185.107.56.208302 Found 11 B URL User Request GET HTTP/1.1 IP 185.107.56.208:80
ASN #43350 NForce Entertainment B.V.
File type ASCII text, with no line terminators
Hash 32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
GET / HTTP/1.1
Host: www.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Sat, 14 Oct 2023 13:14:51 GMT
location: http://ww1.ambermalta.win
server: nginx
set-cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; path=/; domain=.ambermalta.win; expires=Thu, 01 Nov 2091 16:28:59 GMT; max-age=2147483647; HttpOnly
199.59.243.225200 OK 1.0 kB URL User Request GET HTTP/1.1 IP 199.59.243.225:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (322)
Hash cf2c84de78bae7689e895def343e6cc4
78d05df8475bed89ad523785b1707eba490b0662
c4903ea25f1c027ea5221c83eb3286ebabae260692654db7351970d34b84652e
GET / HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sat, 14 Oct 2023 13:14:52 GMT
content-type: text/html; charset=utf-8
content-length: 1025
x-request-id: fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_sh/QDJSBHgozvUK/F+B1pBfBi/IANGigHjnFAPJn1utYMa0A/T55jDRGX9xu84gOr3I1FY5pG+8JyM4tjH5eqg==
set-cookie: parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2; expires=Sat, 14 Oct 2023 13:29:53 GMT; path=/
ww1.ambermalta.win/bFszjHpiJ.js
199.59.243.225200 OK 42 kB URL GET HTTP/1.1 ww1.ambermalta.win/bFszjHpiJ.js
IP 199.59.243.225:80
Requested by http://ww1.ambermalta.win/
File type Unicode text, UTF-8 text, with very long lines (41936)
Hash f8d1be940585934a6a01aaf8f60d74fa
d1321df21a19639ba7c369cd3a4ef06d9c99e1bd
cead005b29251cbda5a4eec5d51aecb276df41376fce5252a221951a0644638e
GET /bFszjHpiJ.js HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Sat, 14 Oct 2023 13:14:52 GMT
content-type: application/javascript; charset=utf-8
content-length: 41939
x-request-id: 56fb315f-8458-4bce-96f2-3bcb44225672
set-cookie: parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2; expires=Sat, 14 Oct 2023 13:29:53 GMT
ww1.ambermalta.win/_fd
199.59.243.225200 OK 2.0 kB IP 199.59.243.225:80
Requested by http://ww1.ambermalta.win/
File type ASCII text, with very long lines (3989), with no line terminators
Hash 59c2c7db73a9c63e80ca049e2290d3f7
0f56cc235a46ced9dce02f5788c8c801d8edee20
70c5d5ae24f90987f85a070b452f5d0967f142bfd9f2bd22c3619637e58d045a
POST /_fd HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.ambermalta.win/
Content-Type: application/json
Origin: http://ww1.ambermalta.win
DNT: 1
Connection: keep-alive
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/1.1 200 OK
server: openresty
date: Sat, 14 Oct 2023 13:14:52 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 2039
x-version: 2.109.9
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2; expires=Sat, 14 Oct 2023 13:29:53 GMT; Max-Age=900; path=/; httponly
ww1.ambermalta.win/px.gif?ch=1&rn=4.300205843040952
199.59.243.225200 OK 42 B URL GET HTTP/1.1 ww1.ambermalta.win/px.gif?ch=1&rn=4.300205843040952
IP 199.59.243.225:80
Requested by http://ww1.ambermalta.win/
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /px.gif?ch=1&rn=4.300205843040952 HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
server: openresty
date: Sat, 14 Oct 2023 13:14:53 GMT
content-type: image/gif
content-length: 42
last-modified: Tue, 18 Jul 2023 15:33:43 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes
ww1.ambermalta.win/px.gif?ch=2&rn=4.300205843040952
199.59.243.225200 OK 42 B URL GET HTTP/1.1 ww1.ambermalta.win/px.gif?ch=2&rn=4.300205843040952
IP 199.59.243.225:80
Requested by http://ww1.ambermalta.win/
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /px.gif?ch=2&rn=4.300205843040952 HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
server: openresty
date: Sat, 14 Oct 2023 13:14:53 GMT
content-type: image/gif
content-length: 42
last-modified: Tue, 18 Jul 2023 15:33:43 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
accept-ranges: bytes
ocsp.pki.goog/gts1c3
142.250.74.131 472 B IP 142.250.74.131:0
