Overview

URLae.continuetoplay.com/9csm9
IP 54.230.111.19 (United States)
ASN#16509 AMAZON-02
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-30 15:23:31 UTC
StatusLoading report..
IDS alerts4
Blocklist alert0
urlquery alerts No alerts detected
Tags None

Domain Summary (18)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
stats.g.doubleclick.net (1) 96 2012-07-01 17:13:23 UTC 2023-01-30 06:38:02 UTC 173.194.221.154
track.fkg.tv (9) 0 2016-10-05 14:44:06 UTC 2023-01-30 05:06:41 UTC 80.74.141.5 Unknown ranking
www.googleoptimize.com (1) 1604 2019-07-16 10:17:19 UTC 2023-01-30 07:12:43 UTC 142.250.74.78
r3.o.lencr.org (8) 344 2020-12-02 08:52:13 UTC 2023-01-30 04:09:08 UTC 23.33.119.27
basebonecdn.com (3) 0 2018-05-03 17:05:33 UTC 2023-01-29 14:22:18 UTC 172.67.190.201 Unknown ranking
ocsp.pki.goog (7) 175 2017-06-14 07:23:31 UTC 2023-01-30 04:10:12 UTC 142.250.74.131
api.basebone.com (1) 756673 2013-04-18 12:15:14 UTC 2023-01-29 14:22:19 UTC 80.74.141.5
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-30 04:10:15 UTC 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-30 04:11:18 UTC 52.36.23.49
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-30 04:10:11 UTC 34.160.144.191
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-30 04:09:18 UTC 34.120.237.76
lookup.tpay.me (1) 161678 2017-01-29 11:17:51 UTC 2023-01-30 10:09:45 UTC 41.178.51.21
my.rtmark.net (3) 9054 2015-02-04 09:54:57 UTC 2023-01-30 04:09:25 UTC 139.45.195.8
www.googletagmanager.com (1) 75 2012-10-04 01:07:32 UTC 2023-01-30 06:05:42 UTC 142.250.74.168
www.google.no (1) 25607 2012-06-26 23:22:08 UTC 2023-01-30 05:09:34 UTC 142.250.74.163
ae.continuetoplay.com (5) 0 2022-06-04 08:02:38 UTC 2023-01-30 04:13:52 UTC 54.230.111.8 Domain (continuetoplay.com) ranked at: 775414
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-30 04:09:03 UTC 35.241.9.150
region1.analytics.google.com (1) 0 2022-03-17 11:26:33 UTC 2023-01-30 06:12:10 UTC 216.239.32.36 Domain (google.com) ranked at: 1

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-01-30 15:23:33 UTC 3  80.74.141.5 Client IP ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1 
2023-01-30 15:23:33 UTC 3  80.74.141.5 Client IP ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2 
2023-01-30 15:23:33 UTC 3  80.74.141.5 Client IP ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3 
2023-01-30 15:23:33 UTC 1 Client IP  80.74.141.5 ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 54.230.111.19
Date UQ / IDS / BL URL IP
2023-03-28 07:58:34 +0000 0 - 0 - 0 cryptoanimelabs.xyz 54.230.111.19
2023-03-27 23:05:02 +0000 0 - 2 - 0 betterme-walking-plan.com/ 54.230.111.19
2023-03-27 17:11:17 +0000 0 - 11 - 0 za.continuetoplay.com/5mxi0 54.230.111.19
2023-03-25 20:59:00 +0000 0 - 0 - 2 sweepstooknow.click/mainstream/Sweepstakes/Gi (...) 54.230.111.19
2023-03-24 19:03:47 +0000 0 - 2 - 0 public-cdn.bambulab.com/upgrade/studio/softwa (...) 54.230.111.19


