width: 370 px!important;float: left!important;
    }.TmgFloat {
        float: left!important;
    }.TmgOfferVerbiage {
        width: 370 px!important;float: left!important;display: none;padding: 0 px 0 px 0 px 0 px!important;margin: 0 px 0 px 0 px 0 px!important;font - family: Arial,
        Helvetica,
        sans - serif!important;font - weight: normal!important;font - size: 12 px!important;color: #000!important;border-style:0px solid # FFF!important;text - align: left!important;
    }.TmgOfferFooterImage {
        width: 370 px!important;float: left!important;display: none;border: 0 px solid # FFF!important;height: 0 px!important;width: 0 px!important;
    }.TmgOfferFooterImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBottomSpace {
        width: 370 px!important;float: left!important;height: 0 px!important;
    }.tmgCampaignlogoArea {
        display: none;width: 130 px!important;vertical - align: top;float: left!important;background - repeat: no - repeat;
    }.tmgCampaignlogoArea img {
        border: 1 px solid #000000 !important;}.TmgCampaignControlArea{display:block;width:25px!important;vertical-align:top;}.TmgCheckBoxButton{margin:1px 3px!important;}.TmgRadioButton{margin:1px 3px!important;}.tmgControlText{font-family:Sans-Serif!important;font-size:14px!important;font-weight:normal!important;color:# 212529!important;font - variant: normal!important;vertical - align: top!important;vertical - align: middle;display: inline - block;padding: 0 px!important;padding: 0 px 0 px 5 px 1 px;margin - left: 0 px!important;margin - left: -1 px;
    }.TmgCampaignCreativeArea {
        float: left!important;width: 325 px!important;vertical - align: top;display: block;
    }.TmgCampaignCreativeText {
        width: 325 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;text-align:left!important;vertical-align:top!important;display:inline-block!important;overflow: hidden!important;}.TmgAdditionalFieldsArea{float:left!important;display:none;width:325px!important;font-family:Sans-Serif!important;font-variant:normal!important;color:# 212529!important;
    }.TmgBlankArea {
        float: left!important;width: 1 px!important;height: 1 px!important;padding: 0 px!important;margin: 0 px!important;
    }.TMG - Creative - MoreInfo - a - Collapse, .TMG - Creative - MoreInfo - a - Expand {
        cursor: pointer;color: #0000FF;text-decoration:underline;padding:0 5px;}.tmgFieldControlTheme{background-color:none;}.tmgFieldControlThemeRequired{background-color:# FF9999;
    }.TmgCampaignDisclaimer {
        font - size: 9 px!important;
        font - style: italic;
    }.tmgFieldOptionDirectionVertical {
        display: inline - table;
    }.TmgPoweredBy {
        float: left!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #9b9b9b!important;text-align:right!important;width:100%!important;}.TmgPoweredBy .initials-span{font-size:13px!important;}</style><script language= 'javascript'
        type = 'text/javascript' >
        var tmg_GlobalAssetsBaseURL = 'tmgassets.azureedge.net/amsus';
        var tmgPlacement = '13488000',
            tmgPublisher = '139136',
            tmgAffId = '1249169444874962',
            tmgSubId = '1249169444874962',
            tmgSSLKey = 's',
            tmgRedirectTo = '#',
            tmgMyURI = 'ldsapi.tmginteractive.com',
            tmgOfferPreCheck = false,
            tmgNumberOfOfferForPreCheck = 0,
            tmg_arrPreCheckCamps = [],
            tmgIsEmbeddedPlacement = true,
            tmgIsFieldDropOnButtonClick = false,
            tmgIsClientQueryStringPass = false,
            lUSER_PLATFORM = 0,
            lUSER_PLATFORM_SUB = 0,
            lUSER_IP_ADDRESS = '91.90.42.154',
            tmg_UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0',
            tmgHitUniqueKey = '1338743879',
            tmgTrustedFormFlag = false,
            tmgUniversalLeadidFlag = false,
            tmg_ptype = 'Embedded',
            tmg_psectype = 'EMBEDDED',
            tmg_hideCampOnClick = false,
            tmg_NumOfCampShowIntially = 0,
            tmg_ShowCampInBunchFunctionality = false,
            tmg_CampaignInABunch = 0,
            tmg_MainPlacement = '13488000',
            tmgAttachedInfo = 'Firefox;105.0;WinNT',
            tmgMoreInfoContext = '<i class=:SQ:fa fa-plus-circle:SQ: style=:SQ:color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgLessInfoContext = '<i class=:SQ:fa fa-minus-circle:SQ: style=:SQ:color:#A12227!important; font-size:16px!important;font-variant:normal !important;font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgSiteName = 'monthlysweeps.us',
            tmgShowingLiveViewOnly_1338743879 = false,
            UserActivityTrackingSequence = 0,
            tmg_PostLeadOnOpt = false,
            tmgTrustedFormEnabledCampaigns = [],
            gMonths = [],
            gDays = [],
            gYears = [],
            gCountry = [],
            usStates = [],
            caStates = [],
            auStates = []; < /script><script src='https:/ / tmgassets.azureedge.net / amsus / ldsapi / assets / script / standard.min.js ? version = 20220221 n ' type='
        text / javascript '></script><script src='
        https : //tmgassets.azureedge.net/amsus/ldsapi/assets/script/clientfp.min.js?version=20211103' type='text/javascript'></script><script src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common.min.js?version=20230119a' type='text/javascript'></script><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/browserdetect.min.js?version=120419' type='text/javascript'></script><link href='https://tmgassets.azureedge.net/amsus/ns/css/13488000.min.css?4231k31j20234231j01ckl31llk106jkk114200' rel='stylesheet' type='text/css' /><iframe security='restricted' id='tmgPost' height='1' width='1' style='display:none;'></iframe><img id='tmgCallPixelSrc' src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1' width='1' /><div id='TmgOffers' align='left' class='TmgOffersArea' style='display:none;'><div class='TmgOfferTopSpace'></div><div class='TmgOfferHeaderImage' title='&nbsp;'></div><div id='TmgOfferVerbiage13488000' class='TmgOfferVerbiage'></div><div class='TmgOfferBlankTop'></div><div id='tmgDisplayOfferContainer' class='TmgOffers'><div id='TMGOfferTD1' class='TmgOffer TmgOfferTheme' ></div><br class='tmg_ignore_br' style='clear:both;'/></div><div class='TmgOfferFooterImage' title=''></div><div class='TmgOfferBottomSpace'></div><div style='clear:both;'></div></div><div style='display:none;'><div id='TMGOfferTR$10023'><div class='TMGOfferDiv13488000'><div class='tmgOfferArea_CenterLeftLine'><div class='tmgOfferArea_CenterRightLine'><div