Hash 0ed2bcc8270de7d3e49bcae821eeeaf3
7d82790702edbaac256068258275b48b509e483c
063f020957f0e0303750c87417eba14d22f2648909b2a393daa704878f4dc1d8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131 472 B IP 142.250.74.131:0
Hash 0ed2bcc8270de7d3e49bcae821eeeaf3
7d82790702edbaac256068258275b48b509e483c
063f020957f0e0303750c87417eba14d22f2648909b2a393daa704878f4dc1d8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131 472 B IP 142.250.74.131:0
Hash 06ad568f1cf3e959ca8c4342aecf04a8
b694d4d303e0e1e4ee65f2379d02c63a00fb7396
2cffc5cea95b3047fea042f6a12ff415e917e48a2b0689a2f91794f51f518172
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css?family=Quicksand
142.250.74.138200 OK 56 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Quicksand
IP 142.250.74.138:443
Requested by http://ww1.ambermalta.win/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint73:C0:B4:AB:41:0A:6A:68:D4:AE:EE:E2:11:A4:38:23:EF:D2:86:B7
ValidityMon, 18 Sep 2023 08:25:07 GMT - Mon, 11 Dec 2023 08:25:06 GMT
File type gzip compressed data, max compression\012- data
Hash 892c35b62792ca9e623ad3c973e533b4
91668e544a965e2ec59303e329f106651b1b1802
cf6c2ba170fc6544471970b66e7126c08085ca98458957f223ed3f3a5ec02fde
GET /css?family=Quicksand HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 14 Oct 2023 13:14:54 GMT
date: Sat, 14 Oct 2023 13:14:54 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/ro
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol313%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol452&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.ambermalta.win%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301371&format=r3&nocache=551697289295082&num=0&output=afd_ads&domain_name=ww1.ambermalta.win&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1697289295086&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=571959512&uio=-&cont=rs&jsid=caf&jsv=571959512&rurl=http%3A%2F%2Fww1.ambermalta.win%2F
142.250.74.164200 OK 2.5 kB URL GET HTTP/3 www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol313%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol452&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.ambermalta.win%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301371&format=r3&nocache=551697289295082&num=0&output=afd_ads&domain_name=ww1.ambermalta.win&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1697289295086&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=571959512&uio=-&cont=rs&jsid=caf&jsv=571959512&rurl=http%3A%2F%2Fww1.ambermalta.win%2F
IP 142.250.74.164:443
Requested by http://ww1.ambermalta.win/
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint09:1E:68:9F:BD:40:4B:47:8D:AC:BE:FE:EF:35:D6:52:C1:A0:EC:9F
ValidityMon, 18 Sep 2023 08:19:26 GMT - Mon, 11 Dec 2023 08:19:25 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (12920)
Hash b9a0afd06c22fa61fc91602ce8aac1ad
fbd73cedae2c0e0a3b36dc52874333cfe0b4fbe2
fcc44cb2600b009da1b885513238b2b6db20f63efb2d5dabe5041bed02b6ecd5
GET /afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol313%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol452&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.ambermalta.win%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301371&format=r3&nocache=551697289295082&num=0&output=afd_ads&domain_name=ww1.ambermalta.win&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1697289295086&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=571959512&uio=-&cont=rs&jsid=caf&jsv=571959512&rurl=http%3A%2F%2Fww1.ambermalta.win%2F HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sat, 14 Oct 2023 13:14:54 GMT
expires: Sat, 14 Oct 2023 13:14:54 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-j2rhUNu4zlxS8g6TMi4uqw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2499
x-xss-protection: 0
set-cookie: CONSENT=PENDING+224; expires=Mon, 13-Oct-2025 13:14:54 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.pki.goog/gts1c3
