r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cd2bda30513692aa11a672c6a599935d
a944c3aa26b461063194a4bb95ce427d23a32d03
d975d1eab40c9fe4986ae0675d79e4f982eb9c0e2f503ca72b3bdf0ec9e7dfdc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D975D1EAB40C9FE4986AE0675D79E4F982EB9C0E2F503CA72B3BDF0EC9E7DFDC"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8741
Expires: Wed, 28 Dec 2022 16:03:39 GMT
Date: Wed, 28 Dec 2022 13:37:58 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 259d3eba2ac4ea32f0410a59bd01c18a
ab02cd69e6c04e3842ad1778fb0daa6d0e86fddc
0d6ec941dac6d97a0b24c0cf00a5642a4edda68ae5ec8b3019d1ec05f40d2281
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0D6EC941DAC6D97A0B24C0CF00A5642A4EDDA68AE5EC8B3019D1EC05F40D2281"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3353
Expires: Wed, 28 Dec 2022 14:33:51 GMT
Date: Wed, 28 Dec 2022 13:37:58 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 28 Dec 2022 12:46:46 GMT
content-type: application/json
age: 3072
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b2d59bdbb1ca6324590988ec031cf1fc
bfd4e25af37dcde4bac38d9b178c5ac8e50f8834
cef2180120ef42ff09d54577229c058d41d2c569d485f5a6dcfadc74bf8aa647
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CEF2180120EF42FF09D54577229C058D41D2C569D485F5A6DCFADC74BF8AA647"
Last-Modified: Mon, 26 Dec 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17768
Expires: Wed, 28 Dec 2022 18:34:06 GMT
Date: Wed, 28 Dec 2022 13:37:58 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: fBUiA0zONwZe0mQAFTGhO93SnzWZlvc1e4MZYemk7MnLVu49DhAMDgAiAGnfjXpj42OYmWpVwr8=
x-amz-request-id: WGS8VVXWZZZYAFZA
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 28 Dec 2022 12:58:19 GMT
age: 2379
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
vv3a1rar924vtest3.siebanpeali.ml/TSKtBH6B?keyword=Tim.bradley@slurpmail.net&sub1=clear&sub3=jtouch.co.ke
302 Found 0 B URL HTTP/1.1 vv3a1rar924vtest3.siebanpeali.ml/TSKtBH6B?keyword=Tim.bradley@slurpmail.net&sub1=clear&sub3=jtouch.co.ke
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ml domain
GET /TSKtBH6B?keyword=Tim.bradley@slurpmail.net&sub1=clear&sub3=jtouch.co.ke HTTP/1.1
Host: vv3a1rar924vtest3.siebanpeali.ml
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: nginx/1.22.1
Date: Wed, 28 Dec 2022 13:37:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Location: https://dateexotic.com/agEA?usid=s8hnpa1797ug&email=Tim.bradley%40slurpmail.net&sub1=clear_main&prid=s8hnpa1797ug
Pragma: no-cache
Set-Cookie: _subid=s8hnpa1797ug;Expires=Saturday, 28-Jan-2023 13:37:58 GMT;Max-Age=2678400;Path=/
b15e4=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjk4XCI6MTY3MjIzNDY3OH0sXCJjYW1wYWlnbnNcIjp7XCIzM1wiOjE2NzIyMzQ2Nzh9LFwidGltZVwiOjE2NzIyMzQ2Nzh9In0.h3ryvjJyTtXGY2xS1DJL8ID2h-Hh_YAHUJuI3Czued4;Expires=Thursday, 26-Dec-2075 03:15:56 GMT;Max-Age=1672321078;Path=/
_token=uuid_s8hnpa1797ug_s8hnpa1797ug63ac46b6d74303.57685482;Expires=Saturday, 28-Jan-2023 13:37:58 GMT;Max-Age=2678400;Path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 28 Dec 2022 13:37:58 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 221cc619262af5c584e0d6859db2381a
5b9c555c0d394a08f85814bfecba63280d44534c
dffb165faaf053047adf76129160fc8665867d1317e70b74180b0e80cc53ae11
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "DFFB165FAAF053047ADF76129160FC8665867D1317E70B74180B0E80CC53AE11"
Last-Modified: Tue, 27 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12361
Expires: Wed, 28 Dec 2022 17:04:00 GMT
Date: Wed, 28 Dec 2022 13:37:59 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 221cc619262af5c584e0d6859db2381a
5b9c555c0d394a08f85814bfecba63280d44534c
dffb165faaf053047adf76129160fc8665867d1317e70b74180b0e80cc53ae11
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "DFFB165FAAF053047ADF76129160FC8665867D1317E70B74180B0E80CC53AE11"
Last-Modified: Tue, 27 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12361
Expires: Wed, 28 Dec 2022 17:04:00 GMT
Date: Wed, 28 Dec 2022 13:37:59 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, ETag, Pragma, Last-Modified, Expires, Alert, Content-Type, Retry-After, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 28 Dec 2022 13:33:30 GMT
age: 269
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 125553386d49a0b56facb82deab9bd9f
1a7480b79f4aada477fb5919794f6efd6d44921e
6f3f4223d3c994dd4754df67a11298d736e16f888f301ad2838d0b4db1ac01d7
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3877
Cache-Control: max-age=160405
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:37:59 GMT
Etag: "63ac0727-1d7"
Expires: Fri, 30 Dec 2022 10:11:24 GMT
Last-Modified: Wed, 28 Dec 2022 09:06:47 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/s/gts1p5/Ixty6-fFKeo
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/Ixty6-fFKeo
IP
Hash a95c8e6ec3e33f3d0f06c046c5f076a2
b5763c46c45aab590429a882322c643178eb47ee
2ab9809c40ae351db17efb1baee8fa1c7422a1539cca17c1fc8255405eb158d8
POST /s/gts1p5/Ixty6-fFKeo HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:00 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
alexatracker.com/?r=aHR0cHM6Ly93d3cyLmRhdGVleG90aWMuY29tL2FnRUE%2FdXNpZD1zOGhucGExNzk3dWcmZW1haWw9VGltLmJyYWRsZXklNDBzbHVycG1haWwubmV0JnN1YjE9Y2xlYXJfbWFpbiZwcmlkPXM4aG5wYTE3OTd1ZyZiZGF0YT1leUprWVhSaElqcDdJbkJzWVhSbWIzSnRJam9pVEdsdWRYZ2dlRGcyWHpZMEluMHNJbVY0ZEhKaElqcDdJazVoZG1sbllYUnZjaTV3YkdGMFptOXliU0k2V3lKTWFXNTFlQ0J3YkdGMFptOXliU0JoYm1RZ1YybHVaRzkzY3lCMWMyVnlJR0ZuWlc1MElHUnZJRzV2ZENCdFlYUmphQ0pkZlN3aVpYSnliM0p6SWpwN0ltbG1jbUZ0WlNJNld5SmpZVzRuZENCaFkyTmxjM01nY0hKdmNHVnlkSGtnWENKaGNIQmxibVJEYUdsc1pGd2lMQ0JrYjJOMWJXVnVkQzVpYjJSNUlHbHpJRzUxYkd3aVhTd2lZMkZ1ZG1GelgyTnZiblJsZUhRaU9sc2lSbUZwYkdWa0lIUnZJR2RsZENCallXNTJZWE1nWTI5dWRHVjRkQ0pkZlN3aVltOTBVMk52Y21VaU9pSXlOQ0o5&h=580a8357caf2431bbbcc66b14b1eadfa
301 Moved Permanently 0 B URL HTTP/2 alexatracker.com/?r=aHR0cHM6Ly93d3cyLmRhdGVleG90aWMuY29tL2FnRUE%2FdXNpZD1zOGhucGExNzk3dWcmZW1haWw9VGltLmJyYWRsZXklNDBzbHVycG1haWwubmV0JnN1YjE9Y2xlYXJfbWFpbiZwcmlkPXM4aG5wYTE3OTd1ZyZiZGF0YT1leUprWVhSaElqcDdJbkJzWVhSbWIzSnRJam9pVEdsdWRYZ2dlRGcyWHpZMEluMHNJbVY0ZEhKaElqcDdJazVoZG1sbllYUnZjaTV3YkdGMFptOXliU0k2V3lKTWFXNTFlQ0J3YkdGMFptOXliU0JoYm1RZ1YybHVaRzkzY3lCMWMyVnlJR0ZuWlc1MElHUnZJRzV2ZENCdFlYUmphQ0pkZlN3aVpYSnliM0p6SWpwN0ltbG1jbUZ0WlNJNld5SmpZVzRuZENCaFkyTmxjM01nY0hKdmNHVnlkSGtnWENKaGNIQmxibVJEYUdsc1pGd2lMQ0JrYjJOMWJXVnVkQzVpYjJSNUlHbHpJRzUxYkd3aVhTd2lZMkZ1ZG1GelgyTnZiblJsZUhRaU9sc2lSbUZwYkdWa0lIUnZJR2RsZENCallXNTJZWE1nWTI5dWRHVjRkQ0pkZlN3aVltOTBVMk52Y21VaU9pSXlOQ0o5&h=580a8357caf2431bbbcc66b14b1eadfa