class='tmgOfferArea_CenterTopLine'><div class='tmgOfferArea_TopLeftCorner'><div class='tmgOfferArea_TopRightCorner'><div class='tmgOfferArea_CenterBottomLine'><div class='tmgOfferArea_BottomLeftCorner'><div class='tmgOfferArea_BottomRightCorner'><div class='TmgBlankArea'></div><div id='TmgCampaignControl$10023' class='TmgFloat TmgCampaignControlTheme'><div align='left' valign='top' style='vertical-align:top!important;' class='TmgCampaignControlArea TmgCampaignControlAreaTheme'><input type='checkbox' id='tmgControl$10023$0' name='tmgControl$10023' class='TmgCheckBoxButton' onClick='javascript:TMG_CheckClick(this);' />&nbsp;</div></div><div id='TmgCampaignCreative$10023' class='TmgCampaignCreativeArea TmgCampaignCreativeAreaTheme'><span class='TmgCampaignCreativeText'><span id='TmgCampaignCreativeSection0' class='TmgCampaignCreativeSection0Theme'><label for='tmgControl$10023$0' style='cursor:pointer;display:inline;'>Get exclusive access to global deals and free apps for your smartphone! </label></span><span id='TmgCampaignCreativeSection1' class='TmgCampaignCreativeSection1Theme'>Sign up for Global and special offers! </span><br class='tmg_ignore_br' style='clear:left;'/><span class='TMG-Creative-MoreInfo-Span' id='CreativeMoreInfo$10023' style='display:none;'>Subscribe us to explore more.&nbsp;<a href='https://ldsapi.tmginteractive.com/pp/' target='_blank'>Privacy Policy</a></span><a class='TMG-Creative-MoreInfo-a-Expand' id='TMGMoreInfoAnchor$10023' onclick='javascript:TMG_ClickForCreativeMoreInfo(this)'><i class='fa fa-plus-circle' style='color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;'></i></a></span></div><br class='tmg_ignore_br' style='clear:both;'/><div id='TmgAdditionalFields$10023' class='TmgAdditionalFieldsArea TmgAdditionalFieldsAreaTheme' style='padding-left:25px'><div><span style='font-size:11px!important;font-weight:normal!important;' name='TmgFieldValidationMsg' id='TmgFieldValidationMsg$10023'>Please complete the following fields:</span></div><div style='height:2px!important;'></div><div id='F_10023_FIRST_NAME_TABLE'><div><span id='F_10023_FIRST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>First Name</span></div><div><input Id='F_10023_FIRST_NAME' name='F_10023_FIRST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_FIRST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_LAST_NAME_TABLE'><div><span id='F_10023_LAST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Last Name</span></div><div><input Id='F_10023_LAST_NAME' name='F_10023_LAST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_LAST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_EMAIL_TABLE'><div><span id='F_10023_EMAIL$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Email</span></div><div><input Id='F_10023_EMAIL' name='F_10023_EMAIL' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_EMAIL'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><input name='F_10023_IP_ADDRESS' Id='F_10023_IP_ADDRESS' type='hidden' value='91.90.42.154'/><div style='height:2px!important;'></div><input name='F_10023_COUNTRY' Id='F_10023_COUNTRY' type='hidden' value=''/><div style='height:2px!important;'></div><input name='F_10023_USER_PLATFORM' Id='F_10023_USER_PLATFORM' type='hidden' value='0'/><div style='height:2px!important;'></div><div><span id='TmgSuccessMsg$10023' name='TmgSuccessMsg' style='font-size:11px!important;'>Once you have completed the required field(s) you will see a success message here.</span></div></div><div id='TmgSpacerTop$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='TmgOffer TmgCampaignSepratorTheme' id='TmgCampaignSepratorId$10023' style='display:none;width:370px;border-bottom: 1px solid #000000!important;'></div><div id='TmgSpacerBottom$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='tmg_ignore_br' style='clear:left;'></div></div></div></div></div></div></div></div></div></div></div></div><input name='hFieldAffId' Id='hFieldAffId' name='hFieldAffId' type='hidden' value='1249169444874962'/><input Id='hTMG_FetchingDataFromQuery' type='hidden' value='0'/><input Id='hTMG_MappedDateFormat' type='hidden' value='0'/><input name='hFieldSubId' Id='hFieldSubId' name='hFieldSubId' type='hidden' value='1249169444874962'/><script language='javascript' type='text/javascript'>var IsPrePingExecuteFromClientScript=false,lCampaigns_out_from_preping=[0],lMappedClientFields='ADDRESS,1,address,NAME--AffId,0,hFieldAffId,ID--CITY,0,city,ID--DATE_OF_BIRTH,2,month^day^year,ID--EMAIL,1,email-address,ID--FIRST_NAME,1,first_name,ID--GENDER,3,title,NAME--LAST_NAME,1,last_name,ID--PHONE,1,phone_number,ID--STATE,0,state,ID--SubId,0,hFieldSubId,ID--ZIP,1,postal_code,ID',lCPL_10023='0.00',lCPLEntryFor_10023='ADMIN',lOptionDocumentNumber_10023='10023/226/0/225',lCampaignFields_10023='F_10023_FIRST_NAME,F_10023_LAST_NAME,F_10023_EMAIL,F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFinalOrderOfCampaignInDisplay='',lTrueTargetedCampaigns='',lFalseTargetedCampaigns='',lNumberOfCampaignsToDisplay='1',lAllCampaigns='10023',lAvoidValidateForIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFieldsContainChildField='',lHiddenFieldIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lAnswerMandatoryFlag=false,lRadioButtonFieldIds='',lCheckBoxFieldIds='',lClientQueryString='',lPrePingCampaigns='',lNumberOfPrepingCampaign='0',lExecuteLines='',lMappedFor_GENDER='Mr~M,Ms~F',lPlacementImpressionOn='LOAD',lCampaignsImpressionOn='LOAD';</script><script language='javascript' type='text/javascript'>try{TMG_DisplayOffers();fn_MoreInfo_Absolute();}catch(ex){}</script><script language='javascript' type='text/javascript'>var oldonload=window.onload;if (typeof window.onload != 'function'){window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();}} else {window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();oldonload();}}</script><script>UserActivityTrackingSequence=1;</script><link href='https://tmgassets.azureedge.net/amsus/ns/assets/awesome-font/font-awesome.css?version=120419' rel='stylesheet' type='text/css' /><script src='https://tmgassets.azureedge.net/amsus/ns/js/13488000.min.js?4231k31j20234231j01ckl31llk106jkk114200' type='text/javascript'></script><style>.tmg-loading{display:none;text-align:center;}</style><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common-extentions.min.js?20230119a' type='text/javascript'></script><input Id='hConditionalStructureData' type='hidden' value=''/><script>try{ TrackTime.push('18:11:42.707','18:11:42.707','18:11:42.707','18:11:42.785','18:11:42.785','18:11:42.785','18:11:42.785','18:11:42.785','18:11:42.785');TrackTime.push(GetDateStringInFormat(new Date(),'hh:mm:ss.fff')) } catch(ex) { }</script>


