Overview

URLmonthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962/
IP 54.161.16.68 (United States)
ASN#14618 AMAZON-AES
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-11-25 22:13:37 UTC
StatusLoading report..
IDS alerts0
Blocklist alert6
urlquery alerts No alerts detected
Tags None

Domain Summary (35)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
firefox.settings.services.mozilla.com (2) 867 No data No data 34.102.187.140
ldsapi.tmginteractive.com (4) 85617 No data No data 209.151.244.116
api.trustedform.com (2) 23021 No data No data 52.54.243.114
monthlysweeps.us (14) 0 No data No data 54.161.16.68 Unknown ranking
ocsp.sca1b.amazontrust.com (5) 1015 No data No data 143.204.42.165
img-getpocket.cdn.mozilla.net (6) 1631 No data No data 34.120.237.76
www.google-analytics.com (1) 40 No data No data 142.250.74.174
cdn.trustedform.com (2) 24659 No data No data 54.230.111.111
pbid.pro-market.net (1) 6233 No data No data 107.178.240.89
code.jquery.com (1) 634 No data No data 69.16.175.10
script.hotjar.com (1) 887 No data No data 143.204.55.68
vars.hotjar.com (1) 1014 No data No data 143.204.55.105
ocsp.digicert.com (8) 86 No data No data 93.184.220.29
ocsp.pki.goog (10) 175 No data No data 142.250.74.35
ads.pro-market.net (1) 47212 No data No data 23.36.76.115
www.gstatic.com (1) 0 No data No data 142.250.74.163 Domain (gstatic.com) ranked at: 540
create.leadid.com (3) 14598 No data No data 50.16.132.247
in.hotjar.com (1) 1746 No data No data 54.171.136.239
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
cdnjs.cloudflare.com (2) 235 No data No data 104.17.25.14
push.services.mozilla.com (1) 2140 No data No data 54.69.181.45
fonts.gstatic.com (5) 0 No data No data 216.58.207.195 Domain (gstatic.com) ranked at: 540
ocsp.sectigo.com (1) 487 No data No data 104.18.32.68
tmgassets.azureedge.net (10) 0 No data No data 13.107.219.53 Domain (azureedge.net) ranked at: 2986
cdn.jsdelivr.net (1) 439 No data No data 151.101.85.229
use.fontawesome.com (3) 942 No data No data 172.64.132.15
d2m2wsoho8qq12.cloudfront.net (1) 0 No data No data 143.204.42.229 Unknown ranking
r3.o.lencr.org (5) 344 No data No data 23.36.76.226
www.google.com (1) 7 No data No data 142.250.74.164
ocsp.usertrust.com (1) 899 No data No data 104.18.32.68
stackpath.bootstrapcdn.com (2) 2467 No data No data 104.18.11.207
contile.services.mozilla.com (1) 1114 No data No data 34.117.237.239
ocsp.globalsign.com (1) 2075 No data No data 104.18.21.226
static.hotjar.com (1) 641 No data No data 143.204.55.54
fonts.googleapis.com (1) 8877 No data No data 142.250.74.10

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-11-25 2 monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/1694 (...) Phishing
2022-11-25 2 monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/1694 (...) Phishing
2022-11-25 2 monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/1694 (...) Phishing
2022-11-25 2 monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/1694 (...) Phishing
2022-11-25 2 monthlysweeps.us/assets/js/datepicker.js Phishing
2022-11-25 2 monthlysweeps.us/go/api/zip/undefined?get_param=value Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 54.161.16.68
Date UQ / IDS / BL URL IP
2023-01-06 09:19:01 +0000 0 - 0 - 6 smoothreward.com/go/to/f388f2/key/2b81b678a4e (...) 54.161.16.68
2023-01-06 09:11:50 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/cdd777f9ae8 (...) 54.161.16.68
2023-01-06 09:11:22 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/9cd0dfd52a6 (...) 54.161.16.68
2023-01-06 09:11:17 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/9cd0dfd52a6 (...) 54.161.16.68
2023-01-06 09:11:16 +0000 0 - 0 - 6 monthlysweeps.us/go/to/59bdf0/key/5cbf043f03f (...) 54.161.16.68


Last 5 reports on ASN: AMAZON-AES
Date UQ / IDS / BL URL IP
2023-02-07 11:37:52 +0000 0 - 2 - 4 internal-sulfuric-camp.glitch.me/motoredx.html 54.226.70.29
2023-02-07 11:37:40 +0000 0 - 4 - 4 remarkable-polished-territory.glitch.me/oplur (...) 54.164.77.181
2023-02-07 11:36:02 +0000 0 - 0 - 1 host.bricoweb.org/agri.zip 52.54.60.165
2023-02-07 11:24:10 +0000 0 - 0 - 0 quora.com 54.243.204.28
2023-02-07 10:54:29 +0000 0 - 2 - 0 t.e2ma.net/click/nwr7r2/3g6gqhgb/rjwd7vl 107.21.35.30


Last 5 reports on domain: monthlysweeps.us
Date UQ / IDS / BL URL IP
2023-02-06 21:11:00 +0000 0 - 0 - 3 monthlysweeps.us/go/to/cabunn/key/4c0aa3ee841 (...) 3.212.250.95
2023-02-06 18:55:48 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:46 +0000 0 - 0 - 4 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:55:29 +0000 0 - 0 - 6 monthlysweeps.us/go/to/4mmjuy/key/43d3d9625c0 (...) 3.212.250.95
2023-02-06 18:52:39 +0000 0 - 0 - 6 monthlysweeps.us/go/to/59bdf0/key/30c958ae038 (...) 107.23.100.94


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-14 11:27:04 +0000 0 - 0 - 6 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 107.23.100.94
2023-01-14 11:27:03 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 107.23.100.94
2023-01-14 11:27:00 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/26890888a28 (...) 3.212.250.95
2023-01-13 11:17:20 +0000 0 - 0 - 6 monthlysweeps.us/go/to/ss28jn/key/9c9c2fa157c (...) 107.23.100.94
2023-01-13 11:17:18 +0000 0 - 0 - 4 monthlysweeps.us/go/to/ss28jn/key/9c9c2fa157c (...) 107.23.100.94

JavaScript

Executed Scripts (46)