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?r=aHR0cHM6Ly93d3cyLmRhdGVleG90aWMuY29tL2FnRUE%2FdXNpZD1zOGhucGExNzk3dWcmZW1haWw9VGltLmJyYWRsZXklNDBzbHVycG1haWwubmV0JnN1YjE9Y2xlYXJfbWFpbiZwcmlkPXM4aG5wYTE3OTd1ZyZiZGF0YT1leUprWVhSaElqcDdJbkJzWVhSbWIzSnRJam9pVEdsdWRYZ2dlRGcyWHpZMEluMHNJbVY0ZEhKaElqcDdJazVoZG1sbllYUnZjaTV3YkdGMFptOXliU0k2V3lKTWFXNTFlQ0J3YkdGMFptOXliU0JoYm1RZ1YybHVaRzkzY3lCMWMyVnlJR0ZuWlc1MElHUnZJRzV2ZENCdFlYUmphQ0pkZlN3aVpYSnliM0p6SWpwN0ltbG1jbUZ0WlNJNld5SmpZVzRuZENCaFkyTmxjM01nY0hKdmNHVnlkSGtnWENKaGNIQmxibVJEYUdsc1pGd2lMQ0JrYjJOMWJXVnVkQzVpYjJSNUlHbHpJRzUxYkd3aVhTd2lZMkZ1ZG1GelgyTnZiblJsZUhRaU9sc2lSbUZwYkdWa0lIUnZJR2RsZENCallXNTJZWE1nWTI5dWRHVjRkQ0pkZlN3aVltOTBVMk52Y21VaU9pSXlOQ0o5&h=580a8357caf2431bbbcc66b14b1eadfa HTTP/1.1
Host: alexatracker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dateexotic.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Wed, 28 Dec 2022 13:38:00 GMT
content-length: 0
location: https://www2.dateexotic.com/agEA?usid=s8hnpa1797ug&email=Tim.bradley%40slurpmail.net&sub1=clear_main&prid=s8hnpa1797ug&bdata=eyJkYXRhIjp7InBsYXRmb3JtIjoiTGludXggeDg2XzY0In0sImV4dHJhIjp7Ik5hdmlnYXRvci5wbGF0Zm9ybSI6WyJMaW51eCBwbGF0Zm9ybSBhbmQgV2luZG93cyB1c2VyIGFnZW50IGRvIG5vdCBtYXRjaCJdfSwiZXJyb3JzIjp7ImlmcmFtZSI6WyJjYW4ndCBhY2Nlc3MgcHJvcGVydHkgXCJhcHBlbmRDaGlsZFwiLCBkb2N1bWVudC5ib2R5IGlzIG51bGwiXSwiY2FudmFzX2NvbnRleHQiOlsiRmFpbGVkIHRvIGdldCBjYW52YXMgY29udGV4dCJdfSwiYm90U2NvcmUiOiIyNCJ9&tbsession=4373624383838373560&c=3235032885
set-cookie: trbarid=4373624383838373560;expires=Fri, 27 Dec 2024 13:38:00 GMT;secure;HttpOnly;SameSite=None;path=/
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=An4MsYjH67criPfsfBMF8F0CXq5x8w4TLx3%2Bs%2Bl6FoixAbDpLNZ25Bp2hK6857KFNeJKJ2Pro8jWvVC9chBJEZYl0VYn62f%2B%2FxPn8s5l4RZYiwjtzaZE42PMiN6xVP8ODKlF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 780ab19e9d850b51-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: EuhNL3hpnGc1xnbuCN8KAw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: vmrCIZB3QAOse3Hs0CtEV6DcoQ4=
ocsp.pki.goog/s/gts1p5/Ixty6-fFKeo
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/Ixty6-fFKeo
IP
Hash a95c8e6ec3e33f3d0f06c046c5f076a2
b5763c46c45aab590429a882322c643178eb47ee
2ab9809c40ae351db17efb1baee8fa1c7422a1539cca17c1fc8255405eb158d8
POST /s/gts1p5/Ixty6-fFKeo HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:00 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1a232b586d7c3b69a171dc3486add990
0ffc9432fe723b5dacbf11a041e67e506020f907
5694731f427cfc05f050dfd66f29f61869e69042cd409a0690f27e145f1eaf42
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5694731F427CFC05F050DFD66F29F61869E69042CD409A0690F27E145F1EAF42"
Last-Modified: Tue, 27 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5079
Expires: Wed, 28 Dec 2022 15:02:39 GMT
Date: Wed, 28 Dec 2022 13:38:00 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c6af90f016d8e2a96c05a34ddb9ebbab
f1440025eeec8413fbe4e8d6a49779d1c8cdd9ef
77c0e58bd42f70ec82dcbc502a00e4cca6bf4c198c049a2a0181ba6008d14441
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
js.sentry-cdn.com/f44bbfb9a37b4915ac9fa50036de00f6.min.js
200 OK 1.0 kB URL HTTP/2 js.sentry-cdn.com/f44bbfb9a37b4915ac9fa50036de00f6.min.js
IP
File type ASCII text, with very long lines (512)
Hash d548360cb4077c2320c36c852e064404
1a37ea780083adf3e7b7c2adca304a0245e8e34d
7450c76e791c7553acf1b81f4d9862f2c46759d897c47666bea4a2493c46b303
GET /f44bbfb9a37b4915ac9fa50036de00f6.min.js HTTP/1.1
Host: js.sentry-cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://her-cupid.com
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-envoy-attempt-count: 1
x-envoy-upstream-service-time: 15
content-encoding: gzip
accept-ranges: bytes
date: Wed, 28 Dec 2022 13:38:01 GMT
age: 21
x-served-by: getsentry-web-default-common-production-669bc4569f-2w2m5, cache-bma1671-BMA
vary: Accept-Encoding
timing-allow-origin: https://sentry.io
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 1021
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c6af90f016d8e2a96c05a34ddb9ebbab
f1440025eeec8413fbe4e8d6a49779d1c8cdd9ef
77c0e58bd42f70ec82dcbc502a00e4cca6bf4c198c049a2a0181ba6008d14441
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c6af90f016d8e2a96c05a34ddb9ebbab
f1440025eeec8413fbe4e8d6a49779d1c8cdd9ef
77c0e58bd42f70ec82dcbc502a00e4cca6bf4c198c049a2a0181ba6008d14441
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10132
Expires: Wed, 28 Dec 2022 16:26:53 GMT
Date: Wed, 28 Dec 2022 13:38:01 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10132
Expires: Wed, 28 Dec 2022 16:26:53 GMT
Date: Wed, 28 Dec 2022 13:38:01 GMT
Connection: keep-alive
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
200 OK 31 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
File type ASCII text, with very long lines (65451)
Hash 903bc7a7e510f87aa5d0201eb59a0832
ac9aa4dd94cde1bcba9037e94087138b127e41fc
41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 28 Dec 2022 13:02:27 GMT
expires: Thu, 28 Dec 2023 13:02:27 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 2134
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10132
Expires: Wed, 28 Dec 2022 16:26:53 GMT
Date: Wed, 28 Dec 2022 13:38:01 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b970ffab86fbe4a36726473524096ed1
92bc9a2cc454608eae4e310456f2ec180d4ccdca
9d9377466c1d69d25cbde0092dbebb8579ba3f172a001e3068690c7d7efc779c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9103
x-amzn-requestid: d35b52dd-fc72-47ca-8232-00e48cd6d209
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0z_EEruIAMFlQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab66c6-574a052f67683ba238966de5;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:42:30 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ohxADRAP902PofikgbhHb6N0yLainQlafqatm4eBQ1u5DHGr1r15Fg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 22:05:36 GMT
age: 55945
etag: "92bc9a2cc454608eae4e310456f2ec180d4ccdca"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg
200 OK 4.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ae5da67479fa2f3afda50a7566b5e46e
d71de1881ea09f0aed36703f95635cc0cd552429
a67eca901c4f8436074f48a594cd9942742430c8776745152baf3f858a9c3407
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4443
x-amzn-requestid: 6ca832c3-dcdc-4fc3-bb60-6868d09f824b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0y_zFEOoAMF9KQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab6531-0a9be43a500ea8b41200cc43;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VvXODqjCpshzmjPEPpfo9vYkptKA-JEjqereJgM_8WqhMLJUC-a_0w==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 22:04:23 GMT
etag: "d71de1881ea09f0aed36703f95635cc0cd552429"
content-type: image/jpeg
age: 56018
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a022f080982dddeaf2decce39bf2f1f7
dd9cb19eb6008d3558f60332bc16c83108474f66
fe2c473fa2e8bb50ead0a1faef96024d711c765330b887e72f53219e96adaf20
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5888