142.250.74.131 471 B IP 142.250.74.131:0
Hash d50fbe01d5e298816b137b2e837a2487
f594d1d197a184a936846f30766229d89e161772
26180d391e818357e811b296289a29468c31d7e861a32132c94d71d721fce20a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131 471 B IP 142.250.74.131:0
Hash d50fbe01d5e298816b137b2e837a2487
f594d1d197a184a936846f30766229d89e161772
26180d391e818357e811b296289a29468c31d7e861a32132c94d71d721fce20a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
142.250.74.65200 OK 278 B URL GET HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff
IP 142.250.74.65:443
Requested by https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol313%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol452&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.ambermalta.win%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301371&format=r3&nocache=551697289295082&num=0&output=afd_ads&domain_name=ww1.ambermalta.win&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1697289295086&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=571959512&uio=-&cont=rs&jsid=caf&jsv=571959512&rurl=http%3A%2F%2Fww1.ambermalta.win%2F
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint55:19:28:2A:70:BF:AC:8C:55:AA:5A:6C:49:B7:AB:89:93:4B:93:74
ValidityMon, 18 Sep 2023 08:23:58 GMT - Mon, 11 Dec 2023 08:23:57 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (306)
Hash fe7dd8c3c629cc6e9cd6d3e4d3cbe905
59ef3b8e4a17169a4cb45fba65bf0d2bf49c8a18
5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e
GET /ad_icons/standard/publisher_icon_image/call_to_action_arrow.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 278
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 14 Oct 2023 09:30:15 GMT
expires: Sun, 15 Oct 2023 08:30:15 GMT
cache-control: public, max-age=82800
age: 13479
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/adsense/domains/caf.js
142.250.74.164200 OK 55 kB URL GET HTTP/2 www.google.com/adsense/domains/caf.js
IP 142.250.74.164:443
Requested by http://ww1.ambermalta.win/
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintC9:F6:98:54:A9:56:99:75:0A:10:B7:BD:95:70:40:74:3A:B0:B0:77
ValidityMon, 18 Sep 2023 08:25:14 GMT - Mon, 11 Dec 2023 08:25:13 GMT
File type ASCII text, with very long lines (2067)
Hash a832a46b68a6de43f68b65d8b92f39ef
44674a80ce067b9ccc37c8a8b218708c0cc90dad
56231b20f56508defa228f9b4af27c1dfa03fe294f6c22c42f267e76bb394647
GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sat, 14 Oct 2023 13:14:54 GMT
expires: Sat, 14 Oct 2023 13:14:54 GMT
cache-control: private, max-age=3600
etag: "10195378011963769314"
x-content-type-options: nosniff
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ocsp.pki.goog/gts1c3
142.250.74.131 471 B IP 142.250.74.131:0
Hash d50fbe01d5e298816b137b2e837a2487
f594d1d197a184a936846f30766229d89e161772
26180d391e818357e811b296289a29468c31d7e861a32132c94d71d721fce20a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Oct 2023 13:14:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ww1.ambermalta.win/_tr
199.59.243.225200 OK 22 B IP 199.59.243.225:80
Requested by http://ww1.ambermalta.win/
File type ASCII text, with no line terminators
Hash 444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /_tr HTTP/1.1
Host: ww1.ambermalta.win
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.ambermalta.win/
Content-Type: application/json
Content-Length: 1613
Origin: http://ww1.ambermalta.win
DNT: 1
Connection: keep-alive
Cookie: sid=a8e057a4-6a93-11ee-95ab-e566e6748ce1; parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
server: openresty
date: Sat, 14 Oct 2023 13:14:54 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 22
x-version: 2.109.9
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=fa5e1191-fc74-4ca1-8bab-9a3f0cada8a2; expires=Sat, 14 Oct 2023 13:29:55 GMT; Max-Age=900; path=/; httponly
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=6pp7dupz9x1g&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0
