www.highcpmcreativeformat.com/307cd9a6acefbb29c6f7ae3a8c253579/invoke.js
11 kB URL www.highcpmcreativeformat.com/307cd9a6acefbb29c6f7ae3a8c253579/invoke.js
IP
File type exported SGML document, ASCII text, with very long lines (29601), with no line terminators
Hash 887aa12faf1934b64571ef77225b3ca2
d3ce53473c934aae6d6afcbf42b2e6b5e2205e6a
7926a3996f43976898112ecb50687a0d30e6700ed961bd4f76ac3c8ddc2c88de
GET /307cd9a6acefbb29c6f7ae3a8c253579/invoke.js HTTP/1.1
Host: www.highcpmcreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a5837ff1.rinmovie.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 11 Dec 2023 18:54:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 32750c4cc7bb6718951b6c5a14e356e9
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
proftrafficcounter.com/stats
40 B URL proftrafficcounter.com/stats
IP
File type ASCII text, with no line terminators
Hash 1b93d0f469f6e1d32975319105a37ac7
add86af3ec1574b485261e93a383e2a6966bcb53
af3a3cacdb5d41966e6c37886598392284e185ee7d763ddf237e56c6ac4745dc
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a5837ff1.rinmovie.pages.dev/
Origin: https://a5837ff1.rinmovie.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:15 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://a5837ff1.rinmovie.pages.dev
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e:3:1; expires=Thu, 08 Dec 2033 18:54:15 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
demeanourgrade.com/watch.1285530923601.js?key=307cd9a6acefbb29c6f7ae3a8c253579&kw=%5B%22movie%22%2C%22unlimited%22%5D&refer=https%3A%2F%2Fa5837ff1.rinmovie.pages.dev%2F&tz=0&dev=e&res=14.3095&uuid=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e%3A3%3A1
0 B URL demeanourgrade.com/watch.1285530923601.js?key=307cd9a6acefbb29c6f7ae3a8c253579&kw=%5B%22movie%22%2C%22unlimited%22%5D&refer=https%3A%2F%2Fa5837ff1.rinmovie.pages.dev%2F&tz=0&dev=e&res=14.3095&uuid=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e%3A3%3A1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /watch.1285530923601.js?key=307cd9a6acefbb29c6f7ae3a8c253579&kw=%5B%22movie%22%2C%22unlimited%22%5D&refer=https%3A%2F%2Fa5837ff1.rinmovie.pages.dev%2F&tz=0&dev=e&res=14.3095&uuid=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e%3A3%3A1 HTTP/1.1
Host: demeanourgrade.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a5837ff1.rinmovie.pages.dev/
Origin: https://a5837ff1.rinmovie.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 11 Dec 2023 18:54:15 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://a5837ff1.rinmovie.pages.dev
Access-Control-Allow-Origin: https://a5837ff1.rinmovie.pages.dev
Access-Control-Allow-Credentials: true
Location: https://demeanourgrade.com/watch.1285530923601.js?key=307cd9a6acefbb29c6f7ae3a8c253579&kw=%5B%22movie%22%2C%22unlimited%22%5D&refer=https%3A%2F%2Fa5837ff1.rinmovie.pages.dev%2F&tz=0&dev=e&res=14.3095&uuid=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e%3A3%3A1&shu=35437a174b767f219e9ffa6554cefb35d4e3dd12f37ac8fb3047a14248e47b3331f27e330350e4ef6441301b03fe51b7e3673e730369f9de3f73bb3622f9a438c6dc4cb1c3013b5e3916ac5c5e389f157abd2e57041b1569c29b23163342&pst=1702320915&rmtc=t
Set-Cookie: u_pl=18362661; expires=Tue, 12 Dec 2023 18:54:15 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxODM2MjY2MSwiayI6IjMwN2NkOWE2YWNlZmJiMjljNmY3YWUzYThjMjUzNTc5Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMjI3NjU3LCJwaWQiOjY5MDU4MSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxLCJhaWQiOjMyLCJwdCI6NCwicGsiOiJpcjJid2M1eXRqIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vYTU4MzdmZjEucmlubW92aWUucGFnZXMuZGV2LyIsImFyIjpbXX19.Vs6gkUWtH3RyfN8aaiGBqjQEEBgwjpHLHB2-DMY8__Q; expires=Mon, 11 Dec 2023 18:55:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: af67e015be8db75e1414373789ed85ed