HTTP Transactions (82)


Request Response
                                        
                                            GET /go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         107.23.100.94
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Tue, 31 Jan 2023 18:11:41 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F6F1C295C68DFEBADACB1FC812B44E01C7EDE0E203615EF3E2CCED2CE2251E7E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8415
Expires: Tue, 31 Jan 2023 20:31:56 GMT
Date: Tue, 31 Jan 2023 18:11:41 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4C946A026114FF05316D92277750FACF3D5F5D162839149DA0B7FB1A4CFF6B5E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10850
Expires: Tue, 31 Jan 2023 21:12:31 GMT
Date: Tue, 31 Jan 2023 18:11:41 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 31 Jan 2023 17:35:54 GMT
age: 2147
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    30db107dcf4380cef05efea409c2e6a3
Sha1:   96e6a306fbc07299aba64e5c14e2bfca35872fa9
Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "50D7D516F446458145A304B288A0A39D391CD37EA50DABEA36AE48D291C65BA7"
Last-Modified: Tue, 31 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4931
Expires: Tue, 31 Jan 2023 19:33:52 GMT
Date: Tue, 31 Jan 2023 18:11:41 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: cHvrSRyW/X7C5WBGJj+3m8tyK0ndppNeMNLkGkiX6K9zAPqezBc6YXN90wbd/ugSn9vPW+i3IVA=
x-amz-request-id: PSMJ36SNVCE57CT4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 31 Jan 2023 17:22:18 GMT
age: 2963
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:41 GMT
Last-Modified: Tue, 31 Jan 2023 18:11:40 GMT
Server: ECS (nyb/1D11)
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: x4fNKFjzvD8OGi_TXUwwQqCW27oGmWJC_SpdmmHsnNzjH3ybJ6zthQ==
Age: 1

                                        
                                            GET /go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 9929
server: Apache/2.4.41 (Ubuntu)
set-cookie: ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (939)
Size:   9929
Md5:    ace15f3491eae149a1a8e1261445576a
Sha1:   febdce3cf7ed305d665e760f76c9e15448ff2af5
Sha256: 045ac15727c30772b9e6370d69ef72eca51d5498b3e8fc3b8d2ddf331f9ed77a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /ajax/libs/bootstrap-formhelpers/2.3.0/js/bootstrap-formhelpers.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.24.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
content-length: 58913
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03d8e-46f6d"
last-modified: Mon, 04 May 2020 16:06:38 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 18231876
expires: Sun, 21 Jan 2024 18:11:42 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xuXQ1FTbXlsnTS1awUvdQt68W%2FiukZOQOnKeCNZu75yigBNGdlSaV3i3KwaCAcWqHsCZarZWQQ%2FJ3v8%2BDzowoZfNXtoDYrgiWwKmWH9uqB63ENdxwn4sZxir49TgFnqVmdNMLjNd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7924694b9b5db529-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65274)
Size:   58913
Md5:    a63b2977b01b6e2d2e2086c3f63a3c9a
Sha1:   560409f64e40f5078e1ba8d496657badd7a3a6ee
Sha256: 4a477bb786727bd8c49a1dbc25dd37dcce7f2ceece74576dffd8a3da739b034f
                                        
                                            GET /assets/css/datepicker.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 818
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:06 GMT
etag: "d07-5c80ac2c970f8-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3335), with no line terminators
Size:   818
Md5:    3240fc33175e0e388f26fbac8bf8cff3
Sha1:   cf1a645948c9ce996e1560b9569f56822c4f9ba8
Sha256: 9077f43ae19f62f65d930304d4f77d3ce23ec0d4ba41e1284dac8702fbc05f96
                                        
                                            GET /jquery-3.3.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         69.16.175.42
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
content-encoding: gzip
content-length: 30288
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
accept-ranges: bytes
server: nginx
etag: W/"620cd6ff-1538f"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1675188702.dop067.sk1.t,1675188702.cds017.sk1.hn,1675188702.cds240.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   30288
Md5:    d549b312f7a7d228b4ec229a6547dfdc
Sha1:   0766794582ad530ec0f8c2595f741086afffa312
Sha256: f6488b2915e0ceee723f4320492511d46c6ba1860d5975d085e6da8913f55f44
                                        
                                            GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.24.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 3413903
expires: Sun, 21 Jan 2024 18:11:42 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XrF25r4eTykBX9elFWh9sZX9kiMUnilXIu8u2%2B5BYYb2fsLVof0OaB8tBbOsuOGLFwZWGmceKrTPZ1IPwvSuPJhHz5g3uFCvX04LZc11nP7jXrd%2BM%2FAxinhMGB6PiuOhvRm%2F8CS7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7924694b8b49b529-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (20322)
Size:   6458
Md5:    df9fe6d48e380554eb0ec9687bed3246
Sha1:   207263d754220200c1916edfbda262f62223ecf5
Sha256: 91d57502b7260e6752c2b5f1636d77707929fa9f09da28589691e61816a448f9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1443
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:42 GMT
Last-Modified: Tue, 31 Jan 2023 17:47:39 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /assets/css/loading_icon_1.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 580
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:07 GMT
etag: "db0-5c80ac2ce37a0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   580
Md5:    b6b8913a6a3ad6881037667493551ec5
Sha1:   3daae516738f878875bb15766ca06a2ed9ee442b
Sha256: cc46b8ab8bf6a609d0c9336a46ef8b217c15fb2ecdef548c5c4d6ce6ebdb52cf
                                        