Last 5 reports on ASN: AMAZON-02
Date UQ / IDS / BL URL IP
2023-03-28 09:47:45 +0000 0 - 0 - 1 www.flo.com.tr 3.126.7.156
2023-03-28 09:46:13 +0000 0 - 2 - 0 xn--reiniciar-memberesa-21b.xn--bancar-8za94a (...) 18.140.244.115
2023-03-28 09:43:41 +0000 0 - 2 - 0 d2qbqh7m5xyiis.cloudfront.net/kLV--G/DLWz/+bo (...) 54.230.245.28
2023-03-28 09:27:32 +0000 0 - 1 - 0 looksmiles.com/smbscanlocal-94a71077a624327c1 (...) 15.197.130.221
2023-03-28 09:15:40 +0000 0 - 0 - 0 www.applesfera.com/ 54.230.111.46


Last 5 reports on domain: continuetoplay.com
Date UQ / IDS / BL URL IP
2023-03-27 17:11:17 +0000 0 - 11 - 0 za.continuetoplay.com/5mxi0 54.230.111.19
2023-03-26 12:06:55 +0000 0 - 7 - 0 za.continuetoplay.com/5mxi0/w/2149803/ 54.230.111.8
2023-03-12 23:03:58 +0000 0 - 7 - 1 za.continuetoplay.com/5mxi0/w/2149803/ 143.204.55.26
2023-03-06 18:59:47 +0000 0 - 0 - 1 za.continuetoplay.com/5mxi0/w/2149020/ 143.204.55.26
2023-02-23 20:46:04 +0000 0 - 7 - 2 za.continuetoplay.com/7pcz8/w/2149986 54.230.111.19


Last 1 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-02-09 04:14:26 +0000 0 - 4 - 0 ae.continuetoplay.com/9csm9 54.230.111.64

JavaScript

Executed Scripts (18)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (53)


Request Response
                                        
                                            GET /9csm9 HTTP/1.1 
Host: ae.continuetoplay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         54.230.111.8
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Content-Length: 0
Connection: keep-alive
Date: Mon, 30 Jan 2023 15:23:19 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Content-Security-Policy: default-src 'self' 'unsafe-inline'
Permissions-Policy: accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*, clipboard-read=*, clipboard-write=*, gamepad=*, speaker-selection=*, conversion-measurement=*, focus-without-user-activation=*, hid=*, idle-detection=*, interest-cohort=*, serial=*, sync-script=*, trust-token-redemption=*, window-placement=*, vertical-scroll=*
Location: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:19 GMT; Max-Age=604800; path=/ LPSID=CB7; path=/
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: w5c934yqSGGq0cnjmPwWs8OsXRwwmZO8lg_Str5m9TGnw6DduQIRlw==

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F6F1C295C68DFEBADACB1FC812B44E01C7EDE0E203615EF3E2CCED2CE2251E7E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10221
Expires: Mon, 30 Jan 2023 18:13:41 GMT
Date: Mon, 30 Jan 2023 15:23:20 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9795
Expires: Mon, 30 Jan 2023 18:06:35 GMT
Date: Mon, 30 Jan 2023 15:23:20 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 30 Jan 2023 14:43:12 GMT
age: 2408
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bf0c602d32b3c14606f22a86183b5e3c
Sha1:   6eabd8d83475eba731968abe1a05a8bfd272f160
Sha256: 6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "56DA08E18A408D7313DE4E598984A251A0ECF85BBBA98B421BE9AEBEB98835AF"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4247
Expires: Mon, 30 Jan 2023 16:34:07 GMT
Date: Mon, 30 Jan 2023 15:23:20 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: bfuLplQMRlihgElSxbQ8M8O3r05w1B/tmc2ByKRcMBx0uwLJ2wqCm1ll1kzq5KBwpqGaJUsDJ2U=
x-amz-request-id: WPREQMAT5NZ6EBXW
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 30 Jan 2023 15:21:50 GMT
age: 90
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9 HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Content-Security-Policy: default-src 'self' 'unsafe-inline'
Permissions-Policy: accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*, clipboard-read=*, clipboard-write=*, gamepad=*, speaker-selection=*, conversion-measurement=*, focus-without-user-activation=*, hid=*, idle-detection=*, interest-cohort=*, serial=*, sync-script=*, trust-token-redemption=*, window-placement=*, vertical-scroll=*
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7316
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/ LPSID=CB4; path=/
Cache-control: private