Strict-Transport-Security: max-age=0; includeSubdomains
a5837ff1.rinmovie.pages.dev/favicon.ico
2.2 kB URL a5837ff1.rinmovie.pages.dev/favicon.ico
IP
File type HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- exported SGML document, ASCII text, with CRLF line terminators
Hash 18a9cae1a49641313f71844791e337cf
3c7887d6c2fb5a52f11df9f132bf5124d4fd2020
b8290967dbb4b3eddafc69bdb0d633f02880594b0fa22a8a3f4b95f5dbe7e54a
GET /favicon.ico HTTP/1.1
Host: a5837ff1.rinmovie.pages.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a5837ff1.rinmovie.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: dom3ic8zudi28v8lr6fgphwffqoz0j6c=dcbbfd34-adfc-48e8-9b7d-d68cfb896f9e%3A3%3A1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 11 Dec 2023 18:54:15 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"5e661f01b597d399302461e332a4799f"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-robots-tag: noindex
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q7YWQMwwPIi9f%2BYq2rxwrWiY0nUUaDmFOi4zJQptN0GiKIqmwoCjeF5QQMH%2F%2BoRzFzxwMNxdVfp1%2FvrQZ4XBsQzxOd2obTXjve%2FwRZxNtINmfHlq%2BkxVNaUlLE07Weuo4JBFMSKo9LlFyReuqi4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833fef62dc38b52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
conqueredallrightswell.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=18362661
1.4 kB URL conqueredallrightswell.com/dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=18362661
IP
File type HTML document text
- HTML document text
- HTML document, ASCII text, with very long lines (500)
Hash 87ee72d28e68a34d63525336ad9e1199
09168507f6a4762ac4c8a4c2fe988606f8f202ac
29896964e1b3531a61ba4a515a8e22521456eba1dbfe55e25004e518e8041dbc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /dyfc1k09?key=863705bcbb4b6a554ddb359665395a6f&psid=18362661 HTTP/1.1
Host: conqueredallrightswell.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a5837ff1.rinmovie.pages.dev/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 11 Dec 2023 18:54:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=16122660; expires=Tue, 12 Dec 2023 18:54:16 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTgzNjI2NjEiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9hNTgzN2ZmMS5yaW5tb3ZpZS5wYWdlcy5kZXYvIiwiYXIiOltdfX0.AdydLRgu3L43foGHDdY2x2dy3U6SzLOfljZsP3xwNr0; expires=Mon, 11 Dec 2023 18:55:16 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fa7696c6f93fd243210df2e0c9a670e2
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
conqueredallrightswell.com/api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE4MzYyNjYxJnBzdD0xNzAyMzIwOTE2JnJlZmVyPWh0dHBzJTNBJTJGJTJGYTU4MzdmZjEucmlubW92aWUucGFnZXMuZGV2JTJGJnJtdGM9dCZzaHU9ZjRmYWYyMmM1MjdhN2U4NTYzMjhjZjhjNmI3YjdkMGYzZDZmY2VjYjRhMjVhMDA3ZDliZThlZDljYTM3OGM0NjNkNzU4MTVhZDQ5ZmE0OWU4ZDExNTE1MWNlMmNmODBhMjViM2MwMzY0YjQ5NDY4NGM2OWY2NmY2ZjY1N2Q0MDg2MmZlOTlkZTZkNTdmMDg5NTc1ZjdmOTM5NjBhMmY0ZGE0YWJhNzgwZTA3YzdkMzNmY2MxYWM4ODNhOWFhNWQzNzg%3D&uuid=&pii=&in=false
302 Found 0 B URL User Request GET HTTP/1.1 conqueredallrightswell.com/api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE4MzYyNjYxJnBzdD0xNzAyMzIwOTE2JnJlZmVyPWh0dHBzJTNBJTJGJTJGYTU4MzdmZjEucmlubW92aWUucGFnZXMuZGV2JTJGJnJtdGM9dCZzaHU9ZjRmYWYyMmM1MjdhN2U4NTYzMjhjZjhjNmI3YjdkMGYzZDZmY2VjYjRhMjVhMDA3ZDliZThlZDljYTM3OGM0NjNkNzU4MTVhZDQ5ZmE0OWU4ZDExNTE1MWNlMmNmODBhMjViM2MwMzY0YjQ5NDY4NGM2OWY2NmY2ZjY1N2Q0MDg2MmZlOTlkZTZkNTdmMDg5NTc1ZjdmOTM5NjBhMmY0ZGE0YWJhNzgwZTA3YzdkMzNmY2MxYWM4ODNhOWFhNWQzNzg%3D&uuid=&pii=&in=false
IP
ASN #39572 DataWeb Global Group B.V.