Executed Evals (9)
#1 JavaScript::Eval (size: 15565) - SHA256: 1f18d938a27693ef85cb1dc556affd9efeab304812ad54bc5fcede37c4cd13ab
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var Z = function(Y, L) {
            if (!(L = (Y = null, e.trustedTypes), L) || !L.createPolicy) return Y;
            try {
                Y = L.createPolicy("bg", {
                    createHTML: d,
                    createScript: d,
                    createScriptURL: d
                })
            } catch (h) {
                e.console && e.console.error(h.message)
            }
            return Y
        },
        d = function(Y) {
            return Y
        },
        e = this || self;
    (0, eval)(function(Y, L) {
        return (L = Z()) && 1 === Y.eval(L.createScript("1")) ? function(h) {
            return L.createScript(h)
        } : function(h) {
            return "" + h
        }
    }(e)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var YM=function(L,h,Y){if(3==L.length){for(Y=0;3>Y;Y++)h[Y]+=L[Y];for(Y=(L=[13,8,13,12,16,5,3,10,15],0);9>Y;Y++)h[3](h,Y%3,L[Y])}},od=function(L,h){(L.Mx.push(L.L.slice()),L).L[471]=void 0,V(471,L,h)},Lo=function(L,h){return(h=l(L),h)&128&&(h=h&127|l(L)<<7),h},K=function(L,h,Y,d,H,e){if(!Y.g){if((L=I(Y,((h=(e=I(((H=void 0,L&&L[0]===O)&&(h=L[1],H=L[2],L=void 0),Y),40),0==e.length&&(d=I(Y,140)>>3,e.push(h,d>>8&255,d&255),void 0!=H&&e.push(H&255)),""),L)&&(L.message&&(h+=L.message),L.stack&&(h+=":"+L.stack)),322)),3)<L){Y.K=(h=(L-=(h=h.slice(0,(L|0)-3),(h.length|0)+3),hk(h)),H=Y.K,Y);try{r(Y,w(h.length,2).concat(h),54,9)}finally{Y.K=H}}V(322,Y,L)}},r=function(L,h,Y,d,H,e){if(L.K==L)for(H=I(L,Y),54==Y?(Y=function(Z,g,n,k,N){if(k=((g=H.length,g)|0)-4>>3,H.Nx!=k){H.Nx=(N=[0,0,e[1],e[2]],n=(k<<3)-4,k);try{H.I6=ew(ds(H,n),N,ds(H,(n|0)+4))}catch(W){throw W;}}H.push(H.I6[g&7]^Z)},e=I(L,374)):Y=function(Z){H.push(Z)},d&&Y(d&255),L=h.length,d=0;d<L;d++)Y(h[d])},gs=function(L,h,Y,d,H,e){for(H=(h=D((Y=(((d=L[Zm]||{},e=D(L),d).LU=D(L),d).i=[],L.K==L)?(l(L)|0)-1:1,L)),0);H<Y;H++)d.i.push(D(L));for((d.l=I(L,e),d).KU=I(L,h);Y--;)d.i[Y]=I(L,d.i[Y]);return d},X=function(L,h){for(h=[];L--;)h.push(255*Math.random()|0);return h},u=function(L,h,Y){Y=this;try{no(L,h,this)}catch(d){G(this,d),L(function(H){H(Y.S)})}},ew=function(L,h,Y,d,H){for(h=(d=(H=0,h[3]|0),h)[2]|0;14>H;H++)d=d>>>8|d<<24,Y=Y>>>8|Y<<24,Y+=L|0,L=L<<3|L>>>29,Y^=h+3039,d+=h|0,h=h<<3|h>>>29,L^=Y,d^=H+3039,h^=d;return[L>>>24&255,L>>>16&255,L>>>8&255,L>>>0&255,Y>>>24&255,Y>>>16&255,Y>>>8&255,Y>>>0&255]},sT=function(L,h,Y,d,H){if(d=h[0],d==x)L.G=25,L.V(h);else if(d==F){Y=h[1];try{H=L.S||L.V(h)}catch(e){G(L,e),H=L.S}Y(H)}else if(d==kM)L.V(h);else if(d==A)L.V(h);else if(d==V6){try{for(H=0;H<L.v.length;H++)try{Y=L.v[H],Y[0][Y[1]](Y[2])}catch(e){}}catch(e){}(0,h[L.v=[],1])(function(e,Z){L.H(e,true,Z)},function(e){(p([(e=!L.R.length,lz)],L),e)&&T(L,true,false)})}else{if(d==E)return H=h[2],V(228,L,h[6]),V(252,L,H),L.V(h);d==lz?(L.L=null,L.Z=[],L.J=[]):d==OT&&"loading"===y.document.readyState&&(L.j=function(e,Z){function g(){Z||(Z=true,e())}y.document.addEventListener("DOMContentLoaded",g,(Z=false,a)),y.addEventListener("load",g,a)})}},Id=function(L,h,Y,d){function H(){}return Y=Ne(L,function(e){H&&(h&&P(h),d=e,H(),H=void 0)},(d=void 0,!!h))[0],{invoke:function(e,Z,g,n){function k(){d(function(N){P(function(){e(N)})},g)}if(!Z)return Z=Y(g),e&&e(Z),Z;d?k():(n=H,H=function(){(n(),P)(k)})}}},b,V=function(L,h,Y){if(471==L||140==L)h.L[L]?h.L[L].concat(Y):h.L[L]=WE(h,Y);else{if(h.g&&2!=L)return;255==L||54==L||38==L||40==L||374==L?h.L[L]||(h.L[L]=fo(h,94,Y,L)):h.L[L]=fo(h,121,Y,L)}2==L&&(h.Y=J(false,h,32),h.P=void 0)},no=function(L,h,Y,d,H){for(d=(Y.nU=(Y.pU=BE(Y.I,{get:(Y.FI=(Y.VQ=rs,Y[F]),Y.Wd=qe,function(){return this.concat()})}),c)[Y.I](Y.pU,{value:{value:{}}}),0),H=[];292>d;d++)H[d]=String.fromCharCode(d);T(Y,(p([(p([(p((V(166,((m(301,Y,(m(132,Y,(m(317,Y,(Y.z$=((V(41,((m(93,(V(54,(m(312,Y,(V((V(38,(V(252,Y,(V(400,(m(239,(m(351,Y,(V(40,(m(52,(m(298,(m(314,(m(438,(m(21,Y,(m(104,Y,(m(428,Y,(m(146,((m(19,(m(253,(m(64,Y,(Y.eL=(m(((m(185,(m(83,(m(336,(V(232,Y,(V(255,Y,[(m(230,(V(140,(V(471,Y,((Y.u=0,Y).yQ=(d=((Y.Z=[],Y).o=(Y.j=null,(Y.S=void 0,Y).v=(Y.Mx=[],Y.W=(Y.ZK=0,Y.h=0,(Y.P=((Y.O=0,Y).g=false,void 0),Y.J=[],Y).T=(Y.D=0,void 0),Y.SL=(Y.X=void 0,!(Y.G=25,1)),void 0),Y.U=0,Y.L=[],Y.B=void 0,Y.N=0,Y.s=8001,[]),Y.A=1,(Y.Y=void 0,Y).R=(Y.K=Y,[]),Y.R6=function(e){this.K=e},false),window.performance)||{},d.timeOrigin||(d.timing||{}).navigationStart)||0,0)),Y),0),Y),function(e,Z,g,n,k){V((n=I(e,(k=I(e,(Z=(n=D((k=D((Z=D((g=D(e),e)),e)),e)),I(e,Z)),k)),n)),g),e,Ko(n,k,e,Z))}),160),0,0]),0)),Y),function(e,Z,g,n,k,N,W){for(n=(N=(g=Lo((W=D(e),e)),Z="",k=I(e,217),k).length,0);g--;)n=((n|0)+(Lo(e)|0))%N,Z+=H[k[n]];V(W,e,Z)}),Y),function(e,Z,g,n){V((n=I(e,(Z=(g=(n=D((Z=D(e),e)),D(e)),I)(e,Z),n)),g),e,+(Z==n))}),m(120,Y,function(e,Z,g,n){!v(Z,true,e,false)&&(Z=gs(e),n=Z.l,g=Z.KU,e.K==e||n==e.R6&&g==e)&&(V(Z.LU,e,n.apply(g,Z.i)),e.h=e.F())}),Y),function(e,Z,g,n){if(Z=e.Mx.pop()){for(g=l(e);0<g;g--)n=D(e),Z[n]=e.L[n];(Z[40]=e.L[40],Z[322]=e.L[322],e).L=Z}else V(471,e,e.N)}),m)(418,Y,function(e){Dm(e,3)}),445),Y,function(e,Z,g,n){V((n=I(e,(Z=(g=(Z=D(e),D(e)),I)(e,Z),g)),g),e,n+Z)}),0),function(e,Z,g){V((g=I((Z=(g=D(e),D(e)),e),g),g=iz(g),Z),e,g)})),Y),function(e,Z,g,n){V((Z=(g=l((n=D(e),e)),D(e)),Z),e,I(e,n)>>>g)}),Y),function(e,Z){od((Z=I(e,D(e)),e).K,Z)}),m)(410,Y,function(e,Z){(e=I((Z=D(e),e).K,Z),e[0]).removeEventListener(e[1],e[2],a)}),Y),function(e,Z,g){(Z=I((Z=(g=D(e),D(e)),e),Z),0!=I(e,g))&&V(471,e,Z)}),function(e,Z,g){(g=(Z=D(e),D(e)),V)(g,e,""+I(e,Z))})),function(e,Z,g,n){n=(g=I(e,(Z=(g=D((n=D(e),e)),D)(e),g)),I(e,n)),V(Z,e,n in g|0)})),function(e,Z,g,n,k){(g=(k=D((n=D(e),e)),D(e)),e.K==e)&&(k=I(e,k),Z=I(e,n),g=I(e,g),Z[k]=g,2==n&&(e.P=void 0,2==k&&(e.Y=J(false,e,32),e.P=void 0)))})),Y),function(e,Z,g,n,k,N){v(Z,true,e,false)||(k=gs(e.K),g=k.l,n=k.KU,Z=k.LU,k=k.i,N=k.length,g=0==N?new n[g]:1==N?new n[g](k[0]):2==N?new n[g](k[0],k[1]):3==N?new n[g](k[0],k[1],k[2]):4==N?new n[g](k[0],k[1],k[2],k[3]):2(),V(Z,e,g))}),m(441,Y,function(){}),Y),function(e,Z,g,n){V((g=I(e,(n=(g=D(e),D(e)),Z=D(e),n=I(e,n),g)),Z),e,g[n])}),Y),function(e,Z,g,n,k){0!==(Z=I((k=I((n=(k=(n=D((Z=D(e),e)),D(e)),g=D(e),I)(e,n),e),k),e.K),Z),g=I(e,g),Z)&&(g=Ko(1,g,e,k,Z,n),Z.addEventListener(n,g,a),V(232,e,[Z,n,g]))}),Y),function(e){UT(1,e)}),Y),[]),function(e,Z,g,n){g=D((n=D((Z=D(e),e)),e)),V(g,e,I(e,Z)||I(e,n))})),Y),function(e,Z,g,n,k){for(n=Lo((Z=D(e),e)),g=[],k=0;k<n;k++)g.push(l(e));V(Z,e,g)}),Y),0),{})),Y),[]),322),Y,2048),function(e){Sw(4,e)})),Y),X(4)),Y),function(e,Z,g,n,k,N){if(!v(Z,true,e,true)){if(e=I((n=I((N=(N=(Z=D((g=D((n=D(e),e)),e)),D(e)),Z=I(e,Z),I(e,N)),e),n),e),g),"object"==iz(n)){for(k in g=[],n)g.push(k);n=g}for(g=(Z=(k=0,0<Z?Z:1),n.length);k<g;k+=Z)e(n.slice(k,(k|0)+(Z|0)),N)}}),Y).hv=0,Y),y),m)(407,Y,function(e,Z,g){v(Z,true,e,false)||(Z=D(e),g=D(e),V(g,e,function(n){return eval(n)}(ws(I(e.K,Z)))))}),0),function(e){UT(4,e)})),function(e,Z,g,n,k,N,W,f,B,S,q,t){function R(U,C){for(;n<U;)B|=l(e)<<n,n+=8;return B>>=(C=B&((n-=U,1)<<U)-1,U),C}for(W=k=(f=(S=(Z=(n=(t=D(e),B=0),(R(3)|0)+1),R(5)),[]),0);k<S;k++)q=R(1),f.push(q),W+=q?0:1;for(W=(k=((W|0)-1).toString(2).length,0),N=[];W<S;W++)f[W]||(N[W]=R(k));for(k=0;k<S;k++)f[k]&&(N[k]=D(e));for(g=[];Z--;)g.push(I(e,D(e)));m(t,e,function(U,C,M,HE,z){for(HE=(C=(M=0,[]),[]);M<S;M++){if(z=N[M],!f[M]){for(;z>=C.length;)C.push(D(U));z=C[z]}HE.push(z)}U.B=WE(U,g.slice()),U.W=WE(U,HE)})})),function(e){Dm(e,4)})),V(497,Y,Y),V)(374,Y,[0,0,0]),Y),637),[OT]),Y),A),h],Y),V6),L],Y),true),true)},m=function(L,h,Y){Y[V(L,h,Y),OT]=2796},a={passive:true,capture:true},XW=function(L,h){return(h=h.create().shift(),L.B.create()).length||L.W.create().length||(L.B=void 0,L.W=void 0),h},G9=function(L,h){h.push(L[0]<<24|L[1]<<16|L[2]<<8|L[3]),h.push(L[4]<<24|L[5]<<16|L[6]<<8|L[7]),h.push(L[8]<<24|L[9]<<16|L[10]<<8|L[11])},D=function(L,h){if(L.B)return XW(L,L.W);return(h=J(true,L,8),h&128)&&(h^=128,L=J(true,L,2),h=(h<<2)+(L|0)),h},uz=function(L,h,Y,d,H,e){if(!h.S){h.O++;try{for(Y=(e=void 0,0),d=h.N;--L;)try{if(H=void 0,h.B)e=XW(h,h.B);else{if(Y=I(h,471),Y>=d)break;e=I(h,(H=(V(140,h,Y),D)(h),H))}e&&e[lz]&2048?e(h,L):K([O,21,H],0,h),v(L,false,h,false)}catch(Z){I(h,166)?K(Z,22,h):V(166,h,Z)}if(!L){if(h.Bd){uz(376662164886,(h.O--,h));return}K([O,33],0,h)}}catch(Z){try{K(Z,22,h)}catch(g){G(h,g)}}h.O--}},G=function(L,h){L.S=((L.S?L.S+"~":"E:")+h.message+":"+h.stack).slice(0,2048)},l=function(L){return L.B?XW(L,L.W):J(true,L,8)},I=function(L,h){if(void 0===(L=L.L[h],L))throw[O,30,h];if(L.value)return L.create();return L.create(1*h*h+55*h+-84),L.prototype},fo=function(L,h,Y,d,H,e,Z,g){return((g=c[L.I]((Y=[-39,(Z=h&7,55),(e=Co,81),-29,-34,-59,Y,-15,46,-33],L.pU)),g)[L.I]=function(n){Z+=(H=n,6)+7*h,Z&=7},g).concat=function(n){return((n=(n=51*H*H+1*(n=d%16+1,d)*d*n-51*d*d*H-n*H- -4284*H-2805*d*H+(e()|0)*n+Z+Y[Z+51&7]*d*n,H=void 0,Y[n]),Y)[(Z+69&7)+(h&2)]=n,Y)[Z+(h&2)]=55,n},g},hk=function(L,h,Y,d,H){for(Y=(L=L.replace(/\\r\\n/g,"\\n"),d=0,H=[],0);Y<L.length;Y++)h=L.charCodeAt(Y),128>h?H[d++]=h:(2048>h?H[d++]=h>>6|192:(55296==(h&64512)&&Y+1<L.length&&56320==(L.charCodeAt(Y+1)&64512)?(h=65536+((h&1023)<<10)+(L.charCodeAt(++Y)&1023),H[d++]=h>>18|240,H[d++]=h>>12&63|128):H[d++]=h>>12|224,H[d++]=h>>6&63|128),H[d++]=h&63|128);return H},xM=function(L,h,Y){return L.H(function(d){Y=d},false,h),Y},FW=function(L,h,Y,d){try{d=L[((h|0)+2)%3],L[h]=(L[h]|0)-(L[((h|0)+1)%3]|0)-(d|0)^(1==h?d<<Y:d>>>Y)}catch(H){throw H;}},Ak=function(L,h){return[(L(function(Y){Y(h)}),function(){return h})]},v=function(L,h,Y,d,H,e,Z,g,n){if((Y.A+=(Y.K=((Z=(H=(g=(n=0<(h||Y.T++,Y.U)&&Y.o&&Y.SL&&1>=Y.O&&!Y.B&&!Y.j&&(!h||1<Y.s-L)&&0==document.hidden,4==Y.T))||n?Y.F():Y.h,e=H-Y.h,e>>14),Y).Y&&(Y.Y^=Z*(e<<2)),Z||Y.K),Z),g)||n)Y.T=0,Y.h=H;if(!n||H-Y.u<Y.U-(d?255:h?5:2))return false;return Y.j=((V(471,(Y.s=L,d=I(Y,h?140:471),Y),Y.N),Y.R).push([kM,d,h?L+1:L]),P),true},Q,w=function(L,h,Y,d){for(Y=(h|0)-(d=[],1);0<=Y;Y--)d[(h|0)-1-(Y|0)]=L>>8*Y&255;return d},Sw=function(L,h,Y,d){for(Y=(d=D(h),0);0<L;L--)Y=Y<<8|l(h);V(d,h,Y)},T=function(L,h,Y,d,H,e){if(L.R.length){(L.o&&0(),L).o=true,L.SL=h;try{e=L.F(),L.h=e,L.u=e,L.T=0,H=Rd(h,L),d=L.F()-L.u,L.D+=d,d<(Y?0:10)||0>=L.G--||(d=Math.floor(d),L.J.push(254>=d?d:254))}finally{L.o=false}return H}},T9=function(L,h){if(L=y.trustedTypes,h=null,!L||!L.createPolicy)return h;try{h=L.createPolicy("bg",{createHTML:po,createScript:po,createScriptURL:po})}catch(Y){y.console&&y.console.error(Y.message)}return h},p=function(L,h){h.R.splice(0,0,L)},UT=function(L,h,Y,d){r(h,w(I(h,(Y=D(h),d=D(h),Y)),L),d)},Dm=function(L,h,Y,d,H){r(L,((Y=I(L,(d=(Y=(H=h&3,h&=4,D(L)),D(L)),Y)),h)&&(Y=hk(""+Y)),H&&r(L,w(Y.length,2),d),Y),d)},po=function(L){return L},Rd=function(L,h,Y,d){for(;h.R.length;){d=(h.j=null,h.R.pop());try{Y=sT(h,d)}catch(H){G(h,H)}if(L&&h.j){(L=h.j,L)(function(){T(h,true,true)});break}}return Y},ds=function(L,h){return L[h]<<24|L[(h|0)+1]<<16|L[(h|0)+2]<<8|L[(h|0)+3]},WE=function(L,h,Y){return(Y=c[L.I](L.nU),Y)[L.I]=function(){return h},Y.concat=function(d){h=d},Y},Ko=function(L,h,Y,d,H,e){function Z(){if(Y.K==Y){if(Y.L){var g=[E,d,h,void 0,H,e,arguments];if(2==L)var n=T(Y,(p(g,Y),false),false);else if(1==L){var k=!Y.R.length;(p(g,Y),k)&&T(Y,false,false)}else n=sT(Y,g);return n}H&&e&&H.removeEventListener(e,Z,a)}}return Z},ET=function(L,h,Y,d){return I(Y,(V(471,(uz(L,(d=I(Y,471),Y.Z&&d<Y.N?(V(471,Y,Y.N),od(Y,h)):V(471,Y,h),Y)),Y),d),252))},J=function(L,h,Y,d,H,e,Z,g,n,k,N,W,f,B){if((e=I(h,471),e)>=h.N)throw[O,31];for(Z=(n=(H=(k=e,Y),h).FI.length,0);0<H;)B=k>>3,N=k%8,f=8-(N|0),d=h.Z[B],f=f<H?f:H,L&&(g=h,g.P!=k>>6&&(g.P=k>>6,W=I(g,2),g.X=ew(g.Y,[0,0,W[1],W[2]],g.P)),d^=h.X[B&n]),k+=f,Z|=(d>>8-(N|0)-(f|0)&(1<<f)-1)<<(H|0)-(f|0),H-=f;return V(471,h,(e|(L=Z,0))+(Y|0)),L},Ne=function(L,h,Y,d){return(d=Q[L.substring(0,3)+"_"])?d(L.substring(3),h,Y):Ak(h,L)},iz=function(L,h,Y){if(Y=typeof L,"object"==Y)if(L){if(L instanceof Array)return"array";if(L instanceof Object)return Y;if((h=Object.prototype.toString.call(L),"[object Window]")==h)return"object";if("[object Array]"==h||"number"==typeof L.length&&"undefined"!=typeof L.splice&&"undefined"!=typeof L.propertyIsEnumerable&&!L.propertyIsEnumerable("splice"))return"array";if("[object Function]"==h||"undefined"!=typeof L.call&&"undefined"!=typeof L.propertyIsEnumerable&&!L.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==Y&&"undefined"==typeof L.call)return"object";return Y},BE=function(L,h){return c[L](c.prototype,{call:h,document:h,prototype:h,splice:h,length:h,console:h,parent:h,propertyIsEnumerable:h,pop:h,stack:h,replace:h,floor:h})},y=this||self,P=y.requestIdleCallback?function(L){requestIdleCallback(function(){L()},{timeout:4})}:y.setImmediate?function(L){setImmediate(L)}:function(L){setTimeout(L,0)},Zm=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),O={},OT=(u.prototype.QQ=(u.prototype.dH=void 0,void 0),[]),V6=[],A=[],E=(u.prototype.Bd=false,[]),kM=(u.prototype.C="toString",[]),F=[],x=[],lz=[],c=((((G9,X,FW,YM,b=u.prototype,b).H=function(L,h,Y,d,H){if((Y="array"===iz(Y)?Y:[Y],this).S)L(this.S);else try{H=[],d=!this.R.length,p([x,H,Y],this),p([F,L,H],this),h&&!d||T(this,h,true)}catch(e){G(this,e),L(this.S)}},b.qx=function(L,h,Y,d,H,e){for(H=(d=[],Y=0);Y<L.length;Y++)for(H+=h,e=e<<h|L[Y];7<H;)H-=8,d.push(e>>H&255);return d},b).F=(window.performance||{}).now?function(){return this.yQ+window.performance.now()}:function(){return+new Date},u.prototype).I="create",b.jL=function(L,h,Y,d,H){for(d=H=0;H<L.length;H++)d+=L.charCodeAt(H),d+=d<<10,d^=d>>6;return H=new (L=(d+=d<<3,d^=d>>11,d+(d<<15)>>>0),Number)(L&(1<<h)-1),H[0]=(L>>>h)%Y,H},O).constructor,Co=((b.wH=function(){return Math.floor(this.D+(this.F()-this.u))},b).xq=function(L,h,Y){return L^((h=(h^=h<<13,h^=h>>17,(h^h<<5)&Y))||(h=1),h)},b.Yq=function(){return Math.floor(this.F())},void 0);((u.prototype.V=function(L,h){return Co=(h={},function(){return L==h?-84:-64}),L={},function(Y,d,H,e,Z,g,n,k,N,W,f,B,S,q,t){L=(H=L,h);try{if(N=Y[0],N==A){t=Y[1];try{for(q=(B=(k=(f=0,atob(t)),[]),0);q<k.length;q++)W=k.charCodeAt(q),255<W&&(B[f++]=W&255,W>>=8),B[f++]=W;V(2,((this.Z=B,this).N=this.Z.length<<3,this),[0,0,0])}catch(R){K(R,17,this);return}uz(8001,this)}else if(N==x)Y[1].push(I(this,38).length,I(this,322),I(this,255).length,I(this,54).length),V(252,this,Y[2]),this.L[507]&&ET(8001,I(this,507),this);else{if(N==F){this.K=(g=(Z=w((I(this,(f=Y[2],255)).length|0)+2,2),this.K),this);try{S=I(this,40),0<S.length&&r(this,w(S.length,2).concat(S),255,10),r(this,w(this.A,1),255,109),r(this,w(this[F].length,1),255),k=0,k+=I(this,400)&2047,k-=(I(this,255).length|0)+5,n=I(this,54),4<n.length&&(k-=(n.length|0)+3),0<k&&r(this,w(k,2).concat(X(k)),255,15),4<n.length&&r(this,w(n.length,2).concat(n),255,156)}finally{this.K=g}if((q=X(2).concat(I(this,255)),q[1]=q[0]^6,q)[3]=q[1]^Z[0],q[4]=q[1]^Z[1],d=this.a6(q))d="!"+d;else for(k=0,d="";k<q.length;k++)e=q[k][this.C](16),1==e.length&&(e="0"+e),d+=e;return I(this,(I((V(322,(I(this,(B=d,38)).length=f.shift(),this),f.shift()),this),255).length=f.shift(),54)).length=f.shift(),B}if(N==kM)ET(Y[2],Y[1],this);else if(N==E)return ET(8001,Y[1],this)}}finally{L=H}}}(),u.prototype.a6=function(L,h,Y,d){if(h=window.btoa){for(Y=(d=0,"");d<L.length;d+=8192)Y+=String.fromCharCode.apply(null,L.slice(d,d+8192));L=h(Y).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else L=void 0;return L},u).prototype.Pd=0,u).prototype.us=0;var qe,rs=/./,jw=A.pop.bind((u.prototype[V6]=[0,0,1,1,0,1,1],u.prototype)[x]),ws=function(L,h){return(h=T9())&&1===L.eval(h.createScript("1"))?function(Y){return h.createScript(Y)}:function(Y){return""+Y}}((qe=(rs[u.prototype.C]=jw,BE(u.prototype.I,{get:jw})),u.prototype.my=void 0,y));(Q=y.botguard||(y.botguard={}),40<Q.m||(Q.m=41,Q.bg=Id,Q.a=Ne),Q).aDN_=function(L,h,Y){return[(Y=new u(h,L),function(d){return xM(Y,d)})]};}).call(this);'));