x-amzn-requestid: c2212a71-2743-49ed-80fe-5319f266932a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0y_0FUgoAMF1dA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab6531-05343b8c4c574b530118c293;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: E9gjc0GrMNyiChebZDcRKpM8isaP2_IctY5n3_5G2VFzF9xkcKotRA==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 22:08:00 GMT
age: 55801
etag: "dd9cb19eb6008d3558f60332bc16c83108474f66"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8ab36b0d168174ef2d960be9810fdb2d
7c8a7415cab3ef88b5d1204af214a687b1676dda
a1d842fd02273603db0090d34c317d7a3ce3e5f00f29271d45fc4ed6d09ee21e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7817
x-amzn-requestid: 21a68509-6fec-48b3-8bce-fb2ebfab3289
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0yuCEVwIAMFUrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab64c0-5e23ceec731631d93e01e2c8;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:33:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XW37o6TY-ynuySDq8QgtRV96fMBxkZeslHuLJNWBDLaiSz-fHJSQDA==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:35:40 GMT
age: 57741
etag: "7c8a7415cab3ef88b5d1204af214a687b1676dda"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2802b3e9-0a7b-4384-abe0-5d84d1cde92f.jpeg
200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2802b3e9-0a7b-4384-abe0-5d84d1cde92f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5b5bce6cae03ce2c843809467165891e
71a8a2440c66ae80bf577c4d7f32525b6597ed8f
59b0c452ef6bb9a68f7fb7ee2caca66d66d137f7cd498d1fd88bb5f2f4d90ace
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2802b3e9-0a7b-4384-abe0-5d84d1cde92f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8057
x-amzn-requestid: 3e067f3c-c98a-4aa5-88f0-7ec61df01ea5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dxfXYF20IAMFU5g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63aa1295-0dfe81b80a016e59489b2980;Sampled=0
x-amzn-remapped-date: Mon, 26 Dec 2022 21:31:01 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Thnu8K9Xq4Y23F7vbJ1kHjGljIwfOnN5Y_1xpvnHsfYebLDezA0A-g==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:45:35 GMT
age: 57146
etag: "71a8a2440c66ae80bf577c4d7f32525b6597ed8f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62f83de5-47cd-4586-9dca-ab7c314cbd0e.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62f83de5-47cd-4586-9dca-ab7c314cbd0e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d9dcccae2018607dee1459081249c91e
2ecfa42f64013afc536c16fcd2250d8229f81654
41839d89192ec4771a6cd5a431617c0b7855701f93c722d025d3f056f109b552
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62f83de5-47cd-4586-9dca-ab7c314cbd0e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10839
x-amzn-requestid: 70cc8d68-0917-472f-9d64-1d4f708791e4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0yuVGkHoAMFskg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab64c1-2aba103f6a75466c19ddbbd6;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:33:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: _XWlZ2SqSaIrAaT7MXl21X7zkIAoFsj4Tyf5jN7JLcrsuL9g1T9zdQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:35:45 GMT
age: 57736
etag: "2ecfa42f64013afc536c16fcd2250d8229f81654"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:100,400,700,900
200 OK 21 kB URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:100,400,700,900
IP
File type ASCII text, with very long lines (58999)
Hash ca74d91e05d2d9937738dd7a227a9675
b9fd8dd5a59c771e5c58b10fcc560c09b9d4bf73
f1d644de8d19bf7cc6e1a44c193b58b84ef09ea0100b0729bfe1c074da1a0443
GET /css?family=Montserrat:100,400,700,900 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 28 Dec 2022 13:38:01 GMT
date: Wed, 28 Dec 2022 13:38:01 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c6af90f016d8e2a96c05a34ddb9ebbab
f1440025eeec8413fbe4e8d6a49779d1c8cdd9ef
77c0e58bd42f70ec82dcbc502a00e4cca6bf4c198c049a2a0181ba6008d14441
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c6af90f016d8e2a96c05a34ddb9ebbab
f1440025eeec8413fbe4e8d6a49779d1c8cdd9ef
77c0e58bd42f70ec82dcbc502a00e4cca6bf4c198c049a2a0181ba6008d14441
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/EmMTM2F0_rU
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/EmMTM2F0_rU
IP
Hash e65fc229b96f29a49fd5dc9e5a214c8f
7a570dc5fb593ea5fa4e24632fc0013b815d5f05
1617e7b579e3d185a1e7adba8a9b0e1be01064a042c7086bed044d818e2bdf3a
POST /s/gts1p5/EmMTM2F0_rU HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 31b2ef5d11c9d14470dd3ceed60af057
02a1385b9473ee54a5705167e04d931777602b71
b370967fc272d097efe25838bdb96105938f64e53c94e3c700aac6c4781ff2d7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B370967FC272D097EFE25838BDB96105938F64E53C94E3C700AAC6C4781FF2D7"
Last-Modified: Wed, 28 Dec 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9916
Expires: Wed, 28 Dec 2022 16:23:17 GMT
Date: Wed, 28 Dec 2022 13:38:01 GMT
Connection: keep-alive
o65532.ingest.sentry.io/api/6161109/envelope/?sentry_key=f44bbfb9a37b4915ac9fa50036de00f6&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.28.1
200 OK 2 B URL HTTP/2 o65532.ingest.sentry.io/api/6161109/envelope/?sentry_key=f44bbfb9a37b4915ac9fa50036de00f6&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.28.1
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
POST /api/6161109/envelope/?sentry_key=f44bbfb9a37b4915ac9fa50036de00f6&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.28.1 HTTP/1.1
Host: o65532.ingest.sentry.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://her-cupid.com/
Content-Type: text/plain;charset=UTF-8
Origin: https://her-cupid.com
Content-Length: 426
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: application/json
content-length: 2
access-control-allow-origin: https://her-cupid.com
access-control-expose-headers: x-sentry-rate-limits, x-sentry-error, retry-after
vary: Origin
x-envoy-upstream-service-time: 0
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9050ee54dae26344646b208a231fc770
a19ae5a4a8f9c28bca52aa8ea55c7313f99e0936
8ab388c1272cd2c6c2137a27f8e021744126f6fc7df5043756a04dac50857436
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-1.webp
200 OK 30 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-1.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 89bed1df07d0561082775600a7b4dffc
c1456d2202279838618660a9405f480af3042b7d
f35ed3356d652ea6a4a3a437d7b4d00cdfa5a766a2cc34ea994f4c814e754a6c
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-1.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 29802
last-modified: Mon, 03 Aug 2020 11:47:45 GMT
etag: "5f27f961-746a"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/EmMTM2F0_rU
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/EmMTM2F0_rU
IP
Hash e65fc229b96f29a49fd5dc9e5a214c8f
7a570dc5fb593ea5fa4e24632fc0013b815d5f05
1617e7b579e3d185a1e7adba8a9b0e1be01064a042c7086bed044d818e2bdf3a
POST /s/gts1p5/EmMTM2F0_rU HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9050ee54dae26344646b208a231fc770