Certificate IssuerLet's Encrypt
Subjectconqueredallrightswell.com
Fingerprint9E:C2:75:0A:08:52:CB:97:0C:C6:54:67:5E:6F:7F:C9:D8:00:28:1C
ValidityTue, 14 Nov 2023 16:14:39 GMT - Mon, 12 Feb 2024 16:14:38 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L2R5ZmMxazA5P2tleT04NjM3MDViY2JiNGI2YTU1NGRkYjM1OTY2NTM5NWE2ZiZwc2lkPTE4MzYyNjYxJnBzdD0xNzAyMzIwOTE2JnJlZmVyPWh0dHBzJTNBJTJGJTJGYTU4MzdmZjEucmlubW92aWUucGFnZXMuZGV2JTJGJnJtdGM9dCZzaHU9ZjRmYWYyMmM1MjdhN2U4NTYzMjhjZjhjNmI3YjdkMGYzZDZmY2VjYjRhMjVhMDA3ZDliZThlZDljYTM3OGM0NjNkNzU4MTVhZDQ5ZmE0OWU4ZDExNTE1MWNlMmNmODBhMjViM2MwMzY0YjQ5NDY4NGM2OWY2NmY2ZjY1N2Q0MDg2MmZlOTlkZTZkNTdmMDg5NTc1ZjdmOTM5NjBhMmY0ZGE0YWJhNzgwZTA3YzdkMzNmY2MxYWM4ODNhOWFhNWQzNzg%3D&uuid=&pii=&in=false HTTP/1.1
Host: conqueredallrightswell.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://conqueredallrightswell.com/dyfc1k09?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=16122660
Cookie: u_pl=16122660; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNjEyMjY2MCwiayI6Ijg2MzcwNWJjYmI0YjZhNTU0ZGRiMzU5NjY1Mzk1YTZmIiwic2lkIjoiMTgzNjI2NjEiLCJpc2lkIjoyLCJhc2lkIjoxLCJ6aWQiOjE0NjQxNSwicGlkIjo5NzI5OSwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozLCJhaWQiOjI4LCJwdCI6NCwicGsiOiJkeWZjMWswOSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6ZmFsc2UsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9hNTgzN2ZmMS5yaW5tb3ZpZS5wYWdlcy5kZXYvIiwiYXIiOltdfX0.AdydLRgu3L43foGHDdY2x2dy3U6SzLOfljZsP3xwNr0; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.21.6
Date: Mon, 11 Dec 2023 18:54:17 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://adserving.unibet.com/redirect.aspx?bid=37953&pid=15135578&sref=ADST&ADST=16122660
Set-Cookie: iprcd148b1f6afd9ae23e7eb79ef57c8e62f=4798635; expires=Tue, 12 Dec 2023 18:54:17 GMT
pdhtkv=true; expires=Tue, 12 Dec 2023 18:54:17 GMT
uncs=1; expires=Tue, 12 Dec 2023 18:54:17 GMT
pdhtkv28=true; expires=Tue, 12 Dec 2023 18:54:17 GMT
uncs28=1; expires=Tue, 12 Dec 2023 18:54:17 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 81ad12f6e964d626ea4fbc58127fb77b
Strict-Transport-Security: max-age=0; includeSubdomains
adserving.unibet.com/redirect.aspx?bid=37953&pid=15135578&sref=ADST&ADST=16122660
307 Temporary Redirect 0 B URL User Request GET HTTP/2 adserving.unibet.com/redirect.aspx?bid=37953&pid=15135578&sref=ADST&ADST=16122660
IP
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Certificate IssuerTrustwave Holdings, Inc.
Subjectaffiliates.kindredplc.com
Fingerprint9C:1F:91:86:77:41:76:62:71:CD:11:FD:80:70:B7:83:58:47:BF:4F
ValidityThu, 17 Aug 2023 06:39:43 GMT - Fri, 16 Aug 2024 06:38:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect.aspx?bid=37953&pid=15135578&sref=ADST&ADST=16122660 HTTP/1.1
Host: adserving.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conqueredallrightswell.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 307 Temporary Redirect
cache-control: private,no-cache, no-store
pragma: no-cache
content-type: text/html
location: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
p3p: CP="This is not a P3P policy! It is used to bypass IEs problematic handling of cookies"
set-cookie: NetRefer_CookieUniTrack_C=%5b%7b%22PID%22%3a68246908%2c%22BID%22%3a37953%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1702320857556)%5c%2f%22%2c%22CookieTag%22%3a%223795368246908451240919C202312111854%22%7d%5d; SameSite=None;; domain=.unibet.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; secure
NetReferSPS=%5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%2210708260222%7c1%22%7d%5d; domain=.unibet.com; expires=Wed, 11-Dec-3022 18:54:17 GMT; path=/; secure; SameSite=Strict
x-aspnet-version: 4.0.30319
request-context: appId=cid-v1:83ffbda4-9458-475e-90ec-4427cfb5c3b0
access-control-expose-headers: Request-Context
x-azure-ref: 02Vp3ZQAAAAAGYsKzXQLUTYzdR4VrNiLUU1ZHMjBFREdFMDUxMQAyZDk5MzlkMy05NTUxLTQ2ZmYtOGEyNi01ZWZmY2FhMWQ5OGM=
x-cache: CONFIG_NOCACHE
date: Mon, 11 Dec 2023 18:54:17 GMT
content-length: 0
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/slots.png
200 OK 6.3 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/slots.png
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type PNG image data, 151 x 200, 8-bit/color RGBA, non-interlaced
- data
Hash 6be047bdf3d103b2414f7f6ab64d96b8
57818bdfe16383abe584b5c30de5f35eb55ebf20
38e2d3e7f261032cf0c558e28555c6425c30aa14014f31bbaad7d5176b7d4449
GET /no/pop/casino/2022/slots.png HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: image/png
content-length: 6303
cf-ray: 833fef71ee64b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 395766
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF214D12C"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: a+BHvfPRA7JBT39qtk2WuA==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: a53159bf-701e-0056-7ba2-1de3ed000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/livecasino.png