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (23109)
Size:   7316
Md5:    ce6084bc7fa1ffaf8bc708fccdecd209
Sha1:   08e343017cfd692bb075a99cc212c3f66517cfb5
Sha256: da7dd44a3cf2dc4c134ba2a52a10d1b3f717cd99b859fb2fe06ef3416a3cb1e2

Alerts:
  IDS:
    - ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
    - ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2
    - ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Mon, 30 Jan 2023 15:23:20 GMT
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /ui/etag HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
Content-Length: 0

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 30 Jan 2023 14:41:41 GMT
age: 2499
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /ui/auth HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
Content-Length: 0


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  IDS:
    - ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted
                                        
                                            GET /ui/cache HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
Content-Length: 0

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Last-Modified: Tue, 13 Dec 2022 16:15:06 GMT
ETag: "57e-5efb7ec4cd30e"
Accept-Ranges: bytes
Content-Length: 1406


--- Additional Info ---
Magic:  MS Windows icon resource - 1 icon, 16x16\012- data
Size:   1406
Md5:    011201ab56695ce86ea2f190bce2670b
Sha1:   bb8fad6accf293e619360935047c23f00da3c769
Sha256: a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
                                        
                                            GET /ui/etag HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
X-BXP-CID: 874eb068770ab3828004ff2ad08b742e
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4; I=874eb068770ab3828004ff2ad08b742e

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
ETag: "874eb068770ab3828004ff2ad08b742e"
Transfer-Encoding: chunked
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   52
Md5:    08746bc0c147eb325bd72ceedeeb61ae
Sha1:   76f9c3ddc3e2a5e7b9ad9d6394433a2e12d72af6
Sha256: 745f7a54798db45871b30b2c8d712f93c69710574ef1e13b0516595194f1269e
                                        
                                            GET /ui/cache HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
X-BXP-CID: 874eb068770ab3828004ff2ad08b742e
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4; I=874eb068770ab3828004ff2ad08b742e

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
Last-Modified: Wed, 30 Jun 2010 21:36:48 GMT
Expires: Tue, 31 Dec 2030 23:30:45 GMT
Cache-Control: public, max-age=630720000
Transfer-Encoding: chunked
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   52
Md5:    08746bc0c147eb325bd72ceedeeb61ae
Sha1:   76f9c3ddc3e2a5e7b9ad9d6394433a2e12d72af6
Sha256: 745f7a54798db45871b30b2c8d712f93c69710574ef1e13b0516595194f1269e
                                        
                                            GET /ui/auth HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Authorization: Basic ODc0ZWIwNjg3NzBhYjM4MjgwMDRmZjJhZDA4Yjc0MmU6bm9wYXNz
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4; I=874eb068770ab3828004ff2ad08b742e

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
WWW-Authenticate: Basic realm="My Realm"
Last-Modified: Wed, 30 Jun 2010 21:36:48 GMT
Expires: Tue, 31 Dec 2030 23:30:45 GMT
Cache-Control: public, max-age=630720000
Transfer-Encoding: chunked
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   52
Md5:    08746bc0c147eb325bd72ceedeeb61ae
Sha1:   76f9c3ddc3e2a5e7b9ad9d6394433a2e12d72af6
Sha256: 745f7a54798db45871b30b2c8d712f93c69710574ef1e13b0516595194f1269e

Alerts:
  IDS:
    - ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A29EE843C8A39551A1507CC6AD949AD509E33AAAE8B72C58AC4884BAD8B0B38E"
Last-Modified: Sun, 29 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8447
Expires: Mon, 30 Jan 2023 17:44:07 GMT
Date: Mon, 30 Jan 2023 15:23:20 GMT
Connection: keep-alive

                                        
                                            POST /ui/rcx HTTP/1.1 
Host: track.fkg.tv
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/ui/inject?router_id=b89cfcc4bd858c4&_lurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3Fa%3D9csm9%26w%3D2182323%26router_id%3Db89cfcc4bd858c4%26__ref%3Dhttp%253A%252F%252Fae.continuetoplay.com%252F9csm9
Content-Type: application/json
Content-Length: 77
Origin: http://track.fkg.tv
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB4; I=874eb068770ab3828004ff2ad08b742e