                                            GET /assets/css/sweeps.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: text/css
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 1639
server: Apache/2.4.41 (Ubuntu)
last-modified: Fri, 02 Sep 2022 17:56:19 GMT
etag: "172c-5e7b572772120-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   1639
Md5:    a5c77602d9ceb6c6450244ffb0baf0d1
Sha1:   0a8756bf9ec23f2957f9165941196551cc046cf7
Sha256: d1bdae39d462d3c7ccb9f86a413c69df0026d2c06558af9b691a0e98bf0cdd4e
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5270
Cache-Control: max-age=122710
Date: Tue, 31 Jan 2023 18:11:42 GMT
Etag: "63d8819e-118"
Expires: Thu, 02 Feb 2023 04:16:52 GMT
Last-Modified: Tue, 31 Jan 2023 02:49:02 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3838
Cache-Control: max-age=154745
Date: Tue, 31 Jan 2023 18:11:42 GMT
Etag: "63d90459-118"
Expires: Thu, 02 Feb 2023 13:10:47 GMT
Last-Modified: Tue, 31 Jan 2023 12:06:49 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/img/sweepstakes250/one.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: image/png
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 801
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:31 GMT
etag: "321-5429f55d7e9c0"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   801
Md5:    03744c9d39310c5d2af2cf2a23616580
Sha1:   603f0d70ddc7d77f6341dc0caf9e0740b33ae061
Sha256: afbc2f9fe529022b98f966b254c8d3173a40998fdd01ee3739df99a8a3169a0b
                                        
                                            GET /assets/img/sweepstakes250/two.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: image/png
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 915
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:30 GMT
etag: "393-5429f55c8a780"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   915
Md5:    a1914f8236d7704856f5c5762e86c109
Sha1:   ea40712fad474fab16b7e2f1505bcb42302cd6ec
Sha256: 6c21621aeb7ad165ee758074b65bbf2fa35498a74320a940c52a3208375ef26d
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A29EE843C8A39551A1507CC6AD949AD509E33AAAE8B72C58AC4884BAD8B0B38E"
Last-Modified: Sun, 29 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5893
Expires: Tue, 31 Jan 2023 19:49:55 GMT
Date: Tue, 31 Jan 2023 18:11:42 GMT
Connection: keep-alive

                                        
                                            GET /assets/js/datepicker.js HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Tue, 31 Jan 2023 18:11:41 GMT
content-length: 5285
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:09 GMT
etag: "42ac-5c80ac2fab258-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (16878)
Size:   5285
Md5:    6c28af1b6fa9301701dfefc5dbfe5159
Sha1:   134cfa1c0a5a837f002034b8ea1a8c6243b96bac
Sha256: 4a47c7c7ccb099528d7387eadcc4989bbbc17d75981507635d015da4711bb932

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /ads/scripts/site-141028.js HTTP/1.1 
Host: ads.pro-market.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         95.101.10.74
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Last-Modified: Tue, 23 Jul 2019 13:39:45 GMT
Server: nginx/1.0.15
Content-Encoding: gzip
Content-Length: 1101
Cache-Control: max-age=86400
Date: Tue, 31 Jan 2023 18:11:42 GMT
Connection: keep-alive
Vary: Accept-Encoding


--- Additional Info ---
Magic:  ASCII text, with very long lines (514), with CRLF line terminators
Size:   1101
Md5:    540b7c85a21cf48ee81735b2ffcc335f
Sha1:   e5eaedc157c73717aab322629e3f1ad8569bc0a1
Sha256: aa2916440a5dc9e91cc213dc3503845a97fe91cfd12fe8e6cd92032b675a4da9
                                        
                                            GET /jquery.validation/1.15.0/additional-methods.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.193.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"4547-g4rGbD7KxrYTawSb3Q4U8vAilSw"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 31 Jan 2023 18:11:42 GMT
age: 7900783
x-served-by: cache-fra-eddf8230100-FRA, cache-bma1659-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5199
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17590)
Size:   5199
Md5:    4c0e8d136f8e41d83cb99f52be04f280
Sha1:   eecf9c91f361ac05dfaa6b7167aea6f0d4ddf7cd
Sha256: 81659fd2d8cc8d38327f4450954654b19dbb8a95a2b1e402e47869f0ca9dddc6
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 31 Jan 2023 17:41:42 GMT
age: 1800
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /jquery.validation/1.15.0/jquery.validate.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.193.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"58a0-xaL/AT+jV8HSplcbXY5ljmcAgOo"
content-encoding: gzip
accept-ranges: bytes
date: Tue, 31 Jan 2023 18:11:42 GMT
age: 6689293
x-served-by: cache-fra-eddf8230115-FRA, cache-bma1659-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7320
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (22550)
Size:   7320
Md5:    17f3f2c0dd873827d21aec4b7c7da443
Sha1:   e10d2e3deff107d85726cb4f14eee82f96f2594e
Sha256: 5f0adea83e4171c32048eafe7032ef01093d96794c62b988fb9935041e35a998
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1443
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:42 GMT
Last-Modified: Tue, 31 Jan 2023 17:47:39 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1776
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:42 GMT
Last-Modified: Tue, 31 Jan 2023 17:42:07 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3838
Cache-Control: max-age=154745
Date: Tue, 31 Jan 2023 18:11:42 GMT
Etag: "63d90459-118"
Expires: Thu, 02 Feb 2023 13:10:47 GMT
Last-Modified: Tue, 31 Jan 2023 12:06:49 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /ca/gsatlasr3dvtlsca2022q4 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "8EC97B4207DA0941A4F6BE2837762A9A54DA7ABC"
Expires: Wed, 01 Feb 2023 05:00:00 GMT
Last-Modified: Tue, 31 Jan 2023 17:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 1116
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7924694ccd630b49-OSL


--- Additional Info ---
Magic:  data
Size:   1462
Md5:    604ee8cf36e43eddd2388692d8fb2271
Sha1:   1a6230bd1cec3c073e587d2a3742195406119ed2
Sha256: db283d4eaa3be01efff707feb6c9dfdc609daa1afaf9d726ddffb50cb6856504
                                        