200 OK 21 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/livecasino.png
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
- data
Hash 87dc3fc9a40a9b0e8fd7c0519ac24f54
908b0ca475f8da1d0380a6cb5caabafce2466aec
a0fd031aa160b2679253c5952576a692e002c6be963c5935af3692ff50206eb4
GET /no/pop/casino/2022/livecasino.png HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: image/png
content-length: 20783
cf-ray: 833fef71ee67b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 310903
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF2032091"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: h9w/yaQKmw6P18BRmsJPVA==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: e590e529-401e-004d-2d8c-1eddee000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/mga.png
200 OK 1.5 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/mga.png
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type PNG image data, 152 x 60, 8-bit colormap, non-interlaced
- data
Hash f34e781d7ad22dc774b98ac82a2b46f6
b66cb9753b0f76a7590f62d3c6b8f645bdbae786
7898ba2cec328d50a75400c1e5a6f1f23974f4c0cc433472a24f28a82c7d01c7
GET /no/pop/casino/2022/mga.png HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: image/png
content-length: 1454
cf-ray: 833fef71ee6ab512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 50730
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF226A8C7"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: 8054HXrSLcd0uYrIKitG9g==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: b9ce90da-f01e-0077-3edc-20c796000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/games.png
200 OK 8.8 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/games.png
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type PNG image data, 234 x 200, 8-bit/color RGBA, non-interlaced
- data
Hash fbd364c184d1c2af246dd5a3079ce9ed
5c572431ced831a518e0c4adfed4372254f1eac1
2a09f891fb138e893fbc2fe522761e47307376143582e41016bf8aa54c4fdb77
GET /no/pop/casino/2022/games.png HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: image/png
content-length: 8838
cf-ray: 833fef71ee69b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 463532
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF1FBCEB0"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: +9NkwYTRwq8kbdWjB5zp7Q==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: ed2a491c-501e-006e-5f0a-1d472d000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
200 OK 956 B URL GET HTTP/2 a1s-cdn.unibet.com/unibet/bannerflow/scripts/master_tag.js
IP
ASN #47171 Unibet Services Limited
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectunibet.com
Fingerprint1A:B0:7B:63:FE:17:68:E4:1E:85:13:D5:3D:2C:46:01:FC:B2:4C:84
ValidityMon, 06 Nov 2023 00:18:08 GMT - Sun, 04 Feb 2024 00:18:07 GMT
Hash fd48e87ecd4d06d9c5df490b91dc813e
a65a437db44444634e4f41732c590c1d14433b3f
2f786ae3f4577ed970f60aa7a9edf726300a740fdb360a8364db7ff4b7ca8e47
GET /unibet/bannerflow/scripts/master_tag.js HTTP/1.1
Host: a1s-cdn.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: application/javascript
content-length: 956
last-modified: Mon, 25 Apr 2022 12:19:34 GMT
etag: "3bc-5dd7996cc0ce1"
cache-control: max-age=1800, public, must-revalidate
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s-cdn.unibet.com; Path=/; SameSite=None; Secure
accept-ranges: bytes
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js
200 OK 44 kB URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File type exported SGML document, ASCII text, with very long lines (32764)
Hash bf8d7656a2457e257e3cf75a01e6a4b7
7c7835b4632ac21ddea281bd2454e4faf08f0ff7
e2992637a3fd258ae2bd64fb199a77155aed36554a4bed9e34ce1bc2958ada1d
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/satelliteLib-81fa49b12f4903c5e2b79397db5965ace0d8bfac.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "bf8d7656a2457e257e3cf75a01e6a4b7:1554112914"
last-modified: Mon, 01 Apr 2019 10:01:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
content-length: 43737
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
200 OK 30 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint10:D0:ED:9A:F4:53:C8:99:DE:B6:5E:5C:04:E6:20:0B:68:7D:46:EC
ValidityMon, 20 Nov 2023 08:08:50 GMT - Mon, 12 Feb 2024 08:08:49 GMT
File type ASCII text, with very long lines (32030)
Hash e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30244
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:57:26 GMT
expires: Fri, 06 Dec 2024 15:57:26 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 356212
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
service.maxymiser.net/cdn/unibet/js/mmcore.js
404 Not Found 10 B URL GET HTTP/2 service.maxymiser.net/cdn/unibet/js/mmcore.js
IP
ASN #20940 Akamai International B.V.