}).call(this);
#2 JavaScript::Eval (size: 64) - SHA256: 8b1281464531a60e0f3bdcc8629e9ba0ad55025989f2e5d4060e1abcd147514d
0,
function(e, Z, g) {
    (g = (Z = (g = D(e), D(e)), e.L[g] && I(e, g)), V)(Z, e, g)
}
#3 JavaScript::Eval (size: 22) - SHA256: 234530f36f0f2f3ae80b035a8b59a0e1c200086f7b874ee23458c7bb36a42aab
0,
function(e) {
    Sw(2, e)
}
#4 JavaScript::Eval (size: 27) - SHA256: 52b43864b9f1786d8c0d2d679562e90dc2a00c9d68ea80188a37d9b01d23dd47
lOptionDocumentNumber_10023
#5 JavaScript::Eval (size: 14) - SHA256: 0510de046e8325540849bad09f31eaaa3e9256fafd330c5d57327dc948812a33
/*@cc_on!@*/ !1
#6 JavaScript::Eval (size: 22) - SHA256: 680612d30feddb2524495b40f65aca8b05e8c47a5013afb8d5b7ce0f4f2eed58
0,
function(e) {
    Sw(1, e)
}
#7 JavaScript::Eval (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
#8 JavaScript::Eval (size: 39) - SHA256: 1edc4ac3150e512a8eef4e30b1cc1ced091953d2902230e869a745579722d059
tmgShowingLiveViewOnly_1318997937 = true;
#9 JavaScript::Eval (size: 21241) - SHA256: ecb771968bd66c31d76ace1c19029018df683af3552471ec1f89758ea72f4e72
(function() {
    var YM = function(L, h, Y) {
            if (3 == L.length) {
                for (Y = 0; 3 > Y; Y++) h[Y] += L[Y];
                for (Y = (L = [13, 8, 13, 12, 16, 5, 3, 10, 15], 0); 9 > Y; Y++) h[3](h, Y % 3, L[Y])
            }
        },
        od = function(L, h) {
            (L.Mx.push(L.L.slice()), L).L[471] = void 0, V(471, L, h)
        },
        Lo = function(L, h) {
            return (h = l(L), h) & 128 && (h = h & 127 | l(L) << 7), h
        },
        K = function(L, h, Y, d, H, e) {
            if (!Y.g) {
                if ((L = I(Y, ((h = (e = I(((H = void 0, L && L[0] === O) && (h = L[1], H = L[2], L = void 0), Y), 40), 0 == e.length && (d = I(Y, 140) >> 3, e.push(h, d >> 8 & 255, d & 255), void 0 != H && e.push(H & 255)), ""), L) && (L.message && (h += L.message), L.stack && (h += ":" + L.stack)), 322)), 3) < L) {
                    Y.K = (h = (L -= (h = h.slice(0, (L | 0) - 3), (h.length | 0) + 3), hk(h)), H = Y.K, Y);
                    try {
                        r(Y, w(h.length, 2).concat(h), 54, 9)
                    } finally {
                        Y.K = H
                    }
                }
                V(322, Y, L)
            }
        },
        r = function(L, h, Y, d, H, e) {
            if (L.K == L)
                for (H = I(L, Y), 54 == Y ? (Y = function(Z, g, n, k, N) {
                        if (k = ((g = H.length, g) | 0) - 4 >> 3, H.Nx != k) {
                            H.Nx = (N = [0, 0, e[1], e[2]], n = (k << 3) - 4, k);
                            try {
                                H.I6 = ew(ds(H, n), N, ds(H, (n | 0) + 4))
                            } catch (W) {
                                throw W;
                            }
                        }
                        H.push(H.I6[g & 7] ^ Z)
                    }, e = I(L, 374)) : Y = function(Z) {
                        H.push(Z)
                    }, d && Y(d & 255), L = h.length, d = 0; d < L; d++) Y(h[d])
        },
        gs = function(L, h, Y, d, H, e) {
            for (H = (h = D((Y = (((d = L[Zm] || {}, e = D(L), d).LU = D(L), d).i = [], L.K == L) ? (l(L) | 0) - 1 : 1, L)), 0); H < Y; H++) d.i.push(D(L));
            for ((d.l = I(L, e), d).KU = I(L, h); Y--;) d.i[Y] = I(L, d.i[Y]);
            return d
        },
        X = function(L, h) {
            for (h = []; L--;) h.push(255 * Math.random() | 0);
            return h
        },
        u = function(L, h, Y) {
            Y = this;
            try {
                no(L, h, this)
            } catch (d) {
                G(this, d), L(function(H) {
                    H(Y.S)
                })
            }
        },
        ew = function(L, h, Y, d, H) {
            for (h = (d = (H = 0, h[3] | 0), h)[2] | 0; 14 > H; H++) d = d >>> 8 | d << 24, Y = Y >>> 8 | Y << 24, Y += L | 0, L = L << 3 | L >>> 29, Y ^= h + 3039, d += h | 0, h = h << 3 | h >>> 29, L ^= Y, d ^= H + 3039, h ^= d;
            return [L >>> 24 & 255, L >>> 16 & 255, L >>> 8 & 255, L >>> 0 & 255, Y >>> 24 & 255, Y >>> 16 & 255, Y >>> 8 & 255, Y >>> 0 & 255]
        },
        sT = function(L, h, Y, d, H) {
            if (d = h[0], d == x) L.G = 25, L.V(h);
            else if (d == F) {
                Y = h[1];
                try {
                    H = L.S || L.V(h)
                } catch (e) {
                    G(L, e), H = L.S
                }
                Y(H)
            } else if (d == kM) L.V(h);
            else if (d == A) L.V(h);
            else if (d == V6) {
                try {
                    for (H = 0; H < L.v.length; H++) try {
                        Y = L.v[H], Y[0][Y[1]](Y[2])
                    } catch (e) {}
                } catch (e) {}(0, h[L.v = [], 1])(function(e, Z) {
                    L.H(e, true, Z)
                }, function(e) {
                    (p([(e = !L.R.length, lz)], L), e) && T(L, true, false)
                })
            } else {
                if (d == E) return H = h[2], V(228, L, h[6]), V(252, L, H), L.V(h);
                d == lz ? (L.L = null, L.Z = [], L.J = []) : d == OT && "loading" === y.document.readyState && (L.j = function(e, Z) {
                    function g() {
                        Z || (Z = true, e())
                    }
                    y.document.addEventListener("DOMContentLoaded", g, (Z = false, a)), y.addEventListener("load", g, a)
                })
            }
        },
        Id = function(L, h, Y, d) {
            function H() {}
            return Y = Ne(L, function(e) {
                H && (h && P(h), d = e, H(), H = void 0)
            }, (d = void 0, !!h))[0], {
                invoke: function(e, Z, g, n) {
                    function k() {
                        d(function(N) {
                            P(function() {
                                e(N)
                            })
                        }, g)
                    }
                    if (!Z) return Z = Y(g), e && e(Z), Z;
                    d ? k() : (n = H, H = function() {
                        (n(), P)(k)
                    })
                }
            }
        },
        b, V = function(L, h, Y) {
            if (471 == L || 140 == L) h.L[L] ? h.L[L].concat(Y) : h.L[L] = WE(h, Y);
            else {
                if (h.g && 2 != L) return;
                255 == L || 54 == L || 38 == L || 40 == L || 374 == L ? h.L[L] || (h.L[L] = fo(h, 94, Y, L)) : h.L[L] = fo(h, 121, Y, L)
            }
            2 == L && (h.Y = J(false, h, 32), h.P = void 0)
        },
        no = function(L, h, Y, d, H) {
            for (d = (Y.nU = (Y.pU = BE(Y.I, {get: (Y.FI = (Y.VQ = rs, Y[F]), Y.Wd = qe, function() {
                        return this.concat()
                    })
                }), c)[Y.I](Y.pU, {
                    value: {
                        value: {}
                    }
                }), 0), H = []; 292 > d; d++) H[d] = String.fromCharCode(d);
            T(Y, (p([(p([(p((V(166, ((m(301, Y, (m(132, Y, (m(317, Y, (Y.z$ = ((V(41, ((m(93, (V(54, (m(312, Y, (V((V(38, (V(252, Y, (V(400, (m(239, (m(351, Y, (V(40, (m(52, (m(298, (m(314, (m(438, (m(21, Y, (m(104, Y, (m(428, Y, (m(146, ((m(19, (m(253, (m(64, Y, (Y.eL = (m(((m(185, (m(83, (m(336, (V(232, Y, (V(255, Y, [(m(230, (V(140, (V(471, Y, ((Y.u = 0, Y).yQ = (d = ((Y.Z = [], Y).o = (Y.j = null, (Y.S = void 0, Y).v = (Y.Mx = [], Y.W = (Y.ZK = 0, Y.h = 0, (Y.P = ((Y.O = 0, Y).g = false, void 0), Y.J = [], Y).T = (Y.D = 0, void 0), Y.SL = (Y.X = void 0, !(Y.G = 25, 1)), void 0), Y.U = 0, Y.L = [], Y.B = void 0, Y.N = 0, Y.s = 8001, []), Y.A = 1, (Y.Y = void 0, Y).R = (Y.K = Y, []), Y.R6 = function(e) {
                this.K = e
            }, false), window.performance) || {}, d.timeOrigin || (d.timing || {}).navigationStart) || 0, 0)), Y), 0), Y), function(e, Z, g, n, k) {
                V((n = I(e, (k = I(e, (Z = (n = D((k = D((Z = D((g = D(e), e)), e)), e)), I(e, Z)), k)), n)), g), e, Ko(n, k, e, Z))
            }), 160), 0, 0]), 0)), Y), function(e, Z, g, n, k, N, W) {
                for (n = (N = (g = Lo((W = D(e), e)), Z = "", k = I(e, 217), k).length, 0); g--;) n = ((n | 0) + (Lo(e) | 0)) % N, Z += H[k[n]];
                V(W, e, Z)
            }), Y), function(e, Z, g, n) {
                V((n = I(e, (Z = (g = (n = D((Z = D(e), e)), D(e)), I)(e, Z), n)), g), e, +(Z == n))
            }), m(120, Y, function(e, Z, g, n) {
                !v(Z, true, e, false) && (Z = gs(e), n = Z.l, g = Z.KU, e.K == e || n == e.R6 && g == e) && (V(Z.LU, e, n.apply(g, Z.i)), e.h = e.F())
            }), Y), function(e, Z, g, n) {
                if (Z = e.Mx.pop()) {
                    for (g = l(e); 0 < g; g--) n = D(e), Z[n] = e.L[n];
                    (Z[40] = e.L[40], Z[322] = e.L[322], e).L = Z
                } else V(471, e, e.N)
            }), m)(418, Y, function(e) {
                Dm(e, 3)
            }), 445), Y, function(e, Z, g, n) {
                V((n = I(e, (Z = (g = (Z = D(e), D(e)), I)(e, Z), g)), g), e, n + Z)
            }), 0), function(e, Z, g) {
                V((g = I((Z = (g = D(e), D(e)), e), g), g = iz(g), Z), e, g)
            })), Y), function(e, Z, g, n) {
                V((Z = (g = l((n = D(e), e)), D(e)), Z), e, I(e, n) >>> g)
            }), Y), function(e, Z) {
                od((Z = I(e, D(e)), e).K, Z)
            }), m)(410, Y, function(e, Z) {
                (e = I((Z = D(e), e).K, Z), e[0]).removeEventListener(e[1], e[2], a)
            }), Y), function(e, Z, g) {
                (Z = I((Z = (g = D(e), D(e)), e), Z), 0 != I(e, g)) && V(471, e, Z)
            }), function(e, Z, g) {
                (g = (Z = D(e), D(e)), V)(g, e, "" + I(e, Z))
            })), function(e, Z, g, n) {
                n = (g = I(e, (Z = (g = D((n = D(e), e)), D)(e), g)), I(e, n)), V(Z, e, n in g | 0)
            })), function(e, Z, g, n, k) {
                (g = (k = D((n = D(e), e)), D(e)), e.K == e) && (k = I(e, k), Z = I(e, n), g = I(e, g), Z[k] = g, 2 == n && (e.P = void 0, 2 == k && (e.Y = J(false, e, 32), e.P = void 0)))
            })), Y), function(e, Z, g, n, k, N) {
                v(Z, true, e, false) || (k = gs(e.K), g = k.l, n = k.KU, Z = k.LU, k = k.i, N = k.length, g = 0 == N ? new n[g] : 1 == N ? new n[g](k[0]) : 2 == N ? new n[g](k[0], k[1]) : 3 == N ? new n[g](k[0], k[1], k[2]) : 4 == N ? new n[g](k[0], k[1], k[2], k[3]) : 2(), V(Z, e, g))
            }), m(441, Y, function() {}), Y), function(e, Z, g, n) {
                V((g = I(e, (n = (g = D(e), D(e)), Z = D(e), n = I(e, n), g)), Z), e, g[n])
            }), Y), function(e, Z, g, n, k) {
                0 !== (Z = I((k = I((n = (k = (n = D((Z = D(e), e)), D(e)), g = D(e), I)(e, n), e), k), e.K), Z), g = I(e, g), Z) && (g = Ko(1, g, e, k, Z, n), Z.addEventListener(n, g, a), V(232, e, [Z, n, g]))
            }), Y), function(e) {
                UT(1, e)
            }), Y), []), function(e, Z, g, n) {
                g = D((n = D((Z = D(e), e)), e)), V(g, e, I(e, Z) || I(e, n))
            })), Y), function(e, Z, g, n, k) {
                for (n = Lo((Z = D(e), e)), g = [], k = 0; k < n; k++) g.push(l(e));
                V(Z, e, g)
            }), Y), 0), {})), Y), []), 322), Y, 2048), function(e) {
                Sw(4, e)
            })), Y), X(4)), Y), function(e, Z, g, n, k, N) {
                if (!v(Z, true, e, true)) {
                    if (e = I((n = I((N = (N = (Z = D((g = D((n = D(e), e)), e)), D(e)), Z = I(e, Z), I(e, N)), e), n), e), g), "object" == iz(n)) {
                        for (k in g = [], n) g.push(k);
                        n = g
                    }
                    for (g = (Z = (k = 0, 0 < Z ? Z : 1), n.length); k < g; k += Z) e(n.slice(k, (k | 0) + (Z | 0)), N)
                }
            }), Y).hv = 0, Y), y), m)(407, Y, function(e, Z, g) {
                v(Z, true, e, false) || (Z = D(e), g = D(e), V(g, e, function(n) {
                    return eval(n)
                }(ws(I(e.K, Z)))))
            }), 0), function(e) {
                UT(4, e)
            })), function(e, Z, g, n, k, N, W, f, B, S, q, t) {
                function R(U, C) {
                    for (; n < U;) B |= l(e) << n, n += 8;
                    return B >>= (C = B & ((n -= U, 1) << U) - 1, U), C
                }
                for (W = k = (f = (S = (Z = (n = (t = D(e), B = 0), (R(3) | 0) + 1), R(5)), []), 0); k < S; k++) q = R(1), f.push(q), W += q ? 0 : 1;
                for (W = (k = ((W | 0) - 1).toString(2).length, 0), N = []; W < S; W++) f[W] || (N[W] = R(k));
                for (k = 0; k < S; k++) f[k] && (N[k] = D(e));
                for (g = []; Z--;) g.push(I(e, D(e)));
                m(t, e, function(U, C, M, HE, z) {
                    for (HE = (C = (M = 0, []), []); M < S; M++) {
                        if (z = N[M], !f[M]) {
                            for (; z >= C.length;) C.push(D(U));
                            z = C[z]
                        }
                        HE.push(z)
                    }
                    U.B = WE(U, g.slice()), U.W = WE(U, HE)
                })
            })), function(e) {
                Dm(e, 4)
            })), V(497, Y, Y), V)(374, Y, [0, 0, 0]), Y), 637), [OT]), Y), A), h], Y), V6), L], Y), true), true)
        },
        m = function(L, h, Y) {
            Y[V(L, h, Y), OT] = 2796
        },
        a = {
            passive: true,
            capture: true
        },
        XW = function(L, h) {
            return (h = h.create().shift(), L.B.create()).length || L.W.create().length || (L.B = void 0, L.W = void 0), h
        },
        G9 = function(L, h) {