                                            GET /css?family=Lato:400,700|Oswald:400,600,700 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.106
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 31 Jan 2023 18:11:42 GMT
date: Tue, 31 Jan 2023 18:11:42 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   1127
Md5:    b22da2a095853e72a8a8358366e6b0f6
Sha1:   43e902abcdd694ed0e79a8ee3400aa52b15d8680
Sha256: 760715ec33f5d2149bcc99b60b75abf60a1794422a8112ac4620cfeed492488a
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 9alJMkZ6sBQxKxxBCKq9qg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.88.112.71
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Tj15dQ3SZ9izzidZ2H49SmIyijM=

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:42 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Mon, 30 Jan 2023 14:10:11 GMT
Expires: Mon, 06 Feb 2023 14:10:10 GMT
Etag: "58e424ee6a1ad2cb267d8b1f7179894cdb350e1b"
Cache-Control: max-age=503307,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7924694dcee9b515-OSL

                                        
                                            GET /assets/img/campaign/1249_bg.jpg HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
content-length: 205247
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 20:33:23 GMT
etag: "321bf-5d7afdc8ca618"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3\012- data
Size:   205247
Md5:    73d2b31df9ec1fe0c4e66a01e5e785b0
Sha1:   5fe301ad5e2579be8b15c0f3a1fa85e83e144741
Sha256: ec9b940fa1d7e84102af2028679eaad91995a59b4f47728f2144efac555928c7
                                        
                                            GET /generateplacementscript.aspx?placement=13488000&publisher=139136&affid=1249169444874962&subid=1249169444874962 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:41 GMT
Content-Length: 700


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (852), with CRLF line terminators
Size:   700
Md5:    3cc99ac0ad13ffe7274aa2e3b6e8b105
Sha1:   c981fcafe0ef24512f9bf1057d063f267392cdde
Sha256: 2fe19bf25aaf0401f21983d2656fec85730cd5c1d2d069d7895e9c22cc7340b6
                                        
                                            GET /GenericPlacementScriptDiv.aspx?tmgrt=ancs&mainPlacement=13488000&hasLoadOptimation=0&hasMinAssets=1&placement=13488000&publisher=139136&affid=1249169444874962&subid=1249169444874962 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:42 GMT
Content-Length: 4842


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (15114), with CRLF line terminators
Size:   4842
Md5:    fac5ed531e33ee22aacdd96bce72640a
Sha1:   4c74edb0f264d2202e8a189d592f7efc6393ae15
Sha256: 38aa4853886b4a07ac88893a595846ce7e2a8a8b6cfad4b2a28f56d620e54d2d
                                        
                                            GET /amsus/ldsapi/assets/images/spacer.gif HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: image/gif
                                        
content-length: 43
content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 7571bcc7-e01e-0020-46a8-34383f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VkDZYwAAAAAOgDgGafILS6k+UxHut+GrRlJBMjMxMDUwNDE4MDI3ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAAB699RBjY2KSLyKClIK4FADQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
                                        
                                            GET /amsus/ns/assets/awesome-font/font-awesome.css?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: text/css
                                        
content-length: 520
content-md5: AExI7hLtZOIj2uUf/9qAyg==
last-modified: Fri, 21 May 2021 11:01:09 GMT
etag: 0x8D91C47BDA9A147
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 2921287b-301e-004f-2f90-3590eb000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VUDZYwAAAAAKo0fRk4bKRo1hkOmsCfdzRlJBMjMxMDUwNDE3MDExADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 031nZYwAAAAAKVtuFyDRrR6RkGBDeMY8CQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (520), with no line terminators
Size:   520
Md5:    004c48ee12ed64e223dae51fffda80ca
Sha1:   a3a70b71586d8573a400bd4a2a0eb9bf8ec39c17
Sha256: 735903b0b0ffc434c5dd315d19c20594526dd23bcc44480e69edfbe20f4fb117
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2495
Expires: Tue, 31 Jan 2023 18:53:18 GMT
Date: Tue, 31 Jan 2023 18:11:43 GMT
Connection: keep-alive

                                        
                                            GET /amsus/ldsapi/assets/script/browserdetect.min.js?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: Shzc0tuaykHxXX+tfi+uUQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 82d58108-301e-004f-0d08-3490eb000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAABmIs+7gjuMQ5uBympaOdZ7RlJBMjMxMDUwNDE3MDExADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 031nZYwAAAACmi3zSQX/BRJ6byxzaMrlWQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (2046), with no line terminators
Size:   1038
Md5:    26442dd7d68ab219de359420e25ef647
Sha1:   4ba9efa81e08e5be49f109443398bac071c01d82
Sha256: 816b9db223bd43a4f286010341bc41e53fc4d367c402c3badde103a03a2a7e02
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2495
Expires: Tue, 31 Jan 2023 18:53:18 GMT
Date: Tue, 31 Jan 2023 18:11:43 GMT
Connection: keep-alive

                                        
                                            GET /amsus/ns/js/13488000.min.js?4231k31j20234231j01ckl31llk106jkk114200 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: 9wgtvP0cVsloq3UaPunwsA==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4E2F58
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 20681a06-801e-0056-63c7-34bc83000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADXc9yabcUoT7I07S/2+EfFRlJBMjMxMDUwNDE3MDQ5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAAB+lmN5Wq4nSISc1TgktvIMQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   1190
Md5:    a1cca2b6867553b33a4e0a8319a45ad8
Sha1:   dc59966fdf1d7af6c9589b923e1b97b2bd8b24d4
Sha256: 59986c6ea5264d0111e1be3ea7973083a3830d6a0b3eb07d545d10447c096036
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C75AEA885E434E8BF53E439C4B441E2AF4B228F70212001FCC4C8094F534E0F1"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2495
Expires: Tue, 31 Jan 2023 18:53:18 GMT
Date: Tue, 31 Jan 2023 18:11:43 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F55e9b24d-3c7c-46d8-89b7-084483cc3d1d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12507
x-amzn-requestid: 85c9adcd-b997-48ca-bbfb-ccdeaf3e8cfb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhklyFaJoAMFqKA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e7be-2bcdd8c353d8429d2b1e95f6;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:40:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: yDsY-3qpBlHMG9YWRQNiMNN3Ml1H4xQNKIO3D9u57sOPFW5hu_bQXQ==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 3cd7af07832481c336aa1c93c9b4a6fe.cloudfront.net (CloudFront), 1.1 google
date: Mon, 30 Jan 2023 21:54:44 GMT
age: 73019
etag: "d60f280f8a742480527dbc32d08f321f972d4fcf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12507
Md5:    5190c0bdc6abe0ee258e9f8c20ddaf51
Sha1:   d60f280f8a742480527dbc32d08f321f972d4fcf
Sha256: 874b38a04aa3736e65aaef72da2cc2efceb208618267107a495bdfe51ec58e58
                                        