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subject*.maxymiser.net
Fingerprint64:BD:DC:A7:97:53:6E:10:E5:25:0D:F4:A1:AF:7E:26:8B:AC:DD:88
ValidityMon, 27 Nov 2023 00:00:00 GMT - Wed, 27 Nov 2024 23:59:59 GMT
Hash 7605968e79d0ca095ab1231486d2b814
a007b420d19ceefa840f0373e050e3b51a4ab480
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
GET /cdn/unibet/js/mmcore.js HTTP/1.1
Host: service.maxymiser.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
accept-ranges: bytes
content-length: 10
server: AkamaiNetStorage
cache-control: max-age=1800
date: Mon, 11 Dec 2023 18:54:18 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/styles.css
200 OK 3.7 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/styles.css
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
Hash 9c7198fae65fdd565a2016879123ca09
e8a4caac57eef46c656b9ce1aeb9067f470baa32
fc67c9b12d5fa444ce772f52e859f6b3388d20adaf2907762eaf5cff4575f918
GET /no/pop/casino/2022/styles.css HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: text/css; charset=utf-8
cf-ray: 833fef71de52b512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 203635
cache-control: public, max-age=900, immutable
etag: W/"0x8DBB47DF17A7D2B"
last-modified: Wed, 13 Sep 2023 17:22:01 GMT
vary: Accept-Encoding
content-md5: nHGY+uZf3VZaIBaHkSPKCQ==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 17bf22a3-501e-006e-7067-1f472d000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
200 OK 13 kB URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (558)
Hash 18eab16a639a4773572307713440a929
75bd72f7058b2d1d3ede541b2129267b438a73d4
358c5899627cc60f849ddc6860c01aa67b122f478e0d4ef42efd48a4b38c305b
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/dil-contents-4493d5fc39a384609f7eab6df1c4aef4ab6b834d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "18eab16a639a4773572307713440a929:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
content-length: 12666
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
service.maxymiser.net/cdn/unibet/js/mmcore.js
404 Not Found 10 B URL GET HTTP/2 service.maxymiser.net/cdn/unibet/js/mmcore.js
IP
ASN #20940 Akamai International B.V.
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subject*.maxymiser.net
Fingerprint64:BD:DC:A7:97:53:6E:10:E5:25:0D:F4:A1:AF:7E:26:8B:AC:DD:88
ValidityMon, 27 Nov 2023 00:00:00 GMT - Wed, 27 Nov 2024 23:59:59 GMT
Hash 7605968e79d0ca095ab1231486d2b814
a007b420d19ceefa840f0373e050e3b51a4ab480
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
GET /cdn/unibet/js/mmcore.js HTTP/1.1
Host: service.maxymiser.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
accept-ranges: bytes
content-length: 10
server: AkamaiNetStorage
cache-control: max-age=1800
date: Mon, 11 Dec 2023 18:54:18 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/BlenderPro-ThinWeb.woff
200 OK 50 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/BlenderPro-ThinWeb.woff
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type Web Open Font Format, TrueType, length 49636, version 3.6
- data
Hash 37ba84aebad11c2e0acd496eedb0bb76
42942446e1cfab8d0eaf7d23899203b2b2b64fe7
2d7cc2c9c9fef717010fcfa8fa6518079eaec1e63975a74b4fb78afb14d6ee5e
GET /no/pop/casino/2022/BlenderPro-ThinWeb.woff HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/styles.css
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: application/font-woff
content-length: 49636
cf-ray: 833fef7499f5b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 23105
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF1CAB3F7"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: N7qErrrRHC4KzUlu7bC7dg==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 822ab976-c01e-000e-6f2c-213bb2000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/BlenderPro-MediumWeb.woff
200 OK 49 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/BlenderPro-MediumWeb.woff
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type Web Open Font Format, TrueType, length 48766, version 3.6
- data
Hash f62793caeb7e5b111d7508b00c0826c2
d003c52a07685156de00186014c777b7dde81573
bac888a26184354a6038eb4ba3d87fdc3315c6e7fe0c19ec7cd1737f1720fc5a
GET /no/pop/casino/2022/BlenderPro-MediumWeb.woff HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/styles.css
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: application/font-woff
content-length: 48766
cf-ray: 833fef74aa05b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 511100
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF1B5CF8B"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: 9ieTyut+WxEddQiwDAgmwg==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: f6f9f935-601e-0028-523d-2273aa000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