142.250.74.164204 No Content 0 B URL GET HTTP/3 www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=6pp7dupz9x1g&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0
IP 142.250.74.164:443
Requested by http://ww1.ambermalta.win/
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint09:1E:68:9F:BD:40:4B:47:8D:AC:BE:FE:EF:35:D6:52:C1:A0:EC:9F
ValidityMon, 18 Sep 2023 08:19:26 GMT - Mon, 11 Dec 2023 08:19:25 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=6pp7dupz9x1g&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bs&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-ZPN6t8N8pq0pSiXmxCjJLA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 14 Oct 2023 13:14:56 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=DjfreHEtJo-ZsD4Sc4U9aYywkKpVb9EMdXMy0pJZKDC1QpU30E958QyqSbCy-4eRfeQpEdU5dhxhFxuSlrpfirXYAosFscwFpoj8ASXc0urkPwIT1lvmvwDhSia8_9pqgYTPNo6pvcEXZe5NM9hlIm2w6kx7XB1E4syaR0d5pEg; expires=Sun, 14-Apr-2024 13:14:56 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+582; expires=Mon, 13-Oct-2025 13:14:56 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=4tmu4xd81x9y&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0
142.250.74.164204 No Content 0 B URL GET HTTP/3 www.google.com/afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=4tmu4xd81x9y&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0
IP 142.250.74.164:443
Requested by http://ww1.ambermalta.win/
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint09:1E:68:9F:BD:40:4B:47:8D:AC:BE:FE:EF:35:D6:52:C1:A0:EC:9F
ValidityMon, 18 Sep 2023 08:19:26 GMT - Mon, 11 Dec 2023 08:19:25 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-bodis30_3ph&output=uds_ads_only&zx=4tmu4xd81x9y&aqid=TpQqZc3pIMWexdwPhYSW2Ag&psid=3113057640&pbt=bv&adbx=290&adby=145&adbh=481&adbw=700&adbah=153%2C153%2C153&adbn=master-1&eawp=partner-dp-bodis30_3ph&errv=571959512&csala=13%7C0%7C317%7C72%7C286&lle=0&ifv=1&usr=0&hpt=0 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww1.ambermalta.win/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-HgJYyY8Z_5xYd5DV3Dvi2A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sat, 14 Oct 2023 13:14:57 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=rnfScf0eJ5HIAUTisgyJlZYDffV6xUqQTRmmX_-XqDhUEgX8kmRQGQXGDvem5mY3LOK_wJ1Fo0z4AMgUTQIFtUAuQd1vabwFVr6Q0dqKqxsPsYe4u2ASSDKCWYppdHMVtYTeWT69vZ84jThSgvlFkfww_Sjj-_vDwV30dBUVBvs; expires=Sun, 14-Apr-2024 13:14:57 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+215; expires=Mon, 13-Oct-2025 13:14:57 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
142.250.74.65200 OK 200 B URL GET HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b
IP 142.250.74.65:443
Requested by https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol313%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol452&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.ambermalta.win%3Fcaf%26&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2298147197369106&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301371&format=r3&nocache=551697289295082&num=0&output=afd_ads&domain_name=ww1.ambermalta.win&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1697289295086&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=922&frm=0&cl=571959512&uio=-&cont=rs&jsid=caf&jsv=571959512&rurl=http%3A%2F%2Fww1.ambermalta.win%2F
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint55:19:28:2A:70:BF:AC:8C:55:AA:5A:6C:49:B7:AB:89:93:4B:93:74
ValidityMon, 18 Sep 2023 08:23:58 GMT - Mon, 11 Dec 2023 08:23:57 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Hash e81eb30a6c5589e7f39436e40b400822
ca2513ede010b3db00099335b809ca693c2cd65c
055ae1fef3be182534069c718e2dc0ab07d7464bcc3ded19553da07d37333657
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 14 Oct 2023 03:24:13 GMT
expires: Sun, 15 Oct 2023 02:24:13 GMT
cache-control: public, max-age=82800
age: 35441
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2