                                            GET /amsus/ldsapi/assets/script/standard.min.js?version=20220221n HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: YTnb0ehLGLRubF63e3IyDA==
last-modified: Mon, 21 Feb 2022 16:55:53 GMT
etag: 0x8D9F55B05E46BD0
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 813d1e6d-701e-0007-2df5-33a276000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0CwfYYwAAAADr6B/6LcbqQrRvQ6HJOowLRlJBMjMxMDUwNDE4MDM5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAAD2KIRLREnOT4z4DCTxiuVgQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (5818), with no line terminators
Size:   8433
Md5:    bbb118ec1c7090001325da0d91177551
Sha1:   e901bd313283fb83914fd2be9202c808840993ea
Sha256: 4df1ffb786c50c90d3684c4aa9535e4ddd7b1e9a2ab461e3a97c848b98be43b7
                                        
                                            GET /amsus/ns/css/13488000.min.css?4231k31j20234231j01ckl31llk106jkk114200 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: text/css
                                        
content-encoding: br
content-md5: WEcI6Omll5/fQKo/f35d8g==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4EA477
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 6959a0fd-801e-0074-50d5-34d2b5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADVIE/YevAISpMkn2+AysZnRlJBMjMxMDUwNDE4MDIxADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 031nZYwAAAACb5BDdbpM6Sa0oolTs9nqhQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (8788), with no line terminators
Size:   11525
Md5:    53c2e8a521cb6d9930d5e4908c405c6b
Sha1:   25e84f4f71d809403deb14319f5802ee9855b288
Sha256: 372049cf445affcfe862c384c3388ef7a929190a60e1fedd059ab76ffae46aff
                                        
                                            GET /amsus/ldsapi/assets/script/clientfp.min.js?version=20211103 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: E4ptMzZLxbawD4B7RV5YCQ==
last-modified: Wed, 03 Nov 2021 09:07:36 GMT
etag: 0x8D99EA961032FA1
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 40b3a374-f01e-003f-4c90-35e32f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAADrYH3d2qvqQ4OpItCAdeMZRlJBMjMxMDUwNDE3MDM5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAADF8uqOgIZLRJcS3visoT+eQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (3119)
Size:   24733
Md5:    7dc1af167cd2b1bea32904f40073974f
Sha1:   3b6a241b9170097722b8796330481b175d8733fc
Sha256: 9c9100fac0f5c45acdbc322d2981e7ce251ba2a7cfdc4dea306aae6b7acefb5f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1295ec36-f5b2-4db1-83c7-667fa373f592.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13853
x-amzn-requestid: ca6ea6e7-3e13-4194-87f5-20a07b813e21
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fk3zzF4hIAMFwWg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d839b1-772487cb1b7495c52c552d36;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 21:42:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: lUGjUSIkoacdmaO1jnMwIuNMONhjyVfAIcTQ3B5d5da_g9eEnCtW7g==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Mon, 30 Jan 2023 21:48:17 GMT
age: 73406
etag: "1959fdd94846fa3791c4890578dd15336b909dcc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13853
Md5:    d957012d3e2b8c3bc0eefe11d66e8554
Sha1:   1959fdd94846fa3791c4890578dd15336b909dcc
Sha256: a97e81ec5eb2eda6a603bf4bfd4fa4ef4fab762747479489e99e6c713258a736
                                        
                                            GET /amsus/ldsapi/assets/script/common.min.js?version=20230119a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: C6fwdGWIexTnY7MOkhccRw==
last-modified: Wed, 18 Jan 2023 19:27:21 GMT
etag: 0x8DAF98A05414A99
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: e3041d87-d01e-0023-191f-343b38000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zFnZYwAAAAAkpOfCWtgDRan5+fRrYdkpRlJBMjMxMDUwNDE3MDMzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAAB9xwlZw34oRru+PoeX8K0pQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   35557
Md5:    586e1cc42d43e383562957ccde231d17
Sha1:   99a8ce594b88f61e71fe7498231a8a0262cf308d
Sha256: cbe664d65bb3f00b6e763d4d51d10fd2f3f73d97137cd182854ccdb92d0839f4
                                        
                                            POST /ManageImpressions/ReportViaJsPlacement.aspx?hKey=1338743879&affid=1249169444874962&subid=1249169444874962&Placement=13488000&Publisher=139136&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:43 GMT
Content-Length: 661


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   661
Md5:    31dc53f4a3e27d21f5afd9536c7dc49b
Sha1:   42af967ff4454b9d096ec9ea49f19d784e0fae18
Sha256: 3e29e25192eb4c6ef5421da01b19826dae5fbdef015c910f273eae22bd1db94a
                                        
                                            POST /ManageImpressions/ReportViaJsCampaign.aspx?hKey=1338743879&affid=1249169444874962&subid=1249169444874962&Placement=13488000&Publisher=139136&CurrentCamps=10023.10023/226/0/225&PreviousCamps=&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:43 GMT
Content-Length: 709


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (351), with CRLF line terminators
Size:   709
Md5:    f25189b2c16dbd8e0dbfa9b2b9a98f7b
Sha1:   3f088f2613f4eede1c0f2249b0b6b1a51c5341b4
Sha256: 12c0f8209e9ce868a20cb3523a5147c14fc40e8ffd8a04fa60cd2357f9baaf12
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4848
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:44 GMT
Last-Modified: Tue, 31 Jan 2023 16:50:56 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /amsus/ns/assets/awesome-font/fontawesome-webfont.woff?v=4.1.0 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://tmgassets.azureedge.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: font/woff
                                        
content-length: 83760
content-md5: /fSRzl/1stoCcIzQ6YZHGQ==
last-modified: Fri, 21 May 2021 11:01:16 GMT
etag: 0x8D91C47C18878E8
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: d2a0b055-401e-002d-2eff-33d733000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0zVnZYwAAAAAO/yB3duxHSK6fB27pqTsbRlJBMjMxMDUwNDE3MDQ3ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
access-control-allow-headers: *
access-control-allow-methods: GET
x-azure-ref: 031nZYwAAAAB2yPKLvHhsToc571c2PYplQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 83760, version 1.0\012- data
Size:   83760
Md5:    fdf491ce5ff5b2da02708cd0e9864719
Sha1:   7f2f3c55c2de192387c351b995115f6b79e09173
Sha256: 66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:44 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 28 Jan 2023 22:10:16 GMT
Expires: Sat, 04 Feb 2023 22:10:15 GMT
Etag: "83ef8a9a1d0d6076e4909a427995c0a1b7d76289"
Cache-Control: max-age=603794,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 739
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792469580b02b523-OSL