200 OK 162 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,500,700,900
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint10:D0:ED:9A:F4:53:C8:99:DE:B6:5E:5C:04:E6:20:0B:68:7D:46:EC
ValidityMon, 20 Nov 2023 08:08:50 GMT - Mon, 12 Feb 2024 08:08:49 GMT
File type gzip compressed data, max compression
- data
Size 162 kB (162370 bytes)
Hash 979572322268a05b39df28493ed2944a
b475593caf7aa1b0c4776e2a9ab2734295f93784
efac4c8e3318633089f30ad1d20c63e3ea5e52e938006d435d1c488b4be23634
GET /css?family=Roboto:300,400,500,700,900 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 11 Dec 2023 18:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
200 OK 30 kB URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (543)
Hash 9c4992909a83d52617e9948d1d1c4141
587bbaea138857f086b03f43120795332fe28523
b53ed597b15301969858b376e9946d1664eff3a03549485ea678e9b8c6deaf63
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/s-code-contents-dcbd0d7722c067386a5d09d13c84aaf7196c1b0d.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "9c4992909a83d52617e9948d1d1c4141:1554112914"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 29629
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
200 OK 67 kB URL GET HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-PF2RVHC
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintC1:58:7C:BF:5A:61:79:08:CB:C2:00:63:60:07:86:BD:EA:0A:45:8A
ValidityMon, 20 Nov 2023 08:02:50 GMT - Mon, 12 Feb 2024 08:02:49 GMT
File type ASCII text, with very long lines (25136)
Hash c4a90a8707fc7316f2b36f2fd89d0112
f170d1dbf593b7d2ed8788d4b55c7edf264174fc
4b802b8abe5c941d207595834637ede6d5263405da52b8e089332d003aa8eaaf
GET /gtm.js?id=GTM-PF2RVHC HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 11 Dec 2023 18:54:18 GMT
expires: Mon, 11 Dec 2023 18:54:18 GMT
cache-control: private, max-age=900
last-modified: Mon, 11 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 67321
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
200 OK 1.2 kB URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (502)
Hash 5e8dc588959123c3ee5de9ac168d5c74
a9aed3325d14a8af844706025abbf7076c2d6df8
8bc787ce4fbc3bec820a859ce9a02388d9b923d06227c5614ea771a62ad05dec
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-580f0b8764746d390100a183.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "5e8dc588959123c3ee5de9ac168d5c74:1554112912"
last-modified: Mon, 01 Apr 2019 10:01:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1199
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 04 Dec 2023 23:43:03 GMT
expires: Tue, 03 Dec 2024 23:43:03 GMT
cache-control: public, max-age=31536000
age: 587475
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0
- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 05:05:31 GMT
expires: Fri, 06 Dec 2024 05:05:31 GMT
cache-control: public, max-age=31536000
age: 395327
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://welcome.mariacasino.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 04:53:07 GMT
expires: Fri, 06 Dec 2024 04:53:07 GMT
cache-control: public, max-age=31536000
age: 396071
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
200 OK 1.4 kB URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
Hash 6444bceb1b767bea75b4f47d793f7b05
173a21cbce9a9c8b73088df59efa6049690a9cbb
7386df477cd87905ec5e618f0d3df193963ec801ff64404cc5023529b16c4d6f
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b20e4d164746d3e0d0043fb.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "6444bceb1b767bea75b4f47d793f7b05:1554112917"
last-modified: Mon, 01 Apr 2019 10:01:57 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
content-length: 1388
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/main.js
200 OK 20 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/main.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /no/pop/casino/2022/main.js HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: application/javascript; charset=utf-8
cf-ray: 833fef71ee5fb512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 53303
cache-control: public, max-age=900, immutable
etag: W/"0x8DBB47DF21F2FDA"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: HUKMSjGdEVR6I7ylcruk3g==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: f441e222-a01e-0018-38dc-20cd65000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
a1s.unibet.com/orval/tracking/lastclick.min.js
200 OK 1.8 kB URL GET HTTP/2 a1s.unibet.com/orval/tracking/lastclick.min.js
IP
ASN #47171 Unibet Services Limited
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectunibet.com
Fingerprint1A:B0:7B:63:FE:17:68:E4:1E:85:13:D5:3D:2C:46:01:FC:B2:4C:84