            h.push(L[0] << 24 | L[1] << 16 | L[2] << 8 | L[3]), h.push(L[4] << 24 | L[5] << 16 | L[6] << 8 | L[7]), h.push(L[8] << 24 | L[9] << 16 | L[10] << 8 | L[11])
        },
        D = function(L, h) {
            if (L.B) return XW(L, L.W);
            return (h = J(true, L, 8), h & 128) && (h ^= 128, L = J(true, L, 2), h = (h << 2) + (L | 0)), h
        },
        uz = function(L, h, Y, d, H, e) {
            if (!h.S) {
                h.O++;
                try {
                    for (Y = (e = void 0, 0), d = h.N; --L;) try {
                        if (H = void 0, h.B) e = XW(h, h.B);
                        else {
                            if (Y = I(h, 471), Y >= d) break;
                            e = I(h, (H = (V(140, h, Y), D)(h), H))
                        }
                        e && e[lz] & 2048 ? e(h, L) : K([O, 21, H], 0, h), v(L, false, h, false)
                    } catch (Z) {
                        I(h, 166) ? K(Z, 22, h) : V(166, h, Z)
                    }
                    if (!L) {
                        if (h.Bd) {
                            uz(376662164886, (h.O--, h));
                            return
                        }
                        K([O, 33], 0, h)
                    }
                } catch (Z) {
                    try {
                        K(Z, 22, h)
                    } catch (g) {
                        G(h, g)
                    }
                }
                h.O--
            }
        },
        G = function(L, h) {
            L.S = ((L.S ? L.S + "~" : "E:") + h.message + ":" + h.stack).slice(0, 2048)
        },
        l = function(L) {
            return L.B ? XW(L, L.W) : J(true, L, 8)
        },
        I = function(L, h) {
            if (void 0 === (L = L.L[h], L)) throw [O, 30, h];
            if (L.value) return L.create();
            return L.create(1 * h * h + 55 * h + -84), L.prototype
        },
        fo = function(L, h, Y, d, H, e, Z, g) {
            return ((g = c[L.I]((Y = [-39, (Z = h & 7, 55), (e = Co, 81), -29, -34, -59, Y, -15, 46, -33], L.pU)), g)[L.I] = function(n) {
                Z += (H = n, 6) + 7 * h, Z &= 7
            }, g).concat = function(n) {
                return ((n = (n = 51 * H * H + 1 * (n = d % 16 + 1, d) * d * n - 51 * d * d * H - n * H - -4284 * H - 2805 * d * H + (e() | 0) * n + Z + Y[Z + 51 & 7] * d * n, H = void 0, Y[n]), Y)[(Z + 69 & 7) + (h & 2)] = n, Y)[Z + (h & 2)] = 55, n
            }, g
        },
        hk = function(L, h, Y, d, H) {
            for (Y = (L = L.replace(/\r\n/g, "\n"), d = 0, H = [], 0); Y < L.length; Y++) h = L.charCodeAt(Y), 128 > h ? H[d++] = h : (2048 > h ? H[d++] = h >> 6 | 192 : (55296 == (h & 64512) && Y + 1 < L.length && 56320 == (L.charCodeAt(Y + 1) & 64512) ? (h = 65536 + ((h & 1023) << 10) + (L.charCodeAt(++Y) & 1023), H[d++] = h >> 18 | 240, H[d++] = h >> 12 & 63 | 128) : H[d++] = h >> 12 | 224, H[d++] = h >> 6 & 63 | 128), H[d++] = h & 63 | 128);
            return H
        },
        xM = function(L, h, Y) {
            return L.H(function(d) {
                Y = d
            }, false, h), Y
        },
        FW = function(L, h, Y, d) {
            try {
                d = L[((h | 0) + 2) % 3], L[h] = (L[h] | 0) - (L[((h | 0) + 1) % 3] | 0) - (d | 0) ^ (1 == h ? d << Y : d >>> Y)
            } catch (H) {
                throw H;
            }
        },
        Ak = function(L, h) {
            return [(L(function(Y) {
                Y(h)
            }), function() {
                return h
            })]
        },
        v = function(L, h, Y, d, H, e, Z, g, n) {
            if ((Y.A += (Y.K = ((Z = (H = (g = (n = 0 < (h || Y.T++, Y.U) && Y.o && Y.SL && 1 >= Y.O && !Y.B && !Y.j && (!h || 1 < Y.s - L) && 0 == document.hidden, 4 == Y.T)) || n ? Y.F() : Y.h, e = H - Y.h, e >> 14), Y).Y && (Y.Y ^= Z * (e << 2)), Z || Y.K), Z), g) || n) Y.T = 0, Y.h = H;
            if (!n || H - Y.u < Y.U - (d ? 255 : h ? 5 : 2)) return false;
            return Y.j = ((V(471, (Y.s = L, d = I(Y, h ? 140 : 471), Y), Y.N), Y.R).push([kM, d, h ? L + 1 : L]), P), true
        },
        Q, w = function(L, h, Y, d) {
            for (Y = (h | 0) - (d = [], 1); 0 <= Y; Y--) d[(h | 0) - 1 - (Y | 0)] = L >> 8 * Y & 255;
            return d
        },
        Sw = function(L, h, Y, d) {
            for (Y = (d = D(h), 0); 0 < L; L--) Y = Y << 8 | l(h);
            V(d, h, Y)
        },
        T = function(L, h, Y, d, H, e) {
            if (L.R.length) {
                (L.o && 0(), L).o = true, L.SL = h;
                try {
                    e = L.F(), L.h = e, L.u = e, L.T = 0, H = Rd(h, L), d = L.F() - L.u, L.D += d, d < (Y ? 0 : 10) || 0 >= L.G-- || (d = Math.floor(d), L.J.push(254 >= d ? d : 254))
                } finally {
                    L.o = false
                }
                return H
            }
        },
        T9 = function(L, h) {
            if (L = y.trustedTypes, h = null, !L || !L.createPolicy) return h;
            try {
                h = L.createPolicy("bg", {
                    createHTML: po,
                    createScript: po,
                    createScriptURL: po
                })
            } catch (Y) {
                y.console && y.console.error(Y.message)
            }
            return h
        },
        p = function(L, h) {
            h.R.splice(0, 0, L)
        },
        UT = function(L, h, Y, d) {
            r(h, w(I(h, (Y = D(h), d = D(h), Y)), L), d)
        },
        Dm = function(L, h, Y, d, H) {
            r(L, ((Y = I(L, (d = (Y = (H = h & 3, h &= 4, D(L)), D(L)), Y)), h) && (Y = hk("" + Y)), H && r(L, w(Y.length, 2), d), Y), d)
        },
        po = function(L) {
            return L
        },
        Rd = function(L, h, Y, d) {
            for (; h.R.length;) {
                d = (h.j = null, h.R.pop());
                try {
                    Y = sT(h, d)
                } catch (H) {
                    G(h, H)
                }
                if (L && h.j) {
                    (L = h.j, L)(function() {
                        T(h, true, true)
                    });
                    break
                }
            }
            return Y
        },
        ds = function(L, h) {
            return L[h] << 24 | L[(h | 0) + 1] << 16 | L[(h | 0) + 2] << 8 | L[(h | 0) + 3]
        },
        WE = function(L, h, Y) {
            return (Y = c[L.I](L.nU), Y)[L.I] = function() {
                return h
            }, Y.concat = function(d) {
                h = d
            }, Y
        },
        Ko = function(L, h, Y, d, H, e) {
            function Z() {
                if (Y.K == Y) {
                    if (Y.L) {
                        var g = [E, d, h, void 0, H, e, arguments];
                        if (2 == L) var n = T(Y, (p(g, Y), false), false);
                        else if (1 == L) {
                            var k = !Y.R.length;
                            (p(g, Y), k) && T(Y, false, false)
                        } else n = sT(Y, g);
                        return n
                    }
                    H && e && H.removeEventListener(e, Z, a)
                }
            }
            return Z
        },
        ET = function(L, h, Y, d) {
            return I(Y, (V(471, (uz(L, (d = I(Y, 471), Y.Z && d < Y.N ? (V(471, Y, Y.N), od(Y, h)) : V(471, Y, h), Y)), Y), d), 252))
        },
        J = function(L, h, Y, d, H, e, Z, g, n, k, N, W, f, B) {
            if ((e = I(h, 471), e) >= h.N) throw [O, 31];
            for (Z = (n = (H = (k = e, Y), h).FI.length, 0); 0 < H;) B = k >> 3, N = k % 8, f = 8 - (N | 0), d = h.Z[B], f = f < H ? f : H, L && (g = h, g.P != k >> 6 && (g.P = k >> 6, W = I(g, 2), g.X = ew(g.Y, [0, 0, W[1], W[2]], g.P)), d ^= h.X[B & n]), k += f, Z |= (d >> 8 - (N | 0) - (f | 0) & (1 << f) - 1) << (H | 0) - (f | 0), H -= f;
            return V(471, h, (e | (L = Z, 0)) + (Y | 0)), L
        },
        Ne = function(L, h, Y, d) {
            return (d = Q[L.substring(0, 3) + "_"]) ? d(L.substring(3), h, Y) : Ak(h, L)
        },
        iz = function(L, h, Y) {
            if (Y = typeof L, "object" == Y)
                if (L) {
                    if (L instanceof Array) return "array";
                    if (L instanceof Object) return Y;
                    if ((h = Object.prototype.toString.call(L), "[object Window]") == h) return "object";
                    if ("[object Array]" == h || "number" == typeof L.length && "undefined" != typeof L.splice && "undefined" != typeof L.propertyIsEnumerable && !L.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == h || "undefined" != typeof L.call && "undefined" != typeof L.propertyIsEnumerable && !L.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == Y && "undefined" == typeof L.call) return "object";
            return Y
        },
        BE = function(L, h) {
            return c[L](c.prototype, {
                call: h,
                document: h,
                prototype: h,
                splice: h,
                length: h,
                console: h,
                parent: h,
                propertyIsEnumerable: h,
                pop: h,
                stack: h,
                replace: h,
                floor: h
            })
        },
        y = this || self,
        P = y.requestIdleCallback ? function(L) {
            requestIdleCallback(function() {
                L()
            }, {
                timeout: 4
            })
        } : y.setImmediate ? function(L) {
            setImmediate(L)
        } : function(L) {
            setTimeout(L, 0)
        },
        Zm = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        O = {},
        OT = (u.prototype.QQ = (u.prototype.dH = void 0, void 0), []),
        V6 = [],
        A = [],
        E = (u.prototype.Bd = false, []),
        kM = (u.prototype.C = "toString", []),
        F = [],
        x = [],
        lz = [],
        c = ((((G9, X, FW, YM, b = u.prototype, b).H = function(L, h, Y, d, H) {
            if ((Y = "array" === iz(Y) ? Y : [Y], this).S) L(this.S);
            else try {
                H = [], d = !this.R.length, p([x, H, Y], this), p([F, L, H], this), h && !d || T(this, h, true)
            } catch (e) {
                G(this, e), L(this.S)
            }
        }, b.qx = function(L, h, Y, d, H, e) {
            for (H = (d = [], Y = 0); Y < L.length; Y++)
                for (H += h, e = e << h | L[Y]; 7 < H;) H -= 8, d.push(e >> H & 255);
            return d
        }, b).F = (window.performance || {}).now ? function() {
            return this.yQ + window.performance.now()
        } : function() {
            return +new Date
        }, u.prototype).I = "create", b.jL = function(L, h, Y, d, H) {
            for (d = H = 0; H < L.length; H++) d += L.charCodeAt(H), d += d << 10, d ^= d >> 6;
            return H = new(L = (d += d << 3, d ^= d >> 11, d + (d << 15) >>> 0), Number)(L & (1 << h) - 1), H[0] = (L >>> h) % Y, H
        }, O).constructor,
        Co = ((b.wH = function() {
            return Math.floor(this.D + (this.F() - this.u))
        }, b).xq = function(L, h, Y) {
            return L ^ ((h = (h ^= h << 13, h ^= h >> 17, (h ^ h << 5) & Y)) || (h = 1), h)
        }, b.Yq = function() {
            return Math.floor(this.F())
        }, void 0);
    ((u.prototype.V = function(L, h) {
        return Co = (h = {}, function() {
                return L == h ? -84 : -64
            }), L = {},
            function(Y, d, H, e, Z, g, n, k, N, W, f, B, S, q, t) {
                L = (H = L, h);
                try {
                    if (N = Y[0], N == A) {
                        t = Y[1];
                        try {
                            for (q = (B = (k = (f = 0, atob(t)), []), 0); q < k.length; q++) W = k.charCodeAt(q), 255 < W && (B[f++] = W & 255, W >>= 8), B[f++] = W;
                            V(2, ((this.Z = B, this).N = this.Z.length << 3, this), [0, 0, 0])
                        } catch (R) {
                            K(R, 17, this);
                            return
                        }
                        uz(8001, this)
                    } else if (N == x) Y[1].push(I(this, 38).length, I(this, 322), I(this, 255).length, I(this, 54).length), V(252, this, Y[2]), this.L[507] && ET(8001, I(this, 507), this);
                    else {
                        if (N == F) {
                            this.K = (g = (Z = w((I(this, (f = Y[2], 255)).length | 0) + 2, 2), this.K), this);
                            try {
                                S = I(this, 40), 0 < S.length && r(this, w(S.length, 2).concat(S), 255, 10), r(this, w(this.A, 1), 255, 109), r(this, w(this[F].length, 1), 255), k = 0, k += I(this, 400) & 2047, k -= (I(this, 255).length | 0) + 5, n = I(this, 54), 4 < n.length && (k -= (n.length | 0) + 3), 0 < k && r(this, w(k, 2).concat(X(k)), 255, 15), 4 < n.length && r(this, w(n.length, 2).concat(n), 255, 156)
                            } finally {
                                this.K = g
                            }
                            if ((q = X(2).concat(I(this, 255)), q[1] = q[0] ^ 6, q)[3] = q[1] ^ Z[0], q[4] = q[1] ^ Z[1], d = this.a6(q)) d = "!" + d;
                            else
                                for (k = 0, d = ""; k < q.length; k++) e = q[k][this.C](16), 1 == e.length && (e = "0" + e), d += e;
                            return I(this, (I((V(322, (I(this, (B = d, 38)).length = f.shift(), this), f.shift()), this), 255).length = f.shift(), 54)).length = f.shift(), B
                        }
                        if (N == kM) ET(Y[2], Y[1], this);
                        else if (N == E) return ET(8001, Y[1], this)
                    }
                } finally {
                    L = H
                }
            }
    }(), u.prototype.a6 = function(L, h, Y, d) {
        if (h = window.btoa) {
            for (Y = (d = 0, ""); d < L.length; d += 8192) Y += String.fromCharCode.apply(null, L.slice(d, d + 8192));
            L = h(Y).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
        } else L = void 0;
        return L
    }, u).prototype.Pd = 0, u).prototype.us = 0;
    var qe, rs = /./,
        jw = A.pop.bind((u.prototype[V6] = [0, 0, 1, 1, 0, 1, 1], u.prototype)[x]),
        ws = function(L, h) {
            return (h = T9()) && 1 === L.eval(h.createScript("1")) ? function(Y) {
                return h.createScript(Y)
            } : function(Y) {
                return "" + Y
            }
        }((qe = (rs[u.prototype.C] = jw, BE(u.prototype.I, {get: jw
        })), u.prototype.my = void 0, y));
    (Q = y.botguard || (y.botguard = {}), 40 < Q.m || (Q.m = 41, Q.bg = Id, Q.a = Ne), Q).aDN_ = function(L, h, Y) {
        return [(Y = new u(h, L), function(d) {
            return xM(Y, d)
        })]
    };
}).call(this);