                                        
                                            GET /campaign/3cced9a6-4a67-d637-acdc-ccf79b4a5210.js?snippet_version=2 HTTP/1.1 
Host: create.lidstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         172.67.41.229
HTTP/2 200 OK
content-type: text/javascript
                                        
date: Tue, 31 Jan 2023 18:11:44 GMT
x-amz-id-2: C7UZ1BMjaKw8Upedm6ncDMEXCFYYaEDc4dLFaz9NrnpjCI3mFM5vKam2RVLtk70csxQI9+Zo3IY=
x-amz-request-id: 8PXXVEAXQSDXH30C
x-amz-replication-status: COMPLETED
last-modified: Fri, 12 Nov 2021 00:55:16 GMT
etag: W/"97495a102c98049f30e62264b1eb50f5"
cache-control: max-age=1800
x-amz-version-id: StKcIVmHluaEF1AzrOc3qrEmwMpZOgwG
cf-cache-status: HIT
age: 19
vary: Accept-Encoding
server: cloudflare
cf-ray: 792469580cbfb524-OSL
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   39855
Md5:    43e719d840decd8b010682c5e57094e6
Sha1:   f7f55b7b2ca60a848a02c68e57c6ba4f2bda6db6
Sha256: 35a25644b9fc402928a52e7a481a3d2ed8be057210708b06450ee8d3a4c4c547
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:44 GMT
Last-Modified: Tue, 31 Jan 2023 16:54:26 GMT
Server: ECS (nyb/1D2C)
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: yMY3p5_jLf42ryeyuEgdU_jgei0kUK39OcayqcLywwyzlClsYe7lZg==
Age: 4638

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 31 Jan 2023 18:11:44 GMT
Last-Modified: Tue, 31 Jan 2023 16:39:40 GMT
Server: ECS (nyb/1D14)
X-Cache: Miss from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: iRnrA6Nq3dB7oHmha-LNNIcUVZgOnBuY8rmj_Syh6S4CwePUwJkKhA==
Age: 5525

                                        
                                            GET /trustedform.js?provide_referrer=false&field=trusted_form&l=16751887217860.9722989613447729&invert_field_sensitivity=false HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         3.92.140.101
HTTP/2 301 Moved Permanently
content-type: text/html
                                        
server: awselb/2.0
date: Tue, 31 Jan 2023 18:11:44 GMT
content-length: 134
location: https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=trusted_form&l=16751887217860.9722989613447729&invert_field_sensitivity=false
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=156019
Date: Tue, 31 Jan 2023 18:11:44 GMT
Etag: "63d905c4-1d7"
Expires: Thu, 02 Feb 2023 13:32:03 GMT
Last-Modified: Tue, 31 Jan 2023 12:12:52 GMT
Server: ECS (bsa/EB1F)
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 7Ivjqaf1uwtmWtPj8J0heFjJG9ZH-1_5QhQDTcQmvpM4MVtxXRji8A==
Age: 4751

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 31 Jan 2023 18:11:44 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/31528eecbdf239747d771e9bf66f4e6f/aid/16944/s1/4874962
Cookie: leadid_token-FCB958C1-1AC9-561E-1E7C-7EB79158EEC4-3CCED9A6-4A67-D637-ACDC-CCF79B4A5210=0EDFE575-83EC-804D-EC88-B75AACDF7E64; _ga=GA1.2.1354865941.1675188710; _gid=GA1.2.397682771.1675188710; _gat=1; _hjSessionUser_2865935=eyJpZCI6IjEyOWY0NTlkLTQxOGMtNTMzNi1iZDJhLWJiMTdmNjFjMGVlYyIsImNyZWF0ZWQiOjE2NzUxODg3MTAyOTgsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_2865935=eyJpZCI6ImM4ZTAzMTNmLWU2OWUtNDYzMC1hYjdkLTEyMDhjMTExM2ZmMCIsImNyZWF0ZWQiOjE2NzUxODg3MTAzMjMsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; ci_session=o1te2ue0l8r2ni9n8c8p54cknrkrh2lo
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         3.212.250.95
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
                                        
date: Tue, 31 Jan 2023 18:11:44 GMT
content-length: 5430
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:08 GMT
etag: "1536-5c80ac2e78fe8"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   5430
Md5:    b0a102991e7332643ae57365023c00c8
Sha1:   4ea4c55c982e08bda104d2e8e981594c067cef24
Sha256: 1dfc58ffbcb07c761f79eb6b46f50b3789bd21e41a0b4cb1aca82b1dd8020fcc
                                        
                                            POST /api/hitsnap.ashx HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 10688
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Cache-Control: private
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Tue, 31 Jan 2023 18:11:44 GMT
Content-Length: 21


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   21
Md5:    8736cdfe08480bca66cffeee06268705
Sha1:   81af0417f969f93848b1cf30fce1db93884facc1
Sha256: 838a7c62adda8d131d694ae13ba2c5b73579aeb0f327d9f23e23880943a8a289
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=120730
Date: Tue, 31 Jan 2023 18:11:44 GMT
Etag: "63d88e39-1d7"
Expires: Thu, 02 Feb 2023 03:43:54 GMT
Last-Modified: Tue, 31 Jan 2023 03:42:49 GMT
Server: ECS (dcb/7F83)
X-Cache: Miss from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 2KW_POX-203HDJzih6i0koBV2P2JvMwj2ApE0TiokeVW74pH8t7sJQ==
Age: 65

                                        
                                            GET /amsus/ns/js/offers_extended_functions.min.js HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: JsdJsTroZxL3ol3Owm84Vg==
last-modified: Mon, 07 Mar 2022 22:37:07 GMT
etag: 0x8DA008B03257DBD
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 0c441b5d-401e-002d-2942-33d733000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0V0DZYwAAAADvG3BrwOytS6h/tQEsDlOURlJBMjMxMDUwNDE4MDUxADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 031nZYwAAAAAKwNymSQIdRIUQU6eLYJVPQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:43 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (349), with CRLF line terminators
Size:   77642
Md5:    f44e1d0b09991b68e453db7a799e9ee5
Sha1:   35ddbbaf5d10e5eef325a0c8ad38af18dcfac537
Sha256: 5b67ed523016439d7ed9fc34b0d7fbf69aad8b251574baf077f62662774b86ec
                                        