ValidityMon, 06 Nov 2023 00:18:08 GMT - Sun, 04 Feb 2024 00:18:07 GMT
File type ASCII text, with very long lines (1881), with no line terminators
Hash 695e4c30089ed5d35b5096257b69bbec
64897f4cdac1a6e4f5d6ed9dcb8b246e3b942841
40fab43e8fa29c9c648a5d56139fe8c35b1fbfb5c826d2fd58c4ceec7a548206
GET /orval/tracking/lastclick.min.js HTTP/1.1
Host: a1s.unibet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 05 Aug 2022 12:55:24 GMT
etag: W/"705-5e57dfac7ede0"
cache-control: max-age=1800, public, must-revalidate
content-encoding: gzip
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=polopoly_desktop; Domain=a1s.unibet.com; Path=/; SameSite=None; Secure
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/background.jpg
200 OK 162 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/background.jpg
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x800, components 3
- data
Size 162 kB (161606 bytes)
Hash aa279ee357b415f50a16127d5c1a7c4d
d1375a6cb87e60f31f609769044af9e6d47775cd
6aa6656d951b443674e2795a2174f6ba5fa711a0f2943830eab9f07cb1e1a809
GET /no/pop/casino/2022/background.jpg HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/styles.css
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: image/jpeg
content-length: 161606
cf-ray: 833fef7499d7b512-OSL
cf-cache-status: HIT
accept-ranges: bytes
access-control-allow-origin: *
age: 352306
cache-control: public, max-age=900, immutable
etag: "0x8DBB47DF1D5AECE"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: qiee41e0FfUKFhJ9XBp8TQ==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 944433a8-a01e-0018-43ae-23cd65000000
x-ms-version: 2014-02-14
server: cloudflare
X-Firefox-Spdy: h2
www.mariacasino.com/kindred_snow/s3.7.0/kindred_s.js
200 OK 74 kB URL GET HTTP/2 www.mariacasino.com/kindred_snow/s3.7.0/kindred_s.js
IP
ASN #47171 Unibet Services Limited
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectmariacasino.com
FingerprintD0:21:61:EE:74:5D:D8:D6:F1:19:F9:4E:33:FA:54:88:64:BF:99:CB
ValidityMon, 06 Nov 2023 00:11:24 GMT - Sun, 04 Feb 2024 00:11:23 GMT
File type ASCII text, with very long lines (65378)
Hash 3fb00dbb8acb3c68fd5ddb674f22bb88
cf7bc4f71f0ff66037ac2e564963ff4c2737e766
7d3d84e73da67922341950d1542a5a5da2420ea18026e314a9aec22f631e4246
GET /kindred_snow/s3.7.0/kindred_s.js HTTP/1.1
Host: www.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1; uniattr=BLP.1.UT; uniattr_ref="https://conqueredallrightswell.com/"
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: application/javascript
last-modified: Mon, 11 Dec 2023 16:08:44 GMT
vary: Accept-Encoding
etag: W/"6577340c-12240"
server: kindred-loadbalancer
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' http: https: data: wss: blob: jockey: unibetpro: *;
x-browser-class: A
x-os-class: M
set-cookie: clientId=browser_desktop; Domain=www.mariacasino.com; Path=/; SameSite=None; Secure
content-encoding: gzip
X-Firefox-Spdy: h2
assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
200 OK 567 B URL GET HTTP/2 assets.adobedtm.com/2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerDigiCert Inc
Subjectassets.adobedtm.com
Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (609), with no line terminators
Hash 7d599073b2f037a8e2a2881467e8fbb4
3e78ffb423be83e492234206fa2572fa7914c62e
f6f4898ab1ed11593c3beef926c56a6ef4351d2d43f8ab431ae26bb2353b74cc
GET /2ba9756ce24e85b6613a5e44df81f3a5de8f7320/scripts/satellite-5b0e7d5264746d144c000221.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "accfdd9d5be1d7142fabad440365d15f:1554112916"
last-modified: Mon, 01 Apr 2019 10:01:56 GMT
server: AkamaiNetStorage
content-length: 567
cache-control: max-age=3600
expires: Mon, 11 Dec 2023 19:54:18 GMT
date: Mon, 11 Dec 2023 18:54:18 GMT
access-control-allow-origin: https://welcome.mariacasino.com
timing-allow-origin: *
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/no-payments.svg
200 OK 25 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/no-payments.svg
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type SVG Scalable Vector Graphics image
- XML 1.0 document text
- XML document text
- HTML document text
- exported SGML document, ASCII text
Hash 7857f5fa35651d9795bac512238caaf4
107c2b86078dd49ffd18c76724bd290018719037
bf1b321fe365e6fdb5429bcebb8a6b5b9ed554d84f4eced5e69cc31038455a81
GET /no/pop/casino/2022/no-payments.svg HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: image/svg+xml
cf-ray: 833fef754ad3b512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 142238
cache-control: public, max-age=900, immutable
etag: W/"0x8DBB47DF243F062"
last-modified: Wed, 13 Sep 2023 17:22:03 GMT
vary: Accept-Encoding