Executed Writes (2)
#1 JavaScript::Write (size: 830) - SHA256: 2b31fe38ea0769cdf4e0f5920f9bc3afa6d45aba2aef46f2b2007164ed2057bd
< script >
    var TrackTime = ['22:13:27.285', '22:13:27.285', '22:13:27.301'] < /script><style>.tmg-loading span{margin:0 auto;display:block;width:130px;font-size:large;font-variant:petite-caps;font-family:initial;text-align:center;}</style > < div id = 'tmgloading'
class = 'tmg-loading' > < span > Loading... < /span></div > < script > function TMG_CheckForClick() {
    try {
        var redirectTo = '#',
            tmpPlacement = '13488000';
        if ('#' != redirectTo) {
            var lurl = decodeURIComponent(redirectTo); - 1 != lurl.indexOf('http://') || -1 != lurl.indexOf('https://') ? window.location.href = lurl : eval(lurl)
        }
    } catch (r) {}
    return !0
} < /script><script src='https:/ / ldsapi.tmginteractive.com / GenericPlacementScriptDiv.aspx ? tmgrt = ancs & mainPlacement = 13488000 & hasLoadOptimation = 0 & hasMinAssets = 1 & placement = 13488000 & publisher = 139136 & affid = 1249169444874962 & subid = 1249169444874962 ' type='
text / javascript '></script>
#2 JavaScript::Write (size: 15016) - SHA256: d4dfc9abf73263adedfbc552a602db17dc0e7b57c19a325ca7d223c398af9e01
< style type = 'text/css' > .TMG - Creative - MoreInfo - Container {
        background - color: # fdecd7!important;
        border: 1 px solid # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar {
        background - color: # f3dfc8!important;
    }.TMG - Creative - MoreInfo - Container - HeaderBar - Icon {
        color: # c4a176!important;
    }.TMG - Creative - MoreInfo - Container a {
        color: # dca926!important;
    }.TmgOffersArea {
        width: 370 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;padding:0px 0px 0px 0px;margin:0px 0px 0px 0px;}.TmgOfferTopSpace{width:370px!important;float:left!important;height:0px!important;}.TmgOfferHeaderImage{width:370px!important;float:left!important;display:none;border:0px solid # FFF!important;
    }.TmgOfferHeaderImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBlankTop {
        width: 370 px!important;float: left!important;margin: 5 px 0 px
    }.TmgOffers {
        width: 370 px!important;float: left!important;
    }.TmgOffer {
        width: 370 px!important;float: left!important;
    }.TmgFloat {
        float: left!important;
    }.TmgOfferVerbiage {
        width: 370 px!important;float: left!important;display: none;padding: 0 px 0 px 0 px 0 px!important;margin: 0 px 0 px 0 px 0 px!important;font - family: Arial,
        Helvetica,
        sans - serif!important;font - weight: normal!important;font - size: 12 px!important;color: #000!important;border-style:0px solid # FFF!important;text - align: left!important;
    }.TmgOfferFooterImage {
        width: 370 px!important;float: left!important;display: none;border: 0 px solid # FFF!important;height: 0 px!important;width: 0 px!important;
    }.TmgOfferFooterImage img {
        height: 0 px!important;width: 0 px!important;
    }.TmgOfferBottomSpace {
        width: 370 px!important;float: left!important;height: 0 px!important;
    }.tmgCampaignlogoArea {
        display: none;width: 130 px!important;vertical - align: top;float: left!important;background - repeat: no - repeat;
    }.tmgCampaignlogoArea img {
        border: 1 px solid #000000 !important;}.TmgCampaignControlArea{display:block;width:25px!important;vertical-align:top;}.TmgCheckBoxButton{margin:1px 3px!important;}.TmgRadioButton{margin:1px 3px!important;}.tmgControlText{font-family:Sans-Serif!important;font-size:14px!important;font-weight:normal!important;color:# 212529!important;font - variant: normal!important;vertical - align: top!important;vertical - align: middle;display: inline - block;padding: 0 px!important;padding: 0 px 0 px 5 px 1 px;margin - left: 0 px!important;margin - left: -1 px;
    }.TmgCampaignCreativeArea {
        float: left!important;width: 325 px!important;vertical - align: top;display: block;
    }.TmgCampaignCreativeText {
        width: 325 px!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #212529!important;text-align:left!important;vertical-align:top!important;display:inline-block!important;overflow: hidden!important;}.TmgAdditionalFieldsArea{float:left!important;display:none;width:325px!important;font-family:Sans-Serif!important;font-variant:normal!important;color:# 212529!important;
    }.TmgBlankArea {
        float: left!important;width: 1 px!important;height: 1 px!important;padding: 0 px!important;margin: 0 px!important;
    }.TMG - Creative - MoreInfo - a - Collapse, .TMG - Creative - MoreInfo - a - Expand {
        cursor: pointer;color: #0000FF;text-decoration:underline;padding:0 5px;}.tmgFieldControlTheme{background-color:none;}.tmgFieldControlThemeRequired{background-color:# FF9999;
    }.TmgCampaignDisclaimer {
        font - size: 9 px!important;
        font - style: italic;
    }.tmgFieldOptionDirectionVertical {
        display: inline - table;
    }.TmgPoweredBy {
        float: left!important;font - family: Sans - Serif!important;font - size: 14 px!important;font - variant: normal!important;color: #9b9b9b!important;text-align:right!important;width:100%!important;}.TmgPoweredBy .initials-span{font-size:13px!important;}</style><script language= 'javascript'
        type = 'text/javascript' >
        var tmg_GlobalAssetsBaseURL = 'tmgassets.azureedge.net/amsus';
        var tmgPlacement = '13488000',
            tmgPublisher = '139136',
            tmgAffId = '1249169444874962',
            tmgSubId = '1249169444874962',
            tmgSSLKey = 's',
            tmgRedirectTo = '#',
            tmgMyURI = 'ldsapi.tmginteractive.com',
            tmgOfferPreCheck = false,
            tmgNumberOfOfferForPreCheck = 0,
            tmg_arrPreCheckCamps = [],
            tmgIsEmbeddedPlacement = true,
            tmgIsFieldDropOnButtonClick = false,
            tmgIsClientQueryStringPass = false,
            lUSER_PLATFORM = 0,
            lUSER_PLATFORM_SUB = 0,
            lUSER_IP_ADDRESS = '91.90.42.154',
            tmg_UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0',
            tmgHitUniqueKey = '1318997937',
            tmgTrustedFormFlag = false,
            tmgUniversalLeadidFlag = false,
            tmg_ptype = 'Embedded',
            tmg_psectype = 'EMBEDDED',
            tmg_hideCampOnClick = false,
            tmg_NumOfCampShowIntially = 0,
            tmg_ShowCampInBunchFunctionality = false,
            tmg_CampaignInABunch = 0,
            tmg_MainPlacement = '13488000',
            tmgAttachedInfo = 'Firefox;105.0;WinNT',
            tmgMoreInfoContext = '<i class=:SQ:fa fa-plus-circle:SQ: style=:SQ:color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgLessInfoContext = '<i class=:SQ:fa fa-minus-circle:SQ: style=:SQ:color:#A12227!important; font-size:16px!important;font-variant:normal !important;font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;:SQ:></i>',
            tmgSiteName = 'monthlysweeps.us',
            tmgShowingLiveViewOnly_1318997937 = false,
            UserActivityTrackingSequence = 0,
            tmg_PostLeadOnOpt = false,
            tmgTrustedFormEnabledCampaigns = [],
            gMonths = [],
            gDays = [],
            gYears = [],
            gCountry = [],
            usStates = [],
            caStates = [],
            auStates = []; < /script><script src='https:/ / tmgassets.azureedge.net / amsus / ldsapi / assets / script / standard.min.js ? version = 20220221 n ' type='
        text / javascript '></script><script src='
        https : //tmgassets.azureedge.net/amsus/ldsapi/assets/script/clientfp.min.js?version=20211103' type='text/javascript'></script><script src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common.min.js?version=20221107a' type='text/javascript'></script><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/browserdetect.min.js?version=120419' type='text/javascript'></script><link href='https://tmgassets.azureedge.net/amsus/ns/css/13488000.min.css?2725k25j20222725j11ckl25llk144jkk132700' rel='stylesheet' type='text/css' /><iframe security='restricted' id='tmgPost' height='1' width='1' style='display:none;'></iframe><img id='tmgCallPixelSrc' src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1' width='1' /><div id='TmgOffers' align='left' class='TmgOffersArea' style='display:none;'><div class='TmgOfferTopSpace'></div><div class='TmgOfferHeaderImage' title='&nbsp;'></div><div id='TmgOfferVerbiage13488000' class='TmgOfferVerbiage'></div><div class='TmgOfferBlankTop'></div><div id='tmgDisplayOfferContainer' class='TmgOffers'><div id='TMGOfferTD1' class='TmgOffer TmgOfferTheme' ></div><br class='tmg_ignore_br' style='clear:both;'/></div><div class='TmgOfferFooterImage' title=''></div><div class='TmgOfferBottomSpace'></div><div style='clear:both;'></div></div><div style='display:none;'><div id='TMGOfferTR$10023'><div class='TMGOfferDiv13488000'><div class='tmgOfferArea_CenterLeftLine'><div class='tmgOfferArea_CenterRightLine'><div class='tmgOfferArea_CenterTopLine'><div class='tmgOfferArea_TopLeftCorner'><div class='tmgOfferArea_TopRightCorner'><div class='tmgOfferArea_CenterBottomLine'><div class='tmgOfferArea_BottomLeftCorner'><div class='tmgOfferArea_BottomRightCorner'><div class='TmgBlankArea'></div><div id='TmgCampaignControl$10023' class='TmgFloat TmgCampaignControlTheme'><div align='left' valign='top' style='vertical-align:top!important;' class='TmgCampaignControlArea TmgCampaignControlAreaTheme'><input type='checkbox' id='tmgControl$10023$0' name='tmgControl$10023' class='TmgCheckBoxButton' onClick='javascript:TMG_CheckClick(this);' />&nbsp;</div></div><div id='TmgCampaignCreative$10023' class='TmgCampaignCreativeArea TmgCampaignCreativeAreaTheme'><span class='TmgCampaignCreativeText'><span id='TmgCampaignCreativeSection0' class='TmgCampaignCreativeSection0Theme'><label for='tmgControl$10023$0' style='cursor:pointer;display:inline;'>Get exclusive access to global deals and free apps for your smartphone! </label></span><span id='TmgCampaignCreativeSection1' class='TmgCampaignCreativeSection1Theme'> </span><br class='tmg_ignore_br' style='clear:left;'/><span class='TMG-Creative-MoreInfo-Span' id='CreativeMoreInfo$10023' style='display:none;'>&nbsp;<a href='https://ldsapi.tmginteractive.com/pp/' target='_blank'>Privacy Policy</a></span><a class='TMG-Creative-MoreInfo-a-Expand' id='TMGMoreInfoAnchor$10023' onclick='javascript:TMG_ClickForCreativeMoreInfo(this)'><i class='fa fa-plus-circle' style='color:#9E9E9E !important; font-size:16px !important;font-variant:normal !important; font-stretch:inherit !important; font-style:normal !important;font-weight:normal !important; background:none !important;border:none !important;text-decoration:none !important;text-transform:none !important;'></i></a></span></div><br class='tmg_ignore_br' style='clear:both;'/><div id='TmgAdditionalFields$10023' class='TmgAdditionalFieldsArea TmgAdditionalFieldsAreaTheme' style='padding-left:25px'><div><span style='font-size:11px!important;font-weight:normal!important;' name='TmgFieldValidationMsg' id='TmgFieldValidationMsg$10023'>Please complete the following fields:</span></div><div style='height:2px!important;'></div><div id='F_10023_FIRST_NAME_TABLE'><div><span id='F_10023_FIRST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>First Name</span></div><div><input Id='F_10023_FIRST_NAME' name='F_10023_FIRST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_FIRST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_LAST_NAME_TABLE'><div><span id='F_10023_LAST_NAME$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Last Name</span></div><div><input Id='F_10023_LAST_NAME' name='F_10023_LAST_NAME' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_LAST_NAME'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><div id='F_10023_EMAIL_TABLE'><div><span id='F_10023_EMAIL$heading' style='font-size:11px!important;' class='tmgFieldCaptionTheme'>Email</span></div><div><input Id='F_10023_EMAIL' name='F_10023_EMAIL' style='width:200px;height:20px;' onChange=javascript:TMG_FillValueWithSameBaseField(this);TMG_ValidateCampaignsFieldsOnChange('F_10023_EMAIL'); type='text' value='' class='tmgFieldTextBox tmgFieldControlTheme'></div></div><div style='height:2px!important;'></div><input name='F_10023_IP_ADDRESS' Id='F_10023_IP_ADDRESS' type='hidden' value='91.90.42.154'/><div style='height:2px!important;'></div><input name='F_10023_COUNTRY' Id='F_10023_COUNTRY' type='hidden' value=''/><div style='height:2px!important;'></div><input name='F_10023_USER_PLATFORM' Id='F_10023_USER_PLATFORM' type='hidden' value='0'/><div style='height:2px!important;'></div><div><span id='TmgSuccessMsg$10023' name='TmgSuccessMsg' style='font-size:11px!important;'>Once you have completed the required field(s) you will see a success message here.</span></div></div><div id='TmgSpacerTop$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='TmgOffer TmgCampaignSepratorTheme' id='TmgCampaignSepratorId$10023' style='display:none;width:370px;border-bottom: 1px solid #000000!important;'></div><div id='TmgSpacerBottom$10023' class='TmgOffer SpacerImage' style='width:370px!important;height:5px!important;'><img src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/images/spacer.gif' height='1px' width='0px'></div><div class='tmg_ignore_br' style='clear:left;'></div></div></div></div></div></div></div></div></div></div></div></div><input name='hFieldAffId' Id='hFieldAffId' name='hFieldAffId' type='hidden' value='1249169444874962'/><input Id='hTMG_FetchingDataFromQuery' type='hidden' value='0'/><input Id='hTMG_MappedDateFormat' type='hidden' value='0'/><input name='hFieldSubId' Id='hFieldSubId' name='hFieldSubId' type='hidden' value='1249169444874962'/><script language='javascript' type='text/javascript'>var IsPrePingExecuteFromClientScript=false,lCampaigns_out_from_preping=[0],lMappedClientFields='ADDRESS,1,address,NAME--AffId,0,hFieldAffId,ID--CITY,0,city,ID--DATE_OF_BIRTH,2,month^day^year,ID--EMAIL,1,email-address,ID--FIRST_NAME,1,first_name,ID--GENDER,3,title,NAME--LAST_NAME,1,last_name,ID--PHONE,1,phone_number,ID--STATE,0,state,ID--SubId,0,hFieldSubId,ID--ZIP,1,postal_code,ID',lCPL_10023='0.00',lCPLEntryFor_10023='ADMIN',lOptionDocumentNumber_10023='10023/226/0/225',lCampaignFields_10023='F_10023_FIRST_NAME,F_10023_LAST_NAME,F_10023_EMAIL,F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFinalOrderOfCampaignInDisplay='',lTrueTargetedCampaigns='',lFalseTargetedCampaigns='',lNumberOfCampaignsToDisplay='1',lAllCampaigns='10023',lAvoidValidateForIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lFieldsContainChildField='',lHiddenFieldIds='F_10023_IP_ADDRESS,F_10023_COUNTRY,F_10023_USER_PLATFORM',lAnswerMandatoryFlag=false,lRadioButtonFieldIds='',lCheckBoxFieldIds='',lClientQueryString='',lPrePingCampaigns='',lNumberOfPrepingCampaign='0',lExecuteLines='',lMappedFor_GENDER='Mr~M,Ms~F',lPlacementImpressionOn='LOAD',lCampaignsImpressionOn='LOAD';</script><script language='javascript' type='text/javascript'>try{TMG_DisplayOffers();fn_MoreInfo_Absolute();}catch(ex){}</script><script language='javascript' type='text/javascript'>var oldonload=window.onload;if (typeof window.onload != 'function'){window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();}} else {window.onload=function(){TMG_ExecuteOnPageLoad();fn_MoreInfo_Absolute();oldonload();}}</script><script>UserActivityTrackingSequence=1;</script><link href='https://tmgassets.azureedge.net/amsus/ns/assets/awesome-font/font-awesome.css?version=120419' rel='stylesheet' type='text/css' /><script src='https://tmgassets.azureedge.net/amsus/ns/js/13488000.min.js?2725k25j20222725j11ckl25llk144jkk132700' type='text/javascript'></script><style>.tmg-loading{display:none;text-align:center;}</style><script async src='https://tmgassets.azureedge.net/amsus/ldsapi/assets/script/common-extentions.min.js?20221107a' type='text/javascript'></script><input Id='hConditionalStructureData' type='hidden' value=''/><script>try{ TrackTime.push('22:13:27.458','22:13:27.458','22:13:27.458','22:13:27.520','22:13:27.520','22:13:27.520','22:13:27.520','22:13:27.520','22:13:27.520');TrackTime.push(GetDateStringInFormat(new Date(),'hh:mm:ss.fff')) } catch(ex) { }</script>