a19ae5a4a8f9c28bca52aa8ea55c7313f99e0936
8ab388c1272cd2c6c2137a27f8e021744126f6fc7df5043756a04dac50857436
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9050ee54dae26344646b208a231fc770
a19ae5a4a8f9c28bca52aa8ea55c7313f99e0936
8ab388c1272cd2c6c2137a27f8e021744126f6fc7df5043756a04dac50857436
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css?family=Oswald:700
200 OK 11 kB URL HTTP/2 fonts.googleapis.com/css?family=Oswald:700
IP
Hash d59935e8298a37c45a484594ebf74a26
0f647bfd0e72202fd9839c3d4f2d0d2db06edcee
fde67485ba963cd27a2709e8f65862e3ff7e00ecf1a26d7df3ea153f211fa3e8
GET /css?family=Oswald:700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 28 Dec 2022 13:38:01 GMT
date: Wed, 28 Dec 2022 13:38:01 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 31b2ef5d11c9d14470dd3ceed60af057
02a1385b9473ee54a5705167e04d931777602b71
b370967fc272d097efe25838bdb96105938f64e53c94e3c700aac6c4781ff2d7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B370967FC272D097EFE25838BDB96105938F64E53C94E3C700AAC6C4781FF2D7"
Last-Modified: Wed, 28 Dec 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9916
Expires: Wed, 28 Dec 2022 16:23:17 GMT
Date: Wed, 28 Dec 2022 13:38:01 GMT
Connection: keep-alive
fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
200 OK 31 kB URL HTTP/2 fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Hash ac0d2859ea5f8fd6bcb3c305c08ec184
7f6c17e3e592cd8bd346b9cc261d8dd961b8aef7
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
GET /s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://her-cupid.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 30928
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 23 Dec 2022 07:08:09 GMT
expires: Sat, 23 Dec 2023 07:08:09 GMT
cache-control: public, max-age=31536000
age: 455392
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
IP
Hash 8d1bb574aafc1070a33faa912893c84d
0641511c290f8817861497f7173c390c20a2d553
53417638090b1e7dc287b8cb7050cecc84cd247d3786230133c72a726693f7d9
POST /s/gts1p5/K0TBC4DjskA HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 9050ee54dae26344646b208a231fc770
a19ae5a4a8f9c28bca52aa8ea55c7313f99e0936
8ab388c1272cd2c6c2137a27f8e021744126f6fc7df5043756a04dac50857436
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
IP
Hash 8d1bb574aafc1070a33faa912893c84d
0641511c290f8817861497f7173c390c20a2d553
53417638090b1e7dc287b8cb7050cecc84cd247d3786230133c72a726693f7d9
POST /s/gts1p5/K0TBC4DjskA HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-2.webp
200 OK 30 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-2.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 7a14d6654f06cf115f1bfa361b6133f4
be7c7984440b7fca15a2dba45e9727f83c7ed5a7
63008d1cf81485851d5d2136644923f9a778fcf2a4e874e5ea718fc426a02fbc
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-2.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 29526
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-7356"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-3.webp
200 OK 32 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-3.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 0a776348771c52ebdedbae6aec1a21bb
6b2d5183853987c743ae74bbb8d1977e91e58542
6bdae8b55844e8ca25ad6422da39ac01f362f3ffb3bb9c8b020cfaf0b146169e
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-3.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 31946
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-7cca"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-4.webp
200 OK 31 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-4.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 8ff3901573b3b7571c19f57460bd64ab
ab0478e05e29ceca93cce58fcc9e628287899fe9
dc893e9b7abe8a4ab2cfeb8924f833fcb43a16f560e1793e8fdb906e9a6aefbb
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-4.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 31114
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-798a"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-5.webp
200 OK 29 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-5.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash d0be4db567029a82f6b2abb8a598047f
54fc8433892867b4f1b04010fda6432bfc8dc672
47aedcc05f343844b3db56c484fb5c2821d3fa4985a405ac86febe1604f6d1e5
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-5.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 29010
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-7152"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-6.webp
200 OK 27 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-6.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 212ab1ac3dd4c0571230527cd14608b5
5d095508ce1777610120bf7dff74eecab451c9d9
d9d36905a77e8ff1e9893c618aaa63770c83217ea01cf2744a0279d02ff0d568
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-6.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 27214
last-modified: Mon, 03 Aug 2020 11:47:45 GMT
etag: "5f27f961-6a4e"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-7.webp
200 OK 20 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-7.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 531177239b443129aa3c4a7df46587a0
d10b5d62feac76a5023a60b1e858c152985ac781
43fc687f4ff9435f336a4c020dd653830c82c07a827b0cc78faae5be2076080d
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-7.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 20464
last-modified: Mon, 03 Aug 2020 11:47:45 GMT
etag: "5f27f961-4ff0"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-8.webp
200 OK 32 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-8.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash ed47b38a109df684d6f47d847baba3ce
42804d2a2f18ea6899033cb513ae25e2412be1da
fd71ee9e633f59c1218eb20e865121e1d0c51d31dfbe04d210ff54c2a5528ce3
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-8.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 32216
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-7dd8"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-9.webp
200 OK 49 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-9.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash 3d3e96d7abdf026fe492e7937f2a59cc
890ba98493246b4ced8317ffb371e95596e630ce
411c4615e4d3d050066ef0ae6ef6e69e7702bc02c0c4e267b26076a47ffd14b2
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-9.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 49118
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-bfde"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/3-1.png
200 OK 480 B URL HTTP/2 her-cupid.com/static/AwAA/3-1.png
IP
File type PNG image data, 45 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 37ad09484eb1a7e103c1bba69ec3408d
950c14767d959c154d2ba2ceaa7867b8809731e5
1a34fa1f236912eddc8817954583103dfb3ee754301a3745010fa09903c2f2a2