content-md5: eFf1+jVlHZeVusUSI4yq9A==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 1cdcd5fb-701e-0024-5107-20e4a2000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/favicon.ico
200 OK 4.3 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/favicon.ico
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
- data
Hash 75467aea7c9ef09112d57da712792f1c
2fd85767a73ad15745af9ae26f51edae5cf431bf
b65996d71ae18fdc3744b16a5fc11a00e625af41b3506ec798a8e62c2d80dabb
GET /no/pop/casino/2022/favicon.ico HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7; AMCV_F431E3BC5593E3887F000101%40AdobeOrg=-306458230%7CMCIDTS%7C19703%7CMCMID%7C32711163271024598804861815783711195200%7CMCAID%7CNONE%7CMCOPTOUT-1702328058s%7CNONE%7CvVersion%7C3.2.0; sat_track=true; AMCVS_F431E3BC5593E3887F000101%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:18 GMT
content-type: image/x-icon
cf-ray: 833fef760b9fb512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 436087
cache-control: public, max-age=900, immutable
etag: W/"0x8DBB47DF1F3E0A4"
last-modified: Wed, 13 Sep 2023 17:22:02 GMT
vary: Accept-Encoding
content-md5: dUZ66nye8JES1X2nEnkvHA==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: d68afac7-501e-0041-1361-1d4ae6000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
200 OK 10 kB URL User Request GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
IP
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953 HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conqueredallrightswell.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: text/html; charset=utf-8
cf-ray: 833fef704c32b512-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: public, max-age=900, immutable
last-modified: Wed, 13 Sep 2023 17:22:01 GMT
vary: Accept-Encoding
content-md5: 195t/EFQHfrEDazau7jk+g==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 86f4fb35-201e-004b-0363-2cee51000000
x-ms-version: 2014-02-14
set-cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7;max-age=2592000; domain=.mariacasino.com;path=/;secure;samesite=none;httponly
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.com/no/pop/casino/2022/maria-logo.svg
200 OK 3.5 kB URL GET HTTP/2 welcome.mariacasino.com/no/pop/casino/2022/maria-logo.svg
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type SVG Scalable Vector Graphics image
- XML document text
- HTML document text
- HTML document text
- exported SGML document, ASCII text, with very long lines (3630), with no line terminators
Hash c555f8d5d6661a5a58353a9cbfd5c558
452c5c7b45b1f8e7e420cdf99d00b517ba17bec8
0af04359175453424d6552e534a91df0099dd7852f2f37025ab96d4778bd16f6
GET /no/pop/casino/2022/maria-logo.svg HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: image/svg+xml
cf-ray: 833fef71ee62b512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 576004
cache-control: public, max-age=900, immutable
etag: W/"0x8DBB47DF193CDB8"
last-modified: Wed, 13 Sep 2023 17:22:01 GMT
vary: Accept-Encoding
content-md5: A/evXSZJMSEi63VEXU58wA==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 6ac808b1-901e-004e-74a6-213c8a000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
welcome.mariacasino.com/custom.js
200 OK 2.3 kB URL GET HTTP/2 welcome.mariacasino.com/custom.js
IP
Requested by https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Certificate IssuerLet's Encrypt
Subjectwelcome.mariacasino.com
Fingerprint40:A0:00:26:41:7A:12:6B:FE:71:F7:E2:B2:55:EC:BB:B2:54:58:93
ValidityMon, 30 Oct 2023 18:15:52 GMT - Sun, 28 Jan 2024 18:15:51 GMT
File type ASCII text, with very long lines (2416), with no line terminators
Hash 6d84cf4089d69c6b618359f8aa3cb9db
7945de767b93fa8eff0e682ffda4350cc3ffbdc9
eda1841e3405aa581a877dd0d100e2ae14726f99d02a5d41788de0a08c5bdcc2
GET /custom.js HTTP/1.1
Host: welcome.mariacasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://welcome.mariacasino.com/no/pop/casino/2022/index.html?ch=affiliate&sub_ch=affiliate&campaignId=2856772&btag=127656177_9FC17AFE7C934C278F69BED8583D75E7&sref=ADST&ADST=16122660&affiliateId=1&pid=68246908&bid=37953
Cookie: btag=127656177_9FC17AFE7C934C278F69BED8583D75E7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 11 Dec 2023 18:54:17 GMT
content-type: application/javascript
cf-ray: 833fef71ee60b512-OSL
cf-cache-status: HIT
access-control-allow-origin: *
age: 309152
etag: W/"0x8DA42DC14A64A3D"
last-modified: Tue, 31 May 2022 08:03:43 GMT
vary: Accept-Encoding
content-md5: AaOIILzruhXFCZo/dsUAMw==
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: b7a3ce13-c01e-0031-74b0-1cf311000000
x-ms-version: 2014-02-14
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2
188.114.97.1
142.250.74.138
85.184.96.5
52.58.59.63
104.18.43.104
23.38.200.237
0.0.0.0