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:20 GMT
Server: Apache
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:20 GMT; Max-Age=604800; path=/
Content-Length: 0

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: HmIvn0AAe7X2gfOMcT3q3w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.36.23.49
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bovNunmZTzClljtcAMtkTSvcSJg=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4779
Expires: Mon, 30 Jan 2023 16:43:01 GMT
Date: Mon, 30 Jan 2023 15:23:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4779
Expires: Mon, 30 Jan 2023 16:43:01 GMT
Date: Mon, 30 Jan 2023 15:23:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4779
Expires: Mon, 30 Jan 2023 16:43:01 GMT
Date: Mon, 30 Jan 2023 15:23:22 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9167
x-amzn-requestid: e6e0789c-a4a9-4ffa-a0ae-691770d1035b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fPF9YEBmIAMF0kQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf8388-01d2093432d3959903671a69;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 07:06:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: awfNeaKbFw2bjiTGwUrwUTxU-qbVS2eTjn948H8kn1hy7pi_DwLMlQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 17:35:56 GMT
age: 78446
etag: "50a48e737310d3f31840db4301b25927fbcc12c5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9167
Md5:    3be81f83687ddb6c93d3ff3c09a9dba2
Sha1:   50a48e737310d3f31840db4301b25927fbcc12c5
Sha256: e78c909e2381898e7f546183784a05dff47c31734c95358aaada8c2777ad47be
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F72e6599c-6a41-4dd2-a346-b15fa84cb20a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10997
x-amzn-requestid: a6fac0ab-1acf-4808-8785-3b4ec5e32edf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhj30FX7IAMFa5w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e698-005109ec2e76529e793678d6;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:35:20 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: skGKI_MWvDwpAbGibUcr8wTlimgoPU9ZYhEHltd3uhdJZ_GoNznVAA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 22:08:57 GMT
etag: "027dbc7a104c922904f067ed15d696c363c11774"
age: 62065
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10997
Md5:    65c02d8a1b0d6a210cb2a649c5c67469
Sha1:   027dbc7a104c922904f067ed15d696c363c11774
Sha256: 89d5443a1d313c632d09a583ef602aa4645a16986076387329f434262d15b0a1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3bb7921c-8aaf-40cd-bf87-43903c3f1a74.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7679
x-amzn-requestid: 0c7983d5-6040-44e9-b394-21c3784702a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhkEtEfHoAMFaNA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e6ea-54c55dbd09ca642048af8916;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:36:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: VHh2SQ21xoDoBnGvM2kRiposhXuCE-DdWW1bM35kEykjbHYmhsldVA==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 21:51:22 GMT
age: 63120
etag: "b820be4ed885dcf288eb6460c57e1fa7b1c7c476"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7679
Md5:    3e04b9eaf7449828136ad59e4c9d69f1
Sha1:   b820be4ed885dcf288eb6460c57e1fa7b1c7c476
Sha256: df75cf7183d401a19655aab025d08ad2c498573c88b32e9b258d951d2993b936
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6df754eb-70f9-4576-ac48-68a6ae719511.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9457
x-amzn-requestid: 7c48e5ca-2128-43da-ba83-fd91568af1ef
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhkBOGHVoAMFQtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e6d4-1b850ffd543f51f92dec3894;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:36:20 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 3EXFa0gb46AbdZ9ZznGiPTemGZ7zWh9WLs5Yr1zmfyh_jyKA6o7xoA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 22:19:57 GMT
age: 61405
etag: "e4388ced02e5576867e77547496dec1ac2338ef7"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9457
Md5:    51aa950d5eed7b90cab6632107092edc
Sha1:   e4388ced02e5576867e77547496dec1ac2338ef7
Sha256: 588830e5f725e8e56270565e40f817f2658b0ee7c0425d138e5f65a17ff40483
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F55e9b24d-3c7c-46d8-89b7-084483cc3d1d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12507
x-amzn-requestid: 85c9adcd-b997-48ca-bbfb-ccdeaf3e8cfb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhklyFaJoAMFqKA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e7be-2bcdd8c353d8429d2b1e95f6;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:40:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XABaoZCqUulmnfZOXx6XTLSUMS5Mie6u0OfkqozmBzCf3Qjzf-fbRA==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 21:54:32 GMT
age: 62930
etag: "d60f280f8a742480527dbc32d08f321f972d4fcf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12507
Md5:    5190c0bdc6abe0ee258e9f8c20ddaf51
Sha1:   d60f280f8a742480527dbc32d08f321f972d4fcf
Sha256: 874b38a04aa3736e65aaef72da2cc2efceb208618267107a495bdfe51ec58e58
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F52796f60-dafe-46ba-9c7a-a08ce5e16c34.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8464
x-amzn-requestid: bf2cf356-ebb1-469b-ba35-a79bb009cad6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fhj3qGeboAMFzNw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d6e697-7c96841f52b6a96d1b0eaf34;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 21:35:19 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: y6bDvcD7a3-A4DLC3cSdZT-yewV1kkFqcGr7AMuqvUeGA4A0pgF4wQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 21:59:27 GMT
age: 62635
etag: "7aa5fbdc8156514770ae620e81f1afef1c77890f"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8464
Md5:    fe31ee140c2fd62e616c8a1edc9e78bb
Sha1:   7aa5fbdc8156514770ae620e81f1afef1c77890f
Sha256: 799af4bf9fa07ed27ebdc9d1a3344ee8a2b6529f076c263495b93290c47a1cc4
                                        