GET /static/AwAA/3-1.png HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2V9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/png
content-length: 480
last-modified: Mon, 03 Aug 2020 11:47:36 GMT
etag: "5f27f958-1e0"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/3-2.png
200 OK 535 B URL HTTP/2 her-cupid.com/static/AwAA/3-2.png
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 7621845db78d7540608060c63a721252
b24bca5f9e3ca0daf6f0f4822d66febc5c65d169
5368506adbbdfa70cffa4f9cf91127edd324af89c40e14cc273fe7e0d322adf1
GET /static/AwAA/3-2.png HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2V9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/png
content-length: 535
last-modified: Mon, 03 Aug 2020 11:47:36 GMT
etag: "5f27f958-217"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-10.webp
200 OK 21 kB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/pic-10.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Hash b914513208055760188667de39db6716
04ae5f3be7a1c7bea6dd09cce098ee9edef554cb
70894006834d4a2a1dcb6029cd29e86f14b9a7e03e8017304669ebd3d3bfec62
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/pic-10.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 21094
last-modified: Mon, 03 Aug 2020 11:47:45 GMT
etag: "5f27f961-5266"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
app.api-push.com/get-keys
204 No Content 0 B URL HTTP/2 app.api-push.com/get-keys
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /get-keys HTTP/1.1
Host: app.api-push.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://her-cupid.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
date: Wed, 28 Dec 2022 13:38:01 GMT
vary: Origin
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-headers: content-type
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TD4gLC2VIAN9agAFgiQql02C2sulSSobcYA1Px6jiQgEPLEGHFNkCf%2BcURxE8pcPWQ1yos%2BQsit3ksqaesqdbMuhfZvW5TRP%2FOrFOmZEkRzD5qKo8zLMoKf%2BUMzYyT0zyUxa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 780ab1a7bea272f4-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/K0TBC4DjskA
IP
Hash 8d1bb574aafc1070a33faa912893c84d
0641511c290f8817861497f7173c390c20a2d553
53417638090b1e7dc287b8cb7050cecc84cd247d3786230133c72a726693f7d9
POST /s/gts1p5/K0TBC4DjskA HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:01 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-center-bottom-ql.webp
200 OK 1.0 MB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-center-bottom-ql.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 1.0 MB (1031120 bytes)
Hash ed3e40b68948820502bbf1716eae56b2
50ae8497f4d8bea52c4cb2c0177bc5be25c8b263
d977d9f29ccba9faae1ffea2dd6b1fa30a8194abe92cec1a4c2fee8dbca18e13
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/gif-center-bottom-ql.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 1031120
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-fbbd0"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-4.webp
200 OK 1.6 MB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-4.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 1.6 MB (1637252 bytes)
Hash 10d4826a92e3fc1e4dbbf0be274bc061
9f4c667c8d1000c30789dc1f9b837803096b5b4f
a78e89556b22804599224527cfe8273a6edbe84d3458e9fb582079addf86011b
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/gif-4.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 1637252
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-18fb84"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-1.webp
200 OK 1.3 MB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-1.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 1.3 MB (1270992 bytes)
Hash 6e76e71ebf7277bce1079af604723e23
c8fcbea450f77451ce8a6709c54c979e70507ca1
085be44516153804017cb6d998e5b39372a7caa480593c80f97c2c24dfab3de8
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/gif-1.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 1270992
last-modified: Mon, 03 Aug 2020 11:47:45 GMT
etag: "5f27f961-1364d0"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-2.webp
200 OK 2.5 MB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-2.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 2.5 MB (2464052 bytes)
Hash 5ea931f6f8f26a124460551efe002ac4
36e800547ef0feaa5d7a7ac69e5a24b66c81f907
f8e38aed3d19c1771bafe0bab8e336732fcf527dae61034e4c25c66251a170ea
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/gif-2.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 2464052
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-259934"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-3.webp
200 OK 1.6 MB URL HTTP/2 her-cupid.com/static/AwAA/images/en/pics-for-bg/gif-3.webp
IP
File type RIFF (little-endian) data, Web/P image\012- data
Size 1.6 MB (1640424 bytes)
Hash c2c8cf2a99d71b95804d661f795b5ce9
5ca43250f3c7bc1a67295381f430df71bffa3a6f
12a310bfa2100acb12ae355b75594e42bed1e75d693778c26f1842ba5a26da04
Analyzer Verdict Alert fortinet Phishing
GET /static/AwAA/images/en/pics-for-bg/gif-3.webp HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: image/webp
content-length: 1640424
last-modified: Mon, 03 Aug 2020 11:47:48 GMT
etag: "5f27f964-1907e8"
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 313 B IP
Hash fb730ab1faf4aae47aa1b45478208452
8a0154bbf5fa099f1c4b1f21fc292e629b14ee1f
9fd4e5ce03e0e706f6704ccb1d7b709fda08a4789bf6a5268e248c3e7fd20240
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5339
Cache-Control: max-age=113638
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 13:38:02 GMT
Etag: "63ab4ac5-139"
Expires: Thu, 29 Dec 2022 21:12:00 GMT
Last-Modified: Tue, 27 Dec 2022 19:43:01 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 313
her-cupid.com/stats
200 OK 7.0 kB IP
Hash 30150a80d151ffaf49550a8a57e67257
d59853f6221e8ed41a7520e24136d5b4fa1abfa1
3a381aba519b3be2fb9b12f862676562b48783b849c210ed3f62dae29c62400c
Analyzer Verdict Alert fortinet Phishing
POST /stats HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 310
Origin: https://her-cupid.com
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2UsImV2ZW50Ijoic3RlcC0xIiwiZGF0YSI6eyJyZWFsX3N0ZXBfbnVtYmVyIjoxfX0=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
app.api-push.com/get-keys
200 OK 2.1 kB URL HTTP/2 app.api-push.com/get-keys
IP
File type JSON data\012- , ASCII text, with very long lines (1940), with no line terminators
Hash a10f3f1590d3bdceeeac49a7c808f72b
b782d34e83758439901475130bb39602e0c3a9a4
54f23f267e62c8133741266101d77d9d6462c6112a34db2618c3282d8ef91d09
POST /get-keys HTTP/1.1
Host: app.api-push.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 174
Origin: https://her-cupid.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: application/json; charset=utf-8
vary: Origin