HTTP Transactions (102)


Request Response
                                        
                                            GET /go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         54.161.16.68
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Fri, 25 Nov 2022 22:13:25 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962/


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "12AF026999398F4976749E320667D43DA3F99B7A2E8254ACA7A410A964A106AA"
Last-Modified: Thu, 24 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8708
Expires: Sat, 26 Nov 2022 00:38:33 GMT
Date: Fri, 25 Nov 2022 22:13:25 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3452
Cache-Control: max-age=134121
Date: Fri, 25 Nov 2022 22:13:25 GMT
Etag: "63809972-1d7"
Expires: Sun, 27 Nov 2022 11:28:46 GMT
Last-Modified: Fri, 25 Nov 2022 10:31:14 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3918
Expires: Fri, 25 Nov 2022 23:18:43 GMT
Date: Fri, 25 Nov 2022 22:13:25 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 25 Nov 2022 21:17:29 GMT
cache-control: public,max-age=3600
age: 3356
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    4d7e4eed097b9c4e5d509419f1cfc85a
Sha1:   290bb3d428a7c6330e2e3d73a952b16f820896c8
Sha256: 0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: wqTFknXTsFAZdsyDzQtk6+5JyWAyFKPct0wTyrM3UQ+eYxz0/ANLk/pwqsMh1HXJU9w7IuWdMbk=
x-amz-request-id: 06KMM74W1B5FDEQ0
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 25 Nov 2022 21:43:59 GMT
age: 1766
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 25 Nov 2022 22:13:25 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.165
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=107465
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "6380386a-1d7"
Expires: Sun, 27 Nov 2022 04:04:31 GMT
Last-Modified: Fri, 25 Nov 2022 03:37:14 GMT
Server: ECS (dcb/7EEC)
X-Cache: Miss from cloudfront
Via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: pUSWYVeGhqMgajylTotY9XpzwN8NN8R0Ro_5RJOE483J49ilUHpeRg==
Age: 1637

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 25 Nov 2022 22:08:53 GMT
cache-control: public,max-age=3600
age: 273
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962/ HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         54.161.16.68
HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 302
location: http://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
server: Apache/2.4.41 (Ubuntu)
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   302
Md5:    18de5bfb8a0983a58777ea77735e39e2
Sha1:   e3c44c020374c982e902754a5de249df2e7f3534
Sha256: fe15f1c413a4d8728cb91b00374c1e04271d0bc83e78dfb4d9054cc83b3e2bf4

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         54.161.16.68
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: awselb/2.0
Date: Fri, 25 Nov 2022 22:13:26 GMT
Content-Length: 134
Connection: keep-alive
Location: https://monthlysweeps.us:443/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   134
Md5:    4aa7a432bb447f094408f1bd6229c605
Sha1:   1965c4952cc8c082a6307ed67061a57aab6632fa
Sha256: 34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4718
Cache-Control: max-age=130323
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "638085ab-1d7"
Expires: Sun, 27 Nov 2022 10:25:29 GMT
Last-Modified: Fri, 25 Nov 2022 09:06:51 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962 HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 9942
server: Apache/2.4.41 (Ubuntu)
set-cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr; path=/; HttpOnly; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (939)
Size:   9942
Md5:    e8b3d7e1f220d7e9f9898da4c8c5cc30
Sha1:   4b0923675d738cafb8f5628f718adf4e0ca5cda6
Sha256: 0710246af71adeeab470c8e2bfa9024fce0c76554b980fa3998efab9debd2e47

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6202
Cache-Control: max-age=124282
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "63806846-118"
Expires: Sun, 27 Nov 2022 08:44:48 GMT
Last-Modified: Fri, 25 Nov 2022 07:01:26 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 280

                                        
                                            GET /ajax/libs/bootstrap-formhelpers/2.3.0/js/bootstrap-formhelpers.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 58913
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03d8e-46f6d"
last-modified: Mon, 04 May 2020 16:06:38 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 12457580
expires: Wed, 15 Nov 2023 22:13:26 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YUwk49SBY4X4DdMdkRFt4h6YqoD1QLSOc6nXAQnDb7TKUg4fNLtEMErgm7Pqukw1GbIN1XFq%2BDfH8CAEolRnaqG%2FHU10TNtkSyZOKsogtVjgBtvIvtcQ2uj2PhM4ZW77Dr0oZE8%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76fdbb4a18bbfac0-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65274)
Size:   58913
Md5:    a63b2977b01b6e2d2e2086c3f63a3c9a
Sha1:   560409f64e40f5078e1ba8d496657badd7a3a6ee
Sha256: 4a477bb786727bd8c49a1dbc25dd37dcce7f2ceece74576dffd8a3da739b034f
                                        
                                            GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 12457653
expires: Wed, 15 Nov 2023 22:13:26 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xt%2B84PbHc6kiH4kaak%2B2rhe373wACNV5xo5KBZxVYr98GRh9I9bNXMbv0CYpEBCT2GFd77w7evCFFG5aQ0TjVF9LdC6HSUA%2BhKxNl3El1%2BCtxSG59yXIVXSGrQWCsRhDDFUUnc%2FO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76fdbb4a18c4fac0-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (20322)
Size:   6458
Md5:    df9fe6d48e380554eb0ec9687bed3246
Sha1:   207263d754220200c1916edfbda262f62223ecf5
Sha256: 91d57502b7260e6752c2b5f1636d77707929fa9f09da28589691e61816a448f9
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: /8vK2zk1Ft4rl8WTHj/CBA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         54.69.181.45
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: GlXAcppf15vZw9gU9lztIQChAY8=

                                        
                                            GET /assets/css/datepicker.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 818
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:06 GMT
etag: "d07-5c80ac2c970f8-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3335), with no line terminators
Size:   818
Md5:    3240fc33175e0e388f26fbac8bf8cff3
Sha1:   cf1a645948c9ce996e1560b9569f56822c4f9ba8
Sha256: 9077f43ae19f62f65d930304d4f77d3ce23ec0d4ba41e1284dac8702fbc05f96
                                        
                                            GET /jquery-3.3.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         69.16.175.10
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-encoding: gzip
content-length: 30288
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
accept-ranges: bytes
server: nginx
etag: W/"28feccc0-1538f"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1669414406.dop215.sk1.t,1669414406.cds262.sk1.hn,1669414406.cds217.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   30288
Md5:    d549b312f7a7d228b4ec229a6547dfdc
Sha1:   0766794582ad530ec0f8c2595f741086afffa312
Sha256: f6488b2915e0ceee723f4320492511d46c6ba1860d5975d085e6da8913f55f44
                                        
                                            GET /jquery.validation/1.15.0/additional-methods.min.js HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         151.101.85.229
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
etag: W/"4547-g4rGbD7KxrYTawSb3Q4U8vAilSw"
content-encoding: gzip
accept-ranges: bytes
date: Fri, 25 Nov 2022 22:13:26 GMT
age: 2126488
x-served-by: cache-fra-eddf8230100-FRA, cache-bma1639-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5199
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17590)
Size:   5199
Md5:    4c0e8d136f8e41d83cb99f52be04f280
Sha1:   eecf9c91f361ac05dfaa6b7167aea6f0d4ddf7cd
Sha256: 81659fd2d8cc8d38327f4450954654b19dbb8a95a2b1e402e47869f0ca9dddc6
                                        
                                            GET /assets/css/sweeps.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 1639
server: Apache/2.4.41 (Ubuntu)
last-modified: Fri, 02 Sep 2022 17:56:19 GMT
etag: "172c-5e7b572772120-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   1639
Md5:    a5c77602d9ceb6c6450244ffb0baf0d1
Sha1:   0a8756bf9ec23f2957f9165941196551cc046cf7
Sha256: d1bdae39d462d3c7ccb9f86a413c69df0026d2c06558af9b691a0e98bf0cdd4e
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4274
Cache-Control: max-age=140677
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "6380afd9-116"
Expires: Sun, 27 Nov 2022 13:18:03 GMT
Last-Modified: Fri, 25 Nov 2022 12:06:49 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /assets/css/loading_icon_1.css HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: text/css
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 580
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:07 GMT
etag: "db0-5c80ac2ce37a0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   580
Md5:    b6b8913a6a3ad6881037667493551ec5
Sha1:   3daae516738f878875bb15766ca06a2ed9ee442b
Sha256: cc46b8ab8bf6a609d0c9336a46ef8b217c15fb2ecdef548c5c4d6ce6ebdb52cf
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4274
Cache-Control: max-age=140677
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "6380afd9-116"
Expires: Sun, 27 Nov 2022 13:18:03 GMT
Last-Modified: Fri, 25 Nov 2022 12:06:49 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /ads/scripts/site-141028.js HTTP/1.1 
Host: ads.pro-market.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.36.76.115
HTTP/1.1 200 OK
Content-Type: application/x-javascript
                                        
Last-Modified: Tue, 23 Jul 2019 13:39:45 GMT
Server: nginx/1.0.15
Content-Encoding: gzip
Content-Length: 1101
Cache-Control: max-age=86400
Date: Fri, 25 Nov 2022 22:13:26 GMT
Connection: keep-alive
Vary: Accept-Encoding


--- Additional Info ---
Magic:  ASCII text, with very long lines (514), with CRLF line terminators
Size:   1101
Md5:    540b7c85a21cf48ee81735b2ffcc335f
Sha1:   e5eaedc157c73717aab322629e3f1ad8569bc0a1
Sha256: aa2916440a5dc9e91cc213dc3503845a97fe91cfd12fe8e6cd92032b675a4da9
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6202
Cache-Control: max-age=124282
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "63806846-118"
Expires: Sun, 27 Nov 2022 08:44:48 GMT
Last-Modified: Fri, 25 Nov 2022 07:01:26 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "30F7FE6827F485B81F20619454214793CB8063FE"
Expires: Sat, 26 Nov 2022 09:00:00 GMT
Last-Modified: Fri, 25 Nov 2022 21:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 667
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76fdbb4adfe6b4f3-OSL


--- Additional Info ---
Magic:  data
Size:   1462
Md5:    0ae22319156deb8d1d22f73f3ff08cfd
Sha1:   86a2af2bc7a9c8bc86e4e7e9709709b7d5020e88
Sha256: a195694964f124bafeb150edc5eb272220946ac4b57a55af8bc8f0a7688f829a
                                        
                                            GET /recaptcha/api.js?render=6LdnFqEUAAAAAFM5s_aRoZZO_zDhqoVv6uCdscQi HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.164
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
expires: Fri, 25 Nov 2022 22:13:26 GMT
date: Fri, 25 Nov 2022 22:13:26 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   583
Md5:    b411b4a1e7bb27e3166ad9f9a18b0b5b
Sha1:   89af18140b91a4b5bcfda5ba63a8892e68f80c93
Sha256: 061858ed950071974b09307c5d1250a7d2c1c2a0847dcef1e5378ef0afebcaa3
                                        
                                            GET /assets/img/campaign/1249_welcome.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 23920
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 20:33:23 GMT
etag: "5d70-5d7afdc8e1548"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 500 x 300, 8-bit/color RGBA, non-interlaced\012- data
Size:   23920
Md5:    2e24581b6aac99ec3e2297b320425e76
Sha1:   98e9aa8c6a5ab7064f6cf148f4e92fe07d31c914
Sha256: 79ec893d60a62640fa88f45c8c4900e67036a253cf4cddac29fc6da403fa2ff0
                                        
                                            GET /assets/img/sweepstakes250/one.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 801
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:31 GMT
etag: "321-5429f55d7e9c0"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   801
Md5:    03744c9d39310c5d2af2cf2a23616580
Sha1:   603f0d70ddc7d77f6341dc0caf9e0740b33ae061
Sha256: afbc2f9fe529022b98f966b254c8d3173a40998fdd01ee3739df99a8a3169a0b
                                        
                                            GET /assets/img/sweepstakes250/two.png HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/png
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 915
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 01 Dec 2016 21:16:30 GMT
etag: "393-5429f55c8a780"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 58 x 58, 8-bit colormap, non-interlaced\012- data
Size:   915
Md5:    a1914f8236d7704856f5c5762e86c109
Sha1:   ea40712fad474fab16b7e2f1505bcb42302cd6ec
Sha256: 6c21621aeb7ad165ee758074b65bbf2fa35498a74320a940c52a3208375ef26d
                                        
                                            GET /assets/js/datepicker.js HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 5285
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:09 GMT
etag: "42ac-5c80ac2fab258-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (16878)
Size:   5285
Md5:    6c28af1b6fa9301701dfefc5dbfe5159
Sha1:   134cfa1c0a5a837f002034b8ea1a8c6243b96bac
Sha256: 4a47c7c7ccb099528d7387eadcc4989bbbc17d75981507635d015da4711bb932

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4274
Cache-Control: max-age=140677
Date: Fri, 25 Nov 2022 22:13:26 GMT
Etag: "6380afd9-116"
Expires: Sun, 27 Nov 2022 13:18:03 GMT
Last-Modified: Fri, 25 Nov 2022 12:06:49 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 278

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/oswald/v49/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17908
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 21:29:12 GMT
expires: Fri, 24 Nov 2023 21:29:12 GMT
cache-control: public, max-age=31536000
age: 89054
last-modified: Mon, 18 Jul 2022 19:23:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 17908, version 1.0\012- data
Size:   17908
Md5:    e46b4e2e3b47cc232937ebf72b4c537e
Sha1:   2675bc06ee643b8c935370325a327efb74746e6a
Sha256: d8543b5dcaea1fc4a0301dc12b5b2adc9079e0794dd6a45879588fb844f3438e
                                        
                                            GET /s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23040
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 19 Nov 2022 21:11:39 GMT
expires: Sun, 19 Nov 2023 21:11:39 GMT
cache-control: public, max-age=31536000
age: 522107
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23040, version 1.0\012- data
Size:   23040
Md5:    de69cf9e514df447d1b0bb16f49d2457
Sha1:   2ac78601179c3a63ba3f3f3081556b12ddcaf655
Sha256: c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
                                        