                                            GET /t/17844/?a=9csm9&w=2182323&router_id=b89cfcc4bd858c4&__ref=http%3A%2F%2Fae.continuetoplay.com%2F9csm9&_bxpc_rtype=js_timeout HTTP/1.1 
Host: ae.continuetoplay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://track.fkg.tv/
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB7
Upgrade-Insecure-Requests: 1

search
                                         54.230.111.8
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Content-Length: 0
Connection: keep-alive
Date: Mon, 30 Jan 2023 15:23:23 GMT
Server: Apache
Set-Cookie: __ref=http%3A%2F%2Fae.continuetoplay.com%2F9csm9 router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:23 GMT; Max-Age=604800; path=/ SES=4802782244; expires=Tue, 31-Jan-2023 15:23:23 GMT; Max-Age=86400; path=/t/17844/
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Content-Security-Policy: default-src 'self' 'unsafe-inline'
Permissions-Policy: accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*, clipboard-read=*, clipboard-write=*, gamepad=*, speaker-selection=*, conversion-measurement=*, focus-without-user-activation=*, hid=*, idle-detection=*, interest-cohort=*, serial=*, sync-script=*, trust-token-redemption=*, window-placement=*, vertical-scroll=*
Location: http://lookup.tpay.me/idxml.ashx/getmsisdn?date=2023-01-30+15%3A23%3A23Z&redirectUrl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3FSES%3D4802782244%26a%3D9csm9%26w%3D2182323%26p%3Dcallback&signature=e4TBMUzPKk9gBfSg9b8j%3Ad85479a670be6383028ba6b043c5d0143d9f75458aa15e6d2f2140f066ef3c3f
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: kQuQ65u5fB9EfUi0VhbgOHJcu_yBWyGfQjkoYaahqUaTNNKIILisWQ==

                                        
                                            GET /idxml.ashx/getmsisdn?date=2023-01-30+15%3A23%3A23Z&redirectUrl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3FSES%3D4802782244%26a%3D9csm9%26w%3D2182323%26p%3Dcallback&signature=e4TBMUzPKk9gBfSg9b8j%3Ad85479a670be6383028ba6b043c5d0143d9f75458aa15e6d2f2140f066ef3c3f HTTP/1.1 
Host: lookup.tpay.me
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://track.fkg.tv/
Upgrade-Insecure-Requests: 1