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9REjFTDoLW3YQqq0PuQeLMxJotoi5MUe9%2BZ4psaD6pnXmpFHtEuQESVmI4LS60E4rXiey5IQdv4Gh%2BhTvRJtzJbMsAnt7TmPIAfrvOpFEvgpaXf37NGPtLOl7uoucg%2BCTao6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 780ab1a8bfbd72f4-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3379471e2684dd7d658dca815f51d0f4
e5348d501e4fa634f4687e2b58a4f5921d074f2d
144ecb33f81e13dbed55c56c4c0ca49168308d3c1de7ff61be5c865cf22d0f4e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "144ECB33F81E13DBED55C56C4C0CA49168308D3C1DE7FF61BE5C865CF22D0F4E"
Last-Modified: Tue, 27 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2453
Expires: Wed, 28 Dec 2022 14:18:55 GMT
Date: Wed, 28 Dec 2022 13:38:02 GMT
Connection: keep-alive
her-cupid.com/user-id?nbl=&impression=Nvq9GmOsRrg&trustLevel=0&botScore=0&finishClicksCount=0&landingConfig=&showedPops=0&uri=https%3A%2F%2Fher-cupid.com%2FAwAA%2F10040%2Foth%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&search=%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&contactExists=false
200 OK 204 B URL HTTP/2 her-cupid.com/user-id?nbl=&impression=Nvq9GmOsRrg&trustLevel=0&botScore=0&finishClicksCount=0&landingConfig=&showedPops=0&uri=https%3A%2F%2Fher-cupid.com%2FAwAA%2F10040%2Foth%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&search=%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&contactExists=false
IP
File type JSON data\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 65b2f20beb8d674c8b7df6a940196802
fa0553df37bb045393200d65d1bcbd80e2a154fd
7fa4971a491cf22c295730e100c74c509ce3ad64006567c2e6171a2efc7e5e98
GET /user-id?nbl=&impression=Nvq9GmOsRrg&trustLevel=0&botScore=0&finishClicksCount=0&landingConfig=&showedPops=0&uri=https%3A%2F%2Fher-cupid.com%2FAwAA%2F10040%2Foth%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&search=%3Fi%3DNvq9GmOsRrg%26u%3D4373624383838373560&contactExists=false HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2V9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: application/json; charset=UTF-8
set-cookie: userid=0128b6c414f6ca05175072f54640c868dab80b4865259ea93520dc8ba79e229fa%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22userid%22%3Bi%3A1%3Bi%3A642810664051%3B%7D; expires=Fri, 29-Dec-2023 09:54:41 GMT; Max-Age=31609000; path=/; HttpOnly; SameSite=Lax
access-control-allow-origin: *
X-Firefox-Spdy: h2
www.pornhubpremium.com/user/security/1111
302 Found 0 B URL HTTP/1.1 www.pornhubpremium.com/user/security/1111
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /user/security/1111 HTTP/1.1
Host: www.pornhubpremium.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
server: openresty
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
set-cookie: ua=df16c081c25306654a0efb89b8761a08; expires=Thu, 29-Dec-2022 13:38:02 GMT; Max-Age=86400; path=/; domain=pornhubpremium.com; secure; HttpOnly
platform=pc; expires=Wed, 04-Jan-2023 13:38:02 GMT; Max-Age=604800; path=/; domain=pornhubpremium.com; secure; HttpOnly
bs=m1vixkaq72spvms9w95ma54z4ymaddvl; expires=Sat, 25-Dec-2032 13:38:02 GMT; Max-Age=315360000; path=/; domain=pornhubpremium.com; secure; HttpOnly; SameSite=None
ss=501741829292485816; expires=Thu, 28-Dec-2023 13:38:02 GMT; Max-Age=31536000; path=/; domain=pornhubpremium.com; secure; HttpOnly
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
ph-redirect: 1026
location: https://www.pornhubpremium.com/premium/login?redirect=5ScAhVB_g0-33jWQKFZWJ0Kwg0rBYhijWHmum6T1NSMymgng89MRaFGcUiu_A4qJ
x-frame-options: SAMEORIGIN
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-request-id: 63AC46BA-42FE722101BB3134-FD796B2
www.pornhubpremium.com/premium/login?redirect=5ScAhVB_g0-33jWQKFZWJ0Kwg0rBYhijWHmum6T1NSMymgng89MRaFGcUiu_A4qJ
200 OK 7.8 kB URL HTTP/1.1 www.pornhubpremium.com/premium/login?redirect=5ScAhVB_g0-33jWQKFZWJ0Kwg0rBYhijWHmum6T1NSMymgng89MRaFGcUiu_A4qJ
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2404)
Hash dc35b6133c06e356ac135a2a09f5f39b
0938ba10b51e0274721a2484f15ff4129c1e3ad8
a9a8197c0df5ce98b623c5c17ab23fd5cacbff7b36f786a6bd6a6da4d8e0cf0f
GET /premium/login?redirect=5ScAhVB_g0-33jWQKFZWJ0Kwg0rBYhijWHmum6T1NSMymgng89MRaFGcUiu_A4qJ HTTP/1.1
Host: www.pornhubpremium.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: bs=m1vixkaq72spvms9w95ma54z4ymaddvl
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
server: openresty
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
set-cookie: ua=df16c081c25306654a0efb89b8761a08; expires=Thu, 29-Dec-2022 13:38:02 GMT; Max-Age=86400; path=/; domain=pornhubpremium.com; secure; HttpOnly
platform=pc; expires=Wed, 04-Jan-2023 13:38:02 GMT; Max-Age=604800; path=/; domain=pornhubpremium.com; secure; HttpOnly
ss=103709606346853549; expires=Thu, 28-Dec-2023 13:38:02 GMT; Max-Age=31536000; path=/; domain=pornhubpremium.com; secure; HttpOnly
fg_0d2ec4cbd943df07ec161982a603817e=45125.100000; expires=Fri, 27-Jan-2023 13:38:02 GMT; Max-Age=2592000; path=/; domain=pornhubpremium.com; secure
ats=eyJhIjoyNiwibiI6MywicyI6MiwiZSI6ODAwMCwicCI6NSwiY24iOiJOb3RfTWVtYmVyX0xvZ2luX0MwMDBfNDJfMV80MTEifQ%3D%3D; expires=Fri, 27-Jan-2023 13:38:02 GMT; Max-Age=2592000; path=/; domain=pornhubpremium.com; secure; HttpOnly
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-request-id: 63AC46BA-42FE722101BB3134-FD79722
ocsp.sectigo.com/
200 OK 471 B IP
Hash b918e3bbfc57d0f7d81820c662a99c70
2b4d6d06bc372a0c00a3a2498acfeca01533c724
a92cd7c5547f3e03f953a3dee30facf07ba5d22fd9456859ea463d61915fdc6e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 28 Dec 2022 13:38:02 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 27 Dec 2022 19:48:05 GMT
Expires: Tue, 03 Jan 2023 19:48:04 GMT
Etag: "2b4d6d06bc372a0c00a3a2498acfeca01533c724"
Cache-Control: max-age=540001,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 780ab1ad3bb7fac0-OSL
www.xvideos.com/favorite/90902157/mk_1123
404 Not Found 26 kB URL HTTP/1.1 www.xvideos.com/favorite/90902157/mk_1123
IP
ASN #46652 SERVERSTACK-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (8626)
Hash 28cdbbe5bd32c7eae6011b6ea0c9ea55
ccd70f40050c8c6df3abc57cc3aafd035bc439b4
d5d2652fafb28cf483b7f9daaca5ea73a27e09d4ad197d91dbda37aaf77a4edc
GET /favorite/90902157/mk_1123 HTTP/1.1
Host: www.xvideos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 404 Not Found
Date: Wed, 28 Dec 2022 13:38:02 GMT
P3p: policyref="/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding,User-Agent,Accept-Language,Cookie