                                            GET /releases/v5.15.4/webfonts/fa-solid-900.woff2 HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: font/woff2
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 78268
x-amz-id-2: ajgJELHdKMGXHJ1yIfn0fYKhLriYqoxiR2HrRw/UNT8x3DOqG4W9TzNomFlEpcPK6zHgEfEs/pU=
x-amz-request-id: YHCGQAT6QGXPN18B
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:47 GMT
etag: "d824df7eb2e268626a2dd9a6a741ac4e"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 261011
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4QfLn%2Bzsk7N4w1r3Hqi0VrVrl1RGe%2FS7CTUn82q%2Ftm3Pj%2FBDZJ2rs2FhP7OU0g5Xcm2dd20BevBchPQY6TJatK938Ur3ayhBj6cnBR9Q2b0OFXmFJ%2B4fiaVj%2B0Z%2BiycZZNbvn3fO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 76fdbb4b7a820091-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 78268, version 331.-31196\012- data
Size:   78268
Md5:    d824df7eb2e268626a2dd9a6a741ac4e
Sha1:   0ccb2c814a7e4ca12c4778821633809cb0361eaa
Sha256: 9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
                                        
                                            GET /s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 22 Nov 2022 17:10:21 GMT
expires: Wed, 22 Nov 2023 17:10:21 GMT
cache-control: public, max-age=31536000
age: 277386
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 23580, version 1.0\012- data
Size:   23580
Md5:    e1b3b5908c9cf23dfb2b9c52b9a023ab
Sha1:   fcd4136085f2a03481d9958cc6793a5ed98e714c
Sha256: 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /assets/img/campaign/1249_bg.jpg HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/jpeg
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
content-length: 205247
server: Apache/2.4.41 (Ubuntu)
last-modified: Thu, 10 Feb 2022 20:33:23 GMT
etag: "321bf-5d7afdc8ca618"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3\012- data
Size:   205247
Md5:    73d2b31df9ec1fe0c4e66a01e5e785b0
Sha1:   5fe301ad5e2579be8b15c0f3a1fa85e83e144741
Sha256: ec9b940fa1d7e84102af2028679eaad91995a59b4f47728f2144efac555928c7
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:27 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Fri, 25 Nov 2022 02:10:14 GMT
Expires: Fri, 02 Dec 2022 02:10:13 GMT
Etag: "8579112b833ad73f2e47fa1884f41c637e65a6d1"
Cache-Control: max-age=532005,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76fdbb4bed81b50f-OSL

                                        
                                            GET /generateplacementscript.aspx?placement=13488000&publisher=139136&affid=1249169444874962&subid=1249169444874962 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 109
Date: Fri, 25 Nov 2022 22:13:27 GMT
Content-Length: 702


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (852), with CRLF line terminators
Size:   702
Md5:    3ea10c955fb00abada18a5841e72abae
Sha1:   badfc899d5374ac79ba0d8eec1065df816569e17
Sha256: 903ff048c80923722de746c449ad117158cf1d898a64b57226e23c5c833f364f
                                        
                                            GET /GenericPlacementScriptDiv.aspx?tmgrt=ancs&mainPlacement=13488000&hasLoadOptimation=0&hasMinAssets=1&placement=13488000&publisher=139136&affid=1249169444874962&subid=1249169444874962 HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 109
Date: Fri, 25 Nov 2022 22:13:27 GMT
Content-Length: 4810


--- Additional Info ---
Magic:  HTML document text\012- HTML document, ASCII text, with very long lines (15047), with CRLF line terminators
Size:   4810
Md5:    014d3a5fdb747e21a7e0334daf671c13
Sha1:   de9780af820ca5d8a46d179caf741d10b6d8a375
Sha256: bc2fe8b4cd0922de54702490cc5cfd43f3891f63a6e8750fbe2a1c839fb6b950
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12576
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 22:13:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12576
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 22:13:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12576
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 22:13:27 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81517ad5-7c1b-49aa-9ba9-dbfa36fbb071.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13882
x-amzn-requestid: 9022b0b3-31d5-4149-a969-02514f11b95a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvzNHjMoAMFWMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9347-0e8354a02bef623644714e31;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:40:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ve4q5FDkwMGhPK6ZVVVCZtoBTaGaz43r_PwINzwS5Nx5tcZeQkVIfw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:49:49 GMT
age: 1418
etag: "1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13882
Md5:    64d79191f005c9876b952c5f948aa0f7
Sha1:   1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a
Sha256: 00fb36c3d322e8302c5ce202d6d4119d637510cd6f3b63e1347781ec3bb9d7fc
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11743
x-amzn-requestid: 9ab0aba7-5cd1-4f6c-8984-dc221e1cbf8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cICD-F7joAMFqmA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe3b2-152ba5f1495a44447356cdab;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oWSNdsrz59sJC2znLnFqa_Zm3T14_d6j-rjzDQe4yV22Dy2Qc4Swaw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:54:45 GMT
age: 1122
etag: "b0ddc1555d2506177adcdcea77864d75f1245d07"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11743
Md5:    8784bb7a8b88736a6016f712e3183bf3
Sha1:   b0ddc1555d2506177adcdcea77864d75f1245d07
Sha256: 8e331713b0ad0b5670dd33dfdadde665e076a40ddb80905d4df89876d49803d8
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44e0daff-bc52-4621-aa2f-d9c59da29c1c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3955
x-amzn-requestid: 42c8d309-a8d2-47cc-8d97-c7fa3a63f8cd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cCM9NGJHoAMF4sQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637d8eba-2a06cda9346bd02c46955444;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 03:08:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 5MlzpHpq7auKLSAYikINuPAylXI11VJL3xxIJ9Dyub-7rjQaPfg0WQ==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 02:07:28 GMT
age: 72359
etag: "74cb2ccd6ae38b171bfbe5a74f0eccb09aa3836b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3955
Md5:    4006a9037ab5f28dca62b0aa7a704c41
Sha1:   74cb2ccd6ae38b171bfbe5a74f0eccb09aa3836b
Sha256: 556ae6516a1f272a96569a3637858292731a34e82672b682f6e7442ca68f4b1d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4309
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: blE0hGNioAMF_Tg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 04:38:44 GMT
age: 63283
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    841a4b110022a99ddea6f7bf66df0fa1
Sha1:   126771b86638108050cf57c0d12faa27f80f0edb
Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7993
x-amzn-requestid: 9f0ff853-4819-47cd-959d-658401ea5748
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCsG5mIAMFqAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-1c48b9223684f2942f8dd42d;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 9q3QD5vpCSAMdyE4k9zFl4m6ZqvAhxHeSC2gfbMKoFLmwnLHFQMBZQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:47:10 GMT
age: 1577
etag: "43d1dec7fc06879988c9c3cadd800cc8145df988"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7993
Md5:    92c78302bcce1568eb6a5563100b932c
Sha1:   43d1dec7fc06879988c9c3cadd800cc8145df988
Sha256: 0dda9914306c8e3a7ea75eade8e762652d93907dd6c5a8cc81707d6d8098b60a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00e89fb5-5cb3-4f68-936b-5ee31d6061bc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8006
x-amzn-requestid: 78aab013-df11-464b-a1c7-ee41b7e77b40
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cIB-AHSrIAMFvKw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe38c-4d795f410a57fc2c21d7075d;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:08 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NntLZ3wUdcX9kEo-afFLU0TPKgqAlSK3bToNh2mmoqoyLBJINNk7ow==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:35:09 GMT
age: 2298
etag: "5d15fd672e968d59b541e4d5d0d01cd5e69f4075"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8006
Md5:    8b6ee13d43732f7c764a49500d092865
Sha1:   5d15fd672e968d59b541e4d5d0d01cd5e69f4075
Sha256: fc3623d527147e1c6aab399251ed8d527e6eefdee6ad7183f00df2613498bfe4
                                        
                                            GET /amsus/ldsapi/assets/images/spacer.gif HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: image/gif
                                        
content-length: 43
content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: efd74a02-101e-0053-3887-ff48fc000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0Pph+YwAAAACMktM13ty3QIfUuQiHuU+tQU1TMDRFREdFMTgxOQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAABWe/2QkQ0oSoSUvV4r21C+T1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    325472601571f31e1bf00674c368d335
Sha1:   2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
Sha256: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
                                        
                                            GET /amsus/ns/assets/awesome-font/font-awesome.css?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: text/css
                                        
content-length: 520
content-md5: AExI7hLtZOIj2uUf/9qAyg==
last-modified: Fri, 21 May 2021 11:01:09 GMT
etag: 0x8D91C47BDA9A147
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: b1732e87-001e-0021-42c2-0039c2000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 04qiAYwAAAAAI9YcnA/r1RqdQUUknIN8EQU1TMDRFREdFMTkxNQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAAC8PinnDc3gRqGKYq1miverT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (520), with no line terminators
Size:   520
Md5:    004c48ee12ed64e223dae51fffda80ca
Sha1:   a3a70b71586d8573a400bd4a2a0eb9bf8ec39c17
Sha256: 735903b0b0ffc434c5dd315d19c20594526dd23bcc44480e69edfbe20f4fb117
                                        
                                            GET /amsus/ldsapi/assets/script/standard.min.js?version=20220221n HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: YTnb0ehLGLRubF63e3IyDA==
last-modified: Mon, 21 Feb 2022 16:55:53 GMT
etag: 0x8D9F55B05E46BD0
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 41c881a9-701e-000c-5fc9-ffba02000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0T5V/YwAAAAA/86y4MWBETLgJZmNaHi2RQU1TMDRFREdFMTgxMgAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAAAL6nKGSvFZRY6l6U+GTWhHT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (5818), with no line terminators
Size:   2253
Md5:    3ebd6c48839973e3ed7713907db0f743
Sha1:   7d0354dae64e356abeb2c2dd20d19f5b4219e037
Sha256: ffb4ef2ae69b87097f28d9eba076b0a7e9348a84aaaf719f515dc62e39b8a4af
                                        
                                            POST /ManageImpressions/ReportViaJsCampaign.aspx?hKey=1318997937&affid=1249169444874962&subid=1249169444874962&Placement=13488000&Publisher=139136&CurrentCamps=10023.10023/226/0/225&PreviousCamps=&TrackOn=load&IP_ADDRESS=91.90.42.154&UserEmail=&postfn=beacon&oovar= HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Fri, 25 Nov 2022 22:13:28 GMT
Content-Length: 712


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (351), with CRLF line terminators
Size:   712
Md5:    ef7bbde6feaab8be59ed8a591e03cadb
Sha1:   e9b10ef8a2d1f58de8a88407e4a72d3b59439ede
Sha256: 5423285620fa94b43da474cd993b3f8ae862886440a5945967b1f94ba8462a4c
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:28 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 10:10:16 GMT
Expires: Wed, 30 Nov 2022 10:10:15 GMT
Etag: "e3a100697db6b74f2e6eff7b9d5591c0df7d6869"
Cache-Control: max-age=603464,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 1783
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76fdbb56380eb509-OSL

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5098
Cache-Control: max-age=170323
Date: Fri, 25 Nov 2022 22:13:28 GMT
Etag: "63812071-116"
Expires: Sun, 27 Nov 2022 21:32:11 GMT
Last-Modified: Fri, 25 Nov 2022 20:07:13 GMT
Server: ECS (amb/6BC6)
X-Cache: HIT
Content-Length: 278

                                        
                                            GET /go/api/zip/undefined?get_param=value HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:28 GMT
content-length: 111
server: Apache/2.4.41 (Ubuntu)
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
set-cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr; path=/; HttpOnly; SameSite=Lax
cache-control: no-store, no-cache, must-revalidate, no-store, max-age=0, no-cache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   111
Md5:    4072747d6757278fe77c6970474ad27d
Sha1:   7404af04b7ef1db62f26e0a08fe82ab5a184e901
Sha256: 7d911cc2e66702b54cfca359fb39a67a65259e9ed6706c4a78516d20a4670e6f

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.165
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=88139
Date: Fri, 25 Nov 2022 22:13:28 GMT
Etag: "637fe845-1d7"
Expires: Sat, 26 Nov 2022 22:42:27 GMT
Last-Modified: Thu, 24 Nov 2022 21:55:17 GMT
Server: ECS (dcb/7F5D)
X-Cache: Miss from cloudfront
Via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: JEQomFpFoUS5LUS_x9Mc32XzWSj-84OL1IwRopmC0KdqDecQE1ApvA==
Age: 2830

                                        
                                            GET /amsus/ns/css/13488000.min.css?2725k25j20222725j11ckl25llk144jkk132700 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: text/css
                                        
content-encoding: br
content-md5: WEcI6Omll5/fQKo/f35d8g==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4EA477
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_MISS
x-ms-request-id: b7e20622-f01e-0034-3f1b-01fb5b000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0Bz6BYwAAAAAsTGJKnxHjTooiqRFILGaKQU1TMDRFREdFMTkxMQAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAAB7VgBSJGwHTaGGBygusWdhT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (8788), with no line terminators
Size:   1672
Md5:    01f34651018d3b05116cac8279d30d28
Sha1:   56afa027e6776ba74553cc35ebf9ea51cb909ec7
Sha256: 5ed8ea3745d0d02d11617ca16fea382a99d81c30409b934d7ee666f8d44bb058
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.163
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 162976
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Nov 2022 08:12:22 GMT
expires: Sat, 25 Nov 2023 08:12:22 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 14 Nov 2022 03:01:59 GMT
age: 50467
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (730)
Size:   162976
Md5:    79d18cf4265108d7cecca1bf4ada6109
Sha1:   e51d0285a545381d4c39e9e0292a650ffeeecbb9
Sha256: 59ce7253f371df0833c3f72d4748ef812002b90a49413c56d0ca7c40bb5a0ab6
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Fri, 25 Nov 2022 20:41:08 GMT
expires: Fri, 25 Nov 2022 22:41:08 GMT
cache-control: public, max-age=7200
age: 5541
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   20039
Md5:    47e6f374ca946fddd5b59871b325736c
Sha1:   baa9282efc8785e84d247c3bff518eaa45f101c4
Sha256: 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: monthlysweeps.us
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/go/to/ss28jn/key/87b466de697ace5ec40041db94d83ab1/aid/16944/s1/4874962
Cookie: ci_session=89jag4vi0oso2i3ds465s1nqipdv9pdr
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         54.161.16.68
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
                                        
date: Fri, 25 Nov 2022 22:13:29 GMT
content-length: 5430
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 26 Jul 2021 18:17:08 GMT
etag: "1536-5c80ac2e78fe8"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   5430
Md5:    b0a102991e7332643ae57365023c00c8
Sha1:   4ea4c55c982e08bda104d2e8e981594c067cef24
Sha256: 1dfc58ffbcb07c761f79eb6b46f50b3789bd21e41a0b4cb1aca82b1dd8020fcc
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /api/hitsnap.ashx HTTP/1.1 
Host: ldsapi.tmginteractive.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 10688
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         209.151.244.116
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
                                        
Cache-Control: private
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
X-Service-Ip: 105
Date: Fri, 25 Nov 2022 22:13:29 GMT
Content-Length: 21


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   21
Md5:    8736cdfe08480bca66cffeee06268705
Sha1:   81af0417f969f93848b1cf30fce1db93884facc1
Sha256: 838a7c62adda8d131d694ae13ba2c5b73579aeb0f327d9f23e23880943a8a289
                                        
                                            GET /modules.e1bdbadbcc63daea6270.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.68
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 68720
date: Thu, 24 Nov 2022 08:09:06 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "53db6c810ee48127f87a9c79e206fc67"
last-modified: Thu, 24 Nov 2022 08:08:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 dac7cf040932e0c072eeed10afdd7b3e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: hCO-D_SolC3ug_gQlsN9i52XSMm7OUXT8oz6UYdDp9OIWKbSOeNEmQ==
age: 137063
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (48714)
Size:   68720
Md5:    53db6c810ee48127f87a9c79e206fc67
Sha1:   aa53e521ba10b23524afc519c6e6ba8d1eb5147c
Sha256: f89c4d3c17828a5c54ecc60f5107e2bfe92cb8b4622fb766fda6d1fca1c95fdd
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.165
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=141800
Date: Fri, 25 Nov 2022 22:13:30 GMT
Etag: "6380b14a-1d7"
Expires: Sun, 27 Nov 2022 13:36:50 GMT
Last-Modified: Fri, 25 Nov 2022 12:12:58 GMT
Server: ECS (bsa/EB11)
X-Cache: Miss from cloudfront
Via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 7cdr7uGfphJcvXfLnEuX5wjanDOEbYIXw0LqGxkM1bysE7EEKC0OGg==
Age: 5032