search
                                         41.178.51.21
HTTP/1.1 302 Found
                                        
Cache-Control: no-store, no-cache
Location: http://ae.continuetoplay.com/t/17844/?SES=4802782244&a=9csm9&w=2182323&p=callback&Status=Error&Msisdn=&OperatorCode=&OrderId=&Details=Failed+To+Get+MSISDN&Signature=e4TBMUzPKk9gBfSg9b8j%3a870f49bcf390e07b1de123d2292d8c8a337e7a6e2bc0d0799e6e972966a0ac73&PlainSessionId=
Server: Kestrel
Access-Control-Allow-Origin: http://track.fkg.tv
Access-Control-Expose-Headers: _tkn
Request-Context: appId=cid-v1:fa05ee09-d179-496d-9c47-4e844b3db080
X-Powered-By: ASP.NET, ASP.NET
Date: Mon, 30 Jan 2023 15:18:35 GMT
Content-Length: 0

                                        
                                            GET /t/17844/?SES=4802782244&a=9csm9&w=2182323&p=callback&Status=Error&Msisdn=&OperatorCode=&OrderId=&Details=Failed+To+Get+MSISDN&Signature=e4TBMUzPKk9gBfSg9b8j%3a870f49bcf390e07b1de123d2292d8c8a337e7a6e2bc0d0799e6e972966a0ac73&PlainSessionId= HTTP/1.1 
Host: ae.continuetoplay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://track.fkg.tv/
Connection: keep-alive
Cookie: SES=4802782244; __ref=http%3A%2F%2Fae.continuetoplay.com%2F9csm9; router_id=b89cfcc4bd858c4; LPSID=CB7
Upgrade-Insecure-Requests: 1

search
                                         54.230.111.8
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Content-Length: 0
Connection: keep-alive
Date: Mon, 30 Jan 2023 15:23:23 GMT
Server: Apache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Content-Security-Policy: frame-ancestors 'none'
Permissions-Policy: accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*, clipboard-read=*, clipboard-write=*, gamepad=*, speaker-selection=*, conversion-measurement=*, focus-without-user-activation=*, hid=*, idle-detection=*, interest-cohort=*, serial=*, sync-script=*, trust-token-redemption=*, window-placement=*, vertical-scroll=*
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:23 GMT; Max-Age=604800; path=/ SES=4802782244; expires=Tue, 31-Jan-2023 15:23:23 GMT; Max-Age=86400; path=/t/17844/ uv=1; path=/
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, no-transform
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: none
Location: http://ae.continuetoplay.com/t/17844/?SES=4802782244&a=9csm9&w=2182323
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 6uF_LQQKcBry6nNS4np-mBTXTppFWxpwdaGxfRs-wdCwrad7iDJ-6w==

                                        
                                            GET /t/17844/?SES=4802782244&a=9csm9&w=2182323 HTTP/1.1 
Host: ae.continuetoplay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://track.fkg.tv/
Cookie: SES=4802782244; __ref=http%3A%2F%2Fae.continuetoplay.com%2F9csm9; router_id=b89cfcc4bd858c4; LPSID=CB7; uv=1
Upgrade-Insecure-Requests: 1

search
                                         54.230.111.8
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Content-Length: 25572
Connection: keep-alive
Date: Mon, 30 Jan 2023 15:23:24 GMT
Server: Apache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Content-Security-Policy: frame-ancestors 'none'
Permissions-Policy: accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*, clipboard-read=*, clipboard-write=*, gamepad=*, speaker-selection=*, conversion-measurement=*, focus-without-user-activation=*, hid=*, idle-detection=*, interest-cohort=*, serial=*, sync-script=*, trust-token-redemption=*, window-placement=*, vertical-scroll=*
Set-Cookie: router_id=b89cfcc4bd858c4; expires=Mon, 06-Feb-2023 15:23:24 GMT; Max-Age=604800; path=/ SES=4802782244; expires=Tue, 31-Jan-2023 15:23:24 GMT; Max-Age=86400; path=/t/17844/ token=74543f97fdae0370935b677e394004bb3f9d9bfaaf8ac41772d40c9aaf789785; expires=Mon, 30-Jan-2023 16:23:24 GMT; Max-Age=3600; path=/
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, no-transform
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: none
Vary: Accept-Encoding
Content-Encoding: gzip
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: iB9A99c3d8O9tROhTkWviRl82GhZGDrcGkUR8noaKSNuKZ2aztHQCQ==