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com z8y8f3q6.ssl.hwcdn.net https://www.xvideos.com https://wg-xvdev.xvideos.com *.trafficfactory.biz fonts.googleapis.com fonts.gstatic.com ajax.googleapis.com www.google-analytics.com www.googletagmanager.com *.addthis.com *.addthisedge.com www.iwanttodeliver.com apis.google.com www.google.com www.gstatic.com accounts.google.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ *.hwcdn.net fcm.googleapis.com *.nk-img.com https://static-dev-xvlive.xvideos.com https://dev-api.naked.com http://dev-api.naked.com *.googleapis.com *.cdn77.org *.pingdom.net *.exoclick.com *.exosrv.com *.realsrv.com *.orbsrv.com *.exdynsrv.com *.ackcdn.net *.afcdn.net *.aucdn.net *.adtng.com *.adglare.net adinvent.engine.adglare.net *.bngpt.com bngpt.com *.trafficjunky.net *.ohmybutt.com *.flirt4free.com *.xlovecam.com *.wlresources.com *.medleyads.com *.cams.com *.acdn5165543.com *.protoawe.com *.google-analytics.com livejasmin.com *.livejasmin.com *.jsmcrptjmp.com *.awemwh.com *.promo-bc.com *.bongacams.com *.bongacash.com *.gammae.com *.servingmillions.com *.super-route.com cdn01.flashmediaportal.com engine.asf4f.us *.htdvt.com *.jerkmate.com *.vfgtb.com *.hytxg2.com *.awemdia.com *.cfgr3.com *.ajxx98.online *.adworldmedia.com as.air2s.com cretgate.com mysexchatroom.com medleyads.com ajxx98.online gamesfromheaven.com go.hpyjmp.com r.trwl2.com bongacams.com clickserve.dartsearch.net bngpst.com trknex.com afrtrk.com track.cam4tracking.com *.smljmp.com sffsdvc.com www.sffsdvc.com bmedia.justservingfiles.net blkditsup.com vast.bimbim.com promo.cameraprive.com bngprl.com *.bngprl.com trafforsrv.com serving.stat-rock.com zubivu.com *.xxxjmp.com *.feelpornx.com *.crjugate.com *.hqscene.com *.xlviirdr.com adulttime.xxx *.adulttime.xxx *.javhd.com *.doppiocdn.com *.videosworks.com xlivrdr.com *.xlivrdr.com *.servetraff.com *.adglare.net www.flirt4free.com www.ohmybutt.com www.secretpartners.com cdn.asf4f.us *.livejasmin.com *.jsmcrptjmp.com *.awemwh.com etahub.com ctrack.trafficjunky.net tracking.sexcash.com wss://dev-chatserver.camster.com wss://staging-chatserver.camster.com wss://m.1ka.com wss://c1.1ka.com wss://c11.1ka.com wss://c12.1ka.com wss://c13.1ka.com wss://c14.1ka.com wss://c15.1ka.com wss://c16.1ka.com wss://c17.1ka.com wss://c18.1ka.com wss://c19.1ka.com wss://c110.1ka.com wss://c111.1ka.com wss://c112.1ka.com wss://c113.1ka.com wss://c114.1ka.com wss://c115.1ka.com wss://c2.1ka.com wss://c21.1ka.com wss://c22.1ka.com wss://c23.1ka.com wss://c24.1ka.com wss://c25.1ka.com wss://c26.1ka.com wss://c27.1ka.com wss://c28.1ka.com wss://c29.1ka.com wss://c210.1ka.com wss://c211.1ka.com wss://c212.1ka.com wss://c213.1ka.com wss://c214.1ka.com wss://c215.1ka.com wss://c3.1ka.com wss://c31.1ka.com wss://c32.1ka.com wss://c33.1ka.com wss://c34.1ka.com wss://c35.1ka.com wss://c36.1ka.com wss://c37.1ka.com wss://c38.1ka.com wss://c39.1ka.com wss://c4.1ka.com wss://c41.1ka.com wss://c42.1ka.com wss://c43.1ka.com wss://c44.1ka.com wss://c45.1ka.com wss://c46.1ka.com wss://c47.1ka.com wss://c48.1ka.com wss://c49.1ka.com wss://c410.1ka.com wss://c411.1ka.com wss://c412.1ka.com wss://c413.1ka.com wss://c414.1ka.com wss://c415.1ka.com wss://c5.1ka.com wss://c51.1ka.com wss://c52.1ka.com wss://c53.1ka.com wss://c54.1ka.com wss://c55.1ka.com wss://c56.1ka.com wss://c57.1ka.com wss://c58.1ka.com wss://c59.1ka.com wss://c510.1ka.com wss://c511.1ka.com wss://c512.1ka.com wss://c513.1ka.com wss://c514.1ka.com wss://c515.1ka.com https://dev-chatserver.camster.com https://staging-chatserver.camster.com https://m.1ka.com https://c1.1ka.com https://c11.1ka.com https://c12.1ka.com https://c13.1ka.com https://c14.1ka.com https://c15.1ka.com https://c16.1ka.com https://c17.1ka.com https://c18.1ka.com https://c19.1ka.com https://c110.1ka.com https://c111.1ka.com https://c112.1ka.com https://c113.1ka.com https://c114.1ka.com https://c115.1ka.com https://c2.1ka.com https://c21.1ka.com https://c22.1ka.com https://c23.1ka.com https://c24.1ka.com https://c25.1ka.com https://c26.1ka.com https://c27.1ka.com https://c28.1ka.com https://c29.1ka.com https://c210.1ka.com https://c211.1ka.com https://c212.1ka.com https://c213.1ka.com https://c214.1ka.com https://c215.1ka.com https://c3.1ka.com https://c31.1ka.com https://c32.1ka.com https://c33.1ka.com https://c34.1ka.com https://c35.1ka.com https://c36.1ka.com https://c37.1ka.com https://c38.1ka.com https://c39.1ka.com https://c4.1ka.com https://c41.1ka.com https://c42.1ka.com https://c43.1ka.com https://c44.1ka.com https://c45.1ka.com https://c46.1ka.com https://c47.1ka.com https://c48.1ka.com https://c49.1ka.com https://c410.1ka.com https://c411.1ka.com https://c412.1ka.com https://c413.1ka.com https://c414.1ka.com https://c415.1ka.com https://c5.1ka.com https://c51.1ka.com https://c52.1ka.com https://c53.1ka.com https://c54.1ka.com https://c55.1ka.com https://c56.1ka.com https://c57.1ka.com https://c58.1ka.com https://c59.1ka.com https://c510.1ka.com https://c511.1ka.com https://c512.1ka.com https://c513.1ka.com https://c514.1ka.com https://c515.1ka.com https://media.1ka.com https://u.1ka.com https://n.1ka.com;img-src 'self' 'unsafe-inline' data: blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com *.hwcdn.net *.trafficfactory.biz www.google.com www.google-analytics.com ssl.gstatic.com *.nk-img.com *.camster.com *.vscdns.com *.doubleclick.net *.google.fr *.google.com *.exoclick.com *.exosrv.com *.realsrv.com *.exdynsrv.com *.ackcdn.net *.afcdn.net *.aucdn.net bmedia.justservingfiles.net;
Referrer-Policy: no-referrer-when-downgrade
Set-Cookie: session_token=3df244bf499798d2Y5j-0SWFb1saajU57M99iHt31lMf23d6ee5Bh8jyt1RGJTCbz3vSOQpcRQheuEKDrSGYCzdocRFsxh_Oz4MztVcbtdb0xxbNF2B05O2v2g-x9B4TLK844SyCC4Iqh5TjJnjKsBi7sJR1YAdU0QdXRr19UUlp7CfuR_8uuJiZNxAeuyM0CrfcQ5qMc2hDxC2g; expires=Fri, 27-Jan-2023 13:38:02 GMT; Max-Age=2592000; path=/; domain=.xvideos.com
_ga=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.xvideos.com
_gid=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.xvideos.com
_gat=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.xvideos.com
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: nginx
her-cupid.com/stats
200 OK 5.9 kB IP
Hash f3aca5d1090ba94cf1230977944d9813
16e4c8ff6290ba44db4cc5778a447d4d2ff5eb51
cce175519e044cc6ac8a50639fbdc1092df156552023731b51d8042fc795b5ed
Analyzer Verdict Alert fortinet Phishing
POST /stats HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 319
Origin: https://her-cupid.com
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2UsImV2ZW50IjoiZXh0c2VzIiwiZGF0YSI6eyJwaHAiOiJmYWxzZSJ9LCJsdWlkIjo2NDI4MTA2NjQwNTF9; userid=0128b6c414f6ca05175072f54640c868dab80b4865259ea93520dc8ba79e229fa%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22userid%22%3Bi%3A1%3Bi%3A642810664051%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
www.pornhub.com/video/manage?o=mr&t=pr2
302 Found 0 B URL HTTP/2 www.pornhub.com/video/manage?o=mr&t=pr2
IP
GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
server: openresty
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: ua=df16c081c25306654a0efb89b8761a08; expires=Thu, 29-Dec-2022 13:38:02 GMT; Max-Age=86400; path=/; domain=pornhub.com; secure
platform=pc; expires=Wed, 04-Jan-2023 13:38:02 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