                                            GET /box-2722367854ce9702c28ea74c51e2a23f.html HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         54.230.111.85
HTTP/2 200 OK
content-type: text/html
                                        
content-length: 1035
date: Mon, 30 Jan 2023 16:06:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "8665e233ef6caaf010ca89793f27b6f8"
last-modified: Mon, 30 Jan 2023 16:05:37 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 0m14qNmpS3M7Z3oK-3Rbfh15VJtVJ5V72c33Afsp1ZbLXDU2iMsOPg==
age: 93939
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Size:   1035
Md5:    8665e233ef6caaf010ca89793f27b6f8
Sha1:   5c593fa5f33e55b3081308b43e6e801b56c047f7
Sha256: 435a3ca7c1c49cbfac193647d056e46217e5c3f9c65c354974ad7acdfb8925ac
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=167500
Date: Tue, 31 Jan 2023 18:11:46 GMT
Etag: "63d932d4-1d7"
Expires: Thu, 02 Feb 2023 16:43:26 GMT
Last-Modified: Tue, 31 Jan 2023 15:25:08 GMT
Server: ECS (nyb/1D34)
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: OZiUo2ccldTmwfHdSpJ1C8nCWIgWu8tqWIVc86tlzH0K6C0AcXIRzg==
Age: 4698

                                        
                                            POST /certs HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 645
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         3.92.140.101
HTTP/2 201 Created
content-type: application/json; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:46 GMT
content-length: 475
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (475), with no line terminators
Size:   475
Md5:    04e67d3b6bd4fa693fdbeceb9ff5a723
Sha1:   9fbff9e10c9fc437d9e6de02ecb5c484fa65ba62
Sha256: b14801d5d678544204e0a6aa3f422883258fb71625828db02c4b8f7e2330a781
                                        
                                            GET /trustedform-1.8.35.js HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         54.230.111.60
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Fri, 06 Jan 2023 16:07:23 GMT
x-amz-version-id: PsGscq0o6WWOGkSqGH9BYInejEgnNeUZ
server: AmazonS3
content-encoding: gzip
date: Tue, 31 Jan 2023 18:11:27 GMT
etag: W/"cef26bd569e1a24279f16aecc87c254b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: ued3blXPQJ7m7NN9xj6n-meHsXeNFFC8h8qVU_GOw6WqYMcNvzx-_g==
age: 27
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37512
Md5:    238062ed280fdd9f356a17e5ba207c05
Sha1:   69e1952776599a4d3fde9eb7876917fc894c6ddb
Sha256: 05fd2f5b6e840f2abae0af59622821588b9dc109c8803fea255961a4eb0c5b6f
                                        
                                            POST /certs/2588516f0f661fc82eaea2ac5b2b7fb12fb39e3e/fingerprints HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 305
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         3.92.140.101
HTTP/2 204 No Content
                                        
date: Tue, 31 Jan 2023 18:11:46 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2

                                        
                                            POST /2.11.9/InitFormData?msn=4&pid=54b6bf0b-80fd-4d7b-9c85-f43a678dc57d&token=0EDFE575-83EC-804D-EC88-B75AACDF7E64&_=466476573 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 1064
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:46 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rguserid=d4b2839c-797f-4e16-85fc-6f179d950fec; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

                                        
                                            GET /bootstrap/4.1.0/css/bootstrap.min.css HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.10.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: US
cdn-edgestorageid: 718, 718
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-04-13 02:48:26
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: b584a7f7756eea1e54b5f28d657ba679
cdn-cache: HIT
cf-cache-status: HIT
age: 1083508
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7924694c3fceb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /api/v2/client/sites/2865935/visit-data?sv=6 HTTP/1.1 
Host: in.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 115
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.253.22.133
HTTP/2 200 OK
content-type: application/json
                                        
date: Tue, 31 Jan 2023 18:11:46 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=3&pid=54b6bf0b-80fd-4d7b-9c85-f43a678dc57d&token=0EDFE575-83EC-804D-EC88-B75AACDF7E64&_=466476572 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 944
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:46 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rguserid=b17b3390-4529-4f1c-a9cf-1dcd577f2b14; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:46 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.10.207
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 31 Jan 2023 18:11:42 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
cdn-edgestorageid: 565, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:05 GMT
cdn-cachedat: 2021-06-08 18:02:12
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: a9c552a6ef500abddb12a9852509d4ed
cdn-status: 200
cdn-cache: HIT
cf-cache-status: HIT
age: 20634855
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7924694c4ffbb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common-extentions.min.js?20230119a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.238.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: G3v7pHqbSC0Gvp9zsfwXIA==
last-modified: Wed, 09 Jun 2021 12:26:50 GMT
etag: 0x8D92B41DB6898DE
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 2cad6eb8-401e-0040-7b15-337d1d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0VUDZYwAAAADJx4JLL0oVTpeOHGENWbePRlJBMjMxMDUwNDE4MDMzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 03lnZYwAAAAC2CB0lXLubRbi6MZtuOwHCQ1BIMzBFREdFMDQxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
date: Tue, 31 Jan 2023 18:11:42 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /c/hotjar-2865935.js?sv=6 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.39
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:23 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/35bf57c3427ec86a170a24c25f51190f
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: tIoCLaKSaV4wQZYzjCVHSALWPDivNDXGYUIlDJtKoz9IdVibQlzPHA==
age: 21
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/SaveLeadUrl?msn=1&pid=54b6bf0b-80fd-4d7b-9c85-f43a678dc57d&token=0EDFE575-83EC-804D-EC88-B75AACDF7E64&_=466476570 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 293
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:44 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rguserid=1195feb7-c42f-46c2-bbf5-2e2ca4bcba2f; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=2&pid=54b6bf0b-80fd-4d7b-9c85-f43a678dc57d&token=0EDFE575-83EC-804D-EC88-B75AACDF7E64&_=466476571 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 12855
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Tue, 31 Jan 2023 18:11:44 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rguserid=82a01e1a-8606-44e1-a92b-afdab5604226; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Thu, 02-Mar-2023 18:11:44 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---