                                        
                                            GET /box-5e66f98b4ee957db209dc6f63e3d59dd.html HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.55.105
HTTP/2 200 OK
content-type: text/html
                                        
content-length: 1035
date: Wed, 23 Nov 2022 13:10:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: zK_pspyLA7Bul3Mv1xsZGInT11j668qNvHdtFID93KyGcqvLqTicsw==
age: 205404
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Size:   1035
Md5:    e0652b84b7b3b650769c759fc520c3f8
Sha1:   0b55d6e28613350c7f41b88f19e726e6751ad03b
Sha256: 94b4c240f83065223dcacdd3f8b69cb229d0616edc3e2041eef3e270d859fc3d
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /2.11.9/GenerateToken?msn=1&pid=7f3483ed-2791-4594-807d-fd651ec22f8b&_=960312916 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 250
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:30 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguserid=ee0d9da2-6ec8-4516-91d8-b10efeaaaa7a; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2

                                        
                                            GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 19 Nov 2022 12:31:58 GMT
expires: Sun, 19 Nov 2023 12:31:58 GMT
cache-control: public, max-age=31536000
age: 553292
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Size:   15344
Md5:    5d4aeb4e5f5ef754e307d7ffaef688bd
Sha1:   06db651cdf354c64a7383ea9c77024ef4fb4cef8
Sha256: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
                                        
                                            GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 21:46:16 GMT
expires: Fri, 24 Nov 2023 21:46:16 GMT
cache-control: public, max-age=31536000
age: 88034
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Size:   15552
Md5:    285467176f7fe6bb6a9c6873b3dad2cc
Sha1:   ea04e4ff5142ddd69307c183def721a160e0a64e
Sha256: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.35
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 25 Nov 2022 22:13:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.165
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=154302
Date: Fri, 25 Nov 2022 22:13:30 GMT
Etag: "6380de5e-1d7"
Expires: Sun, 27 Nov 2022 17:05:12 GMT
Last-Modified: Fri, 25 Nov 2022 15:25:18 GMT
Server: ECS (bsa/EB13)
X-Cache: Miss from cloudfront
Via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: i_yZZm_ycGWDHCo0YtQ7BJFBEQ3B3u_yuM7Zr4uQuF3ae2R17EQ4Qg==
Age: 5995

                                        
                                            GET /iframe.html?token=0D4F2DB8-A059-989F-2270-1AE9167219E6&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=3CCED9A6-4A67-D637-ACDC-CCF79B4A5210&lac=FCB958C1-1AC9-561E-1E7C-7EB79158EEC4 HTTP/1.1 
Host: d2m2wsoho8qq12.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.42.229
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Wed, 12 Oct 2022 20:15:04 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Fri, 25 Nov 2022 16:23:13 GMT
ETag: W/"63472048-dbb"
X-Cache: Hit from cloudfront
Via: 1.1 6cb1d4b545e7beb4ead790454f4807c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: ATAbju9_i238h741LY84mewtjL6561jqbsJw3U-WtR9ZgO0P1-SOhA==
Age: 21137


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   1449
Md5:    ef825b8a88a51cd76a51d08dfc1d4f99
Sha1:   5bf247bd91a4be0c3b76a70ec8e5e462de0e9f3b
Sha256: 2ac453ec379c3e7b0fa69b810ecf2d6771de3e7611a2599a20f8e8ce9a240af1
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.165
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=169338
Date: Fri, 25 Nov 2022 22:13:31 GMT
Etag: "63812d15-1d7"
Expires: Sun, 27 Nov 2022 21:15:49 GMT
Last-Modified: Fri, 25 Nov 2022 21:01:09 GMT
Server: ECS (dcb/7FA4)
X-Cache: Miss from cloudfront
Via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: kYHGMGxDjxBBnjJKJ_UA9X4vldwZRR5xlPiJRpBpm53N-eEvZod4Zw==
Age: 880

                                        
                                            POST /certs HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 645
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         52.54.243.114
HTTP/2 201 Created
content-type: application/json; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:31 GMT
content-length: 475
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (475), with no line terminators
Size:   475
Md5:    e971ca61a3453150f89243ff47cfee25
Sha1:   bf1ba7d397a81abb4f235cb9bf2e2365b1574fc5
Sha256: d3bc7e30e14edd7a1106fff5af3af6ad7a09fc91822b52b7c05c1a1dcf3cdf9f
                                        
                                            GET /trustedform-1.8.30.js HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         54.230.111.111
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Mon, 24 Oct 2022 17:48:28 GMT
x-amz-version-id: C4KqA2Ml8NtIH1tcFWoBNv3GWDN3hi8K
server: AmazonS3
content-encoding: gzip
date: Fri, 25 Nov 2022 22:13:30 GMT
etag: W/"a5b5dad6197e972a745a719bfccfb334"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: JcWS9hKhBWtKGjhxqytSpnp_INjKWTvXPOOIWHCuP_4qGPwjRes1MQ==
age: 16
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37140
Md5:    14487f8960e61adf6ea2ea56a2c0fc4b
Sha1:   95c5c211d96b16b85dd2e7e73ea2074181af33a1
Sha256: 1af41182c48fe7c1f3603dafa7c97803ed41b063a7ee84f566a7eaaff374e41d
                                        
                                            POST /certs/48201ed70a7cc7d64fb0682f63a40701ec642d07/fingerprints HTTP/1.1 
Host: api.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 262
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         52.54.243.114
HTTP/2 204 No Content
                                        
date: Fri, 25 Nov 2022 22:13:31 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers:
cache-control: max-age=0, private, must-revalidate
server: Cowboy
X-Firefox-Spdy: h2

                                        
                                            POST /api/v2/client/sites/2865935/visit-data?sv=6 HTTP/1.1 
Host: in.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain; charset=UTF-8
Content-Length: 130
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         54.171.136.239
HTTP/2 200 OK
content-type: application/json
                                        
date: Fri, 25 Nov 2022 22:13:30 GMT
vary: Accept-Encoding
cache-control: no-cache, no-store
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-max-age: 86400
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   6941
Md5:    a469477b1bdb1a91082072b7f18ab93c
Sha1:   cde1917cf2103484736bbf0b20c5fa5b602afdb1
Sha256: 8dfcaca7e93167875d1926369ec3745b5cfc3cbdf70c152ef8d2e3499ddc800b
                                        
                                            GET /bootstrap/4.1.0/css/bootstrap.min.css HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.11.207
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: SE
cdn-edgestorageid: 723, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-04-23 06:51:23
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: fb769ef43d6803d303a68c7d7f774d4c
cdn-cache: HIT
cf-cache-status: HIT
age: 17521504
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 76fdbb4aaba41c16-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /releases/v5.15.4/css/fontawesome.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
x-amz-id-2: 0vcNhwW5vZodHXrn3PQTHirqtGmgYB/hDMvpNK9RteaT9AtpwacN5ALKKnzZFUszOpt/j9r+pY8=
x-amz-request-id: G5XJ4C8WFSRWXWV7
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"a227f005fa7ae066c1068ac4b963514c"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 200905
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWzBnkBRu6BwAbJhFmPW37lzLa7%2FZ0zcZGnFmBvTwXNxyvOuMRNdi9v7bROummQ0zcBltzAL0V0ejpFMMjE7RNqsgwRXFU%2B7YC9E6s7lhynHVcjQJACR9clAdyyGzyCcg%2BLCi1JT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 76fdbb4ada090091-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/browserdetect.min.js?version=120419 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: Shzc0tuaykHxXX+tfi+uUQ==
last-modified: Fri, 21 May 2021 12:34:19 GMT
etag: 0x8D91C54C1586655
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: cc73a668-501e-0054-0cfa-00be79000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0pA6BYwAAAABFH3Ejl4vfQJHRixn1jhiERlJBMjMxMDUwNDE4MDI5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 0Bz6BYwAAAABC+ZlC+VvTQYVrm4SlbU1yT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ns/js/13488000.min.js?2725k25j20222725j11ckl25llk144jkk132700 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: 9wgtvP0cVsloq3UaPunwsA==
last-modified: Mon, 14 Mar 2022 19:57:50 GMT
etag: 0x8DA05F4EB4E2F58
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_MISS
x-ms-request-id: a3b29791-101e-0053-351b-0148fc000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0Bz6BYwAAAADNSNoXasr6RY884DObJIN6QU1TMDRFREdFMTgxNAAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAADsfrkqPelQRoR6DgkOP2GbT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /c/hotjar-2865935.js?sv=6 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.54
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:28 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/dd1ef69f61cfa02e31905eae07895959
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 72MPcQYjcEloRNY8sbyQGOr7jJwIFirJGhUZUQmvxxStc7Y3xXf47w==
age: 1
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1 
Host: stackpath.bootstrapcdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.11.207
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
cdn-edgestorageid: 565, 718, 718
last-modified: Mon, 25 Jan 2021 22:04:05 GMT
cdn-cachedat: 2021-06-08 18:02:12
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: a9c552a6ef500abddb12a9852509d4ed
cdn-status: 200
cdn-cache: HIT
cf-cache-status: HIT
age: 14860559
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 76fdbb4a2aec1c16-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/InitFormData?msn=3&pid=7f3483ed-2791-4594-807d-fd651ec22f8b&token=0D4F2DB8-A059-989F-2270-1AE9167219E6&_=960312918 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 12855
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:30 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguserid=d9bc1fc1-3e28-42e9-8f08-17475cef931b; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ns/js/offers_extended_functions.min.js HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: JsdJsTroZxL3ol3Owm84Vg==
last-modified: Mon, 07 Mar 2022 22:37:07 GMT
etag: 0x8DA008B03257DBD
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: e0266a90-d01e-004e-698b-fe9116000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0P5h+YwAAAADZhnhz/GA3R4NSHyjXQKZhQU1TMDRFREdFMTkwOAAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0CD6BYwAAAAA2M0dobjd9RprNZroE1wQFT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:28 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /engine?site=141028;size=1x1;e=0;dt=0;category=i1kh9%3A%20%20vgmtitpkdexx1%20ts%20of%20ao%2001u7jo%20b6f%20rfkw56emx1oavme6b418vtubscm02ac9%202zd%209f134%200s%20l8qciy1-%202ec4ofv%205nmbqe;kw=nwelylh056dpt%20lk%20%7C%20ul5nnbt4k%20g1n2%20basl%20%7C%20u6wo7hcjic%209wxmyksalmj;rnd=(1669414407920) HTTP/1.1 
Host: pbid.pro-market.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         107.178.240.89
HTTP/2 200 OK
content-type: text/html
                                        
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
anserver: gapp-eu-4.c.datonics-gcp-01.internal
set-cookie: anProfile="0+1+4=21x+1f=1+1g=2+1j=57:1+rs=s+rt=5B5A2A9A+s0=(95)+s2=(rlxceg)"; Domain=.pro-market.net; Max-Age=15552000; Path=/; Secure; SameSite=None;
pragma: no-cache
cache-control: no-cache, no-store, must-revalidate
expires: Mon, 1 Jan 1990 0:0:0 GMT
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
date: Fri, 25 Nov 2022 22:13:28 GMT
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            POST /2.11.9/SaveDom?msn=2&pid=7f3483ed-2791-4594-807d-fd651ec22f8b&token=0D4F2DB8-A059-989F-2270-1AE9167219E6&_=960312917 HTTP/1.1 
Host: create.leadid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 512
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         50.16.132.247
HTTP/2 200 OK
content-type: text/plain;charset=UTF-8
                                        
date: Fri, 25 Nov 2022 22:13:30 GMT
server: nginx
set-cookie: rgisanonymous=false; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguserid=b160ff02-8e5f-4cb2-8ff3-c5c6716d70a4; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rguuid=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/ rgisanonymous=true; expires=Sun, 25-Dec-2022 22:13:30 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common-extentions.min.js?20221107a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: G3v7pHqbSC0Gvp9zsfwXIA==
last-modified: Wed, 09 Jun 2021 12:26:50 GMT
etag: 0x8D92B41DB6898DE
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 7f7f3c1c-c01e-0037-6255-fff85c000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0NUR+YwAAAADUFoehJoWDQK6rDnwM6BaXQU1TMDRFREdFMTgxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAABn0u6mLXD2Tby2bHrEdOOPT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /releases/v5.15.4/css/solid.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://monthlysweeps.us
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         172.64.132.15
HTTP/2 200 OK
content-type: text/css
                                        
date: Fri, 25 Nov 2022 22:13:26 GMT
x-amz-id-2: IVX8bIAdXzPVxs8xhtUZt6TOmxpdDFxz3cjufRyuqe+MuWJf6GrpvdduLJ444qoiO8jZxMYQxAQ=
x-amz-request-id: YHCTXTQ1P0CM292Z
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 20:43:22 GMT
etag: W/"685a6b10be9f3db25acf78c5e7ba7379"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 261011
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fdf1e3pLc8LT02BgT%2Blwyc1DtTqjAz6qKLilf7mXSUoGOMkKAEKXnEbiBLEPS1mI5fERT1NA%2BLL2%2BQRXm2Of62OPvkXn9xVeUlrPige8Q%2BzXxXdh0YmpmY8J8H6J5cisRWPxZO5P"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 76fdbb4aea110091-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/common.min.js?version=20221107a HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: qsPI/BUdPOJY0zfYlOeYSQ==
last-modified: Mon, 07 Nov 2022 07:18:16 GMT
etag: 0x8DAC0903D88263C
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 2cf11b74-401e-002d-2b8c-fed733000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0NUR+YwAAAAANlRyvVI8zToR7iC/8BjGIQU1TMDRFREdFMTgxNwAyODU5YzAzNS0wZjdmLTQ5ZjktOGY0Ny01ZTE1OGJlMzJjNTU=
x-azure-ref: 0Bz6BYwAAAACL2g2dqzSJRJI6b7hvEH2yT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /amsus/ldsapi/assets/script/clientfp.min.js?version=20211103 HTTP/1.1 
Host: tmgassets.azureedge.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         13.107.219.53
HTTP/2 200 OK
content-type: application/javascript
                                        
content-encoding: br
content-md5: E4ptMzZLxbawD4B7RV5YCQ==
last-modified: Wed, 03 Nov 2021 09:07:36 GMT
etag: 0x8D99EA961032FA1
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-cache: TCP_HIT
x-ms-request-id: 9d095d22-b01e-0055-6612-00bf84000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0pA6BYwAAAACzOcr6En9iRZxxeC3bR54qRlJBMjMxMDUwNDE3MDI5ADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
x-azure-ref: 0Bz6BYwAAAAB6RnAHga+4T67DdTZajReBT1NMMjMxMDUwMjA1MDUzADI4NTljMDM1LTBmN2YtNDlmOS04ZjQ3LTVlMTU4YmUzMmM1NQ==
date: Fri, 25 Nov 2022 22:13:27 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /bootstrap.js?provide_referrer=false&field=trusted_form&l=16694144079450.5707313108724469&invert_field_sensitivity=false HTTP/1.1 
Host: cdn.trustedform.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://monthlysweeps.us/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.111
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Fri, 25 Nov 2022 22:13:30 GMT
last-modified: Mon, 24 Oct 2022 17:48:28 GMT
x-amz-version-id: zf4ijuzvSsU0Tal.ZZJLDHqE7VqwjEi9
etag: W/"647d5353b63df3b4ed201da87c98cc2d"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: MXG-5QFwbfudjqRMVsozrH2HjwyFAQPFZdhwNMGP2J58wQvJ3MiqPw==
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /css?family=Lato:400,700|Oswald:400,600,700 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://monthlysweeps.us/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.10
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 25 Nov 2022 22:13:26 GMT
date: Fri, 25 Nov 2022 22:13:26 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---