bs=0oxzmmveciqe1ccnskw9yifuuc4bpizs; expires=Sat, 25-Dec-2032 13:38:02 GMT; Max-Age=315360000; path=/; domain=pornhub.com; secure; SameSite=None
ss=693281973852617778; expires=Thu, 28-Dec-2023 13:38:02 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=89471.100000; expires=Fri, 27-Jan-2023 13:38:02 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=63AC46BA-42FE722901BB4BCE-FE205BD; Secure; Samesite=None
__l=63AC46BA-42FE722901BB4BCE-FE205BD; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
ph-redirect: 1041
location: /login
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-request-id: 63AC46BA-42FE722901BB4BCE-FE205BD
X-Firefox-Spdy: h2
dateexotic.com/agEA?usid=s8hnpa1797ug&email=Tim.bradley%40slurpmail.net&sub1=clear_main&prid=s8hnpa1797ug
200 OK 0 B URL HTTP/2 dateexotic.com/agEA?usid=s8hnpa1797ug&email=Tim.bradley%40slurpmail.net&sub1=clear_main&prid=s8hnpa1797ug
IP
GET /agEA?usid=s8hnpa1797ug&email=Tim.bradley%40slurpmail.net&sub1=clear_main&prid=s8hnpa1797ug HTTP/1.1
Host: dateexotic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Wed, 28 Dec 2022 13:37:59 GMT
content-type: text/html
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aqgg10%2B7PaJkBTVRZRLQ0uGrm6yU1R5vSlMDeJqU5C8PgLDeevtSPyRGPutpzuJASZZ1SuGvnGRl5t5lLav%2B6CchxaensPGxdzrshWZ0zVe9b5bdGn4ngtcLHjgaBT2R8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 780ab1989c4ab4ee-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
her-cupid.com/stats
200 OK 0 B IP
Analyzer Verdict Alert fortinet Phishing
POST /stats HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 383
Origin: https://her-cupid.com
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6bnVsbCwic2hvd2VkUG9wcyI6MCwidXJpIjoiaHR0cHM6Ly9oZXItY3VwaWQuY29tL0F3QUEvMTAwNDAvb3RoP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwic2VhcmNoIjoiP2k9TnZxOUdtT3NScmcmdT00MzczNjI0MzgzODM4MzczNTYwIiwiY29udGFjdEV4aXN0cyI6ZmFsc2UsImV2ZW50IjoibG9hZCIsImRhdGEiOnsicmVzcG9uc2VTdGFydCI6MTY1MCwiZG9tSW50ZXJhY3RpdmUiOjIwMzgsImRvbUNvbXBsZXRlIjoyOTcyfSwibHVpZCI6NjQyODEwNjY0MDUxfQ==; userid=0128b6c414f6ca05175072f54640c868dab80b4865259ea93520dc8ba79e229fa%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22userid%22%3Bi%3A1%3Bi%3A642810664051%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
her-cupid.com/stats
200 OK 0 B IP
Analyzer Verdict Alert fortinet Phishing
POST /stats HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 579
Origin: https://her-cupid.com
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6eyJ0cmFmZmljV2l0aEVtYWlsQ2FzY2FkZUlkIjp0cnVlLCJyZWFsVXNlcnNDYXNjYWRlSWQiOnRydWUsIm1haW5DYXNjYWRlIjp0cnVlLCJiYWNrQ2FzY2FkZSI6dHJ1ZSwic2Vjb25kQ2xpY2tDYXNjYWRlIjp0cnVlLCJwb3BzQ2FzY2FkZSI6ZmFsc2UsInBvcHNDb3VudCI6MX0sInNob3dlZFBvcHMiOjAsInVyaSI6Imh0dHBzOi8vaGVyLWN1cGlkLmNvbS9Bd0FBLzEwMDQwL290aD9pPU52cTlHbU9zUnJnJnU9NDM3MzYyNDM4MzgzODM3MzU2MCIsInNlYXJjaCI6Ij9pPU52cTlHbU9zUnJnJnU9NDM3MzYyNDM4MzgzODM3MzU2MCIsImNvbnRhY3RFeGlzdHMiOmZhbHNlLCJldmVudCI6ImV4dHNlcyIsImRhdGEiOnsicGgiOiJmYWxzZSJ9LCJsdWlkIjo2NDI4MTA2NjQwNTF9; userid=0128b6c414f6ca05175072f54640c868dab80b4865259ea93520dc8ba79e229fa%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22userid%22%3Bi%3A1%3Bi%3A642810664051%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
her-cupid.com/stats
200 OK 0 B IP
Analyzer Verdict Alert fortinet Phishing
POST /stats HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 581
Origin: https://her-cupid.com
Connection: keep-alive
Cookie: slappInfo64_Nvq9GmOsRrg=eyJuYmwiOm51bGwsImltcHJlc3Npb24iOiJOdnE5R21Pc1JyZyIsInRydXN0TGV2ZWwiOjAsImJvdFNjb3JlIjowLCJmaW5pc2hDbGlja3NDb3VudCI6MCwibGFuZGluZ0NvbmZpZyI6eyJ0cmFmZmljV2l0aEVtYWlsQ2FzY2FkZUlkIjp0cnVlLCJyZWFsVXNlcnNDYXNjYWRlSWQiOnRydWUsIm1haW5DYXNjYWRlIjp0cnVlLCJiYWNrQ2FzY2FkZSI6dHJ1ZSwic2Vjb25kQ2xpY2tDYXNjYWRlIjp0cnVlLCJwb3BzQ2FzY2FkZSI6ZmFsc2UsInBvcHNDb3VudCI6MX0sInNob3dlZFBvcHMiOjAsInVyaSI6Imh0dHBzOi8vaGVyLWN1cGlkLmNvbS9Bd0FBLzEwMDQwL290aD9pPU52cTlHbU9zUnJnJnU9NDM3MzYyNDM4MzgzODM3MzU2MCIsInNlYXJjaCI6Ij9pPU52cTlHbU9zUnJnJnU9NDM3MzYyNDM4MzgzODM3MzU2MCIsImNvbnRhY3RFeGlzdHMiOmZhbHNlLCJldmVudCI6ImV4dHNlcyIsImRhdGEiOnsieHZpZCI6ImZhbHNlIn0sImx1aWQiOjY0MjgxMDY2NDA1MX0=; userid=0128b6c414f6ca05175072f54640c868dab80b4865259ea93520dc8ba79e229fa%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22userid%22%3Bi%3A1%3Bi%3A642810664051%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:03 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
her-cupid.com/AwAA/10040/oth?i=Nvq9GmOsRrg&u=4373624383838373560
200 OK 0 B URL HTTP/2 her-cupid.com/AwAA/10040/oth?i=Nvq9GmOsRrg&u=4373624383838373560
IP
GET /AwAA/10040/oth?i=Nvq9GmOsRrg&u=4373624383838373560 HTTP/1.1
Host: her-cupid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dateexotic.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 28 Dec 2022 13:38:00 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
x-cache-status: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
cdnjam.com/cdn/push.min.js
200 OK 0 B URL HTTP/2 cdnjam.com/cdn/push.min.js
IP
GET /cdn/push.min.js HTTP/1.1
Host: cdnjam.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 28 Dec 2022 13:38:01 GMT
content-type: application/x-javascript
content-security-policy: block-all-mixed-content
etag: W/"44c9e373bc246e347c8420a2eb8f54d4"
last-modified: Mon, 06 Jun 2022 20:30:35 GMT
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-request-id: 16F62D8C82243EE0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=14400
cf-cache-status: HIT
age: 3146
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Je4d8iFS0Y2DRmPzkZgbgc8yJQAiEm3kv9yd500X92cI7s%2FvXcJKYHNBpIb1wEa3Z6bCd584ZysDuLun0rlNw6dSFd1ToY15wpv9l0%2Bf%2BkcXANViXEEObDGTgRA6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 780ab1a66c65b4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.pornhub.com/login
200 OK 0 B IP
GET /login HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: bs=0oxzmmveciqe1ccnskw9yifuuc4bpizs
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: openresty
date: Wed, 28 Dec 2022 13:38:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: ua=df16c081c25306654a0efb89b8761a08; expires=Thu, 29-Dec-2022 13:38:02 GMT; Max-Age=86400; path=/; domain=pornhub.com; secure
platform=pc; expires=Wed, 04-Jan-2023 13:38:02 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
ss=883869924165331625; expires=Thu, 28-Dec-2023 13:38:02 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=88873.100000; expires=Fri, 27-Jan-2023 13:38:02 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=63AC46BA-42FE722901BB4BCE-FE20620; Secure; Samesite=None
__l=63AC46BA-42FE722901BB4BCE-FE20620; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-request-id: 63AC46BA-42FE722901BB4BCE-FE20620
X-Firefox-Spdy: h2
146.190.75.35
93.184.220.29
104.18.32.68
188.114.96.1
23.36.77.32
54.39.22.228