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (29697), with CRLF, LF line terminators
Size:   25572
Md5:    ad7ca60c2666d605858ff87cf5ce9a91
Sha1:   c3aadd8f5414419bae3acfa32ecac010780062a6
Sha256: 83ac66bc19f1dbd591cc6dd1b3a7495bfdab33ddcc946e3123957f7aba893494
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /p.js?f=sync&lr=1&partner=e4433d196201dabb3d3131ccb7cd09dc39b5898761466ff24d75e42ccade3155 HTTP/1.1 
Host: my.rtmark.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ae.continuetoplay.com/

search
                                         139.45.195.8
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                        
Server: nginx
Date: Mon, 30 Jan 2023 15:23:24 GMT
Content-Length: 138
Connection: keep-alive
Location: https://my.rtmark.net/p.js?f=sync&lr=1&partner=e4433d196201dabb3d3131ccb7cd09dc39b5898761466ff24d75e42ccade3155
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Timing-Allow-Origin: *


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   138
Md5:    aff950cab4c0265e21d401db15f1026d
Sha1:   f03e18461817f7a6546c8bf8fa8d686d7e30aca0
Sha256: 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
                                        
                                            GET /optimize.js?id=OPT-WTX2SLW HTTP/1.1 
Host: www.googleoptimize.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.78
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 30 Jan 2023 15:23:24 GMT
expires: Mon, 30 Jan 2023 15:23:24 GMT
cache-control: private, max-age=900
last-modified: Mon, 30 Jan 2023 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43261
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1759)
Size:   43261
Md5:    36cdd5852ff80269a0f46d40a75676e1
Sha1:   678d565ed966b794b42d6dca4c5b357c1d89ed10
Sha256: d3913119458ab3651f757317e593a3590dc7eb9c467d329d4b811542ec6cf84f
                                        
                                            GET /gtm.js?id=GTM-MF387SN HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.168
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 30 Jan 2023 15:23:24 GMT
expires: Mon, 30 Jan 2023 15:23:24 GMT
cache-control: private, max-age=900
last-modified: Mon, 30 Jan 2023 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 61172
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (40004)
Size:   61172
Md5:    67d42c2e9820e7cff2ad8a74660c1635
Sha1:   de0ec2ca6b8d65863842479acad4e86db77bcaba
Sha256: 8d5337a454a011bc5ae7c1ca48651806753a0e0aa129b040671202d59c361798
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /media/images/download/download_pinlock_3.png HTTP/1.1 
Host: basebonecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ae.continuetoplay.com/

search
                                         172.67.190.201
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Content-Length: 3189
Connection: keep-alive
Last-Modified: Wed, 01 Jun 2022 07:34:32 GMT
x-amz-version-id: .tWJTcT0wSu34VKPzFpcHLVSfG.ygeJt
ETag: "5d1ee9008bce301ddd6fa74571b3e17c"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: LbNRqaAHqjBf4kDPvnKAukG8iy3ahXDKKQxeGwAo7yip35NAZiCc4A==
Cache-Control: max-age=86400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vSGP%2B0QSsH5hBInKCuv3EZOVU2wHGa%2BFUqMH6J0xSkR7UERes3T%2FfHN4YVQ5HKvNh%2BF5ZmrUHQa%2FP4Lr7f7zz5WhBkX2sHuF6YqU47D4uaaRBYEA7CI4gNQrvgptEpvvD%2BA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 791b3564bc03fac4-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  PNG image data, 109 x 106, 8-bit/color RGBA, non-interlaced\012- data
Size:   3189
Md5:    5d1ee9008bce301ddd6fa74571b3e17c
Sha1:   9b621b76e35b4911655794eb47740a925acb3ed9
Sha256: dcd1d8d9427dcf544e5cf3a6fa44018f7cda51f34074316cb9bd0e2572cb8426
                                        
                                            GET /media/images/logos/2022/games.baseplay.co_logo_white.svg HTTP/1.1 
Host: basebonecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ae.continuetoplay.com/

search
                                         172.67.190.201
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 03 May 2022 06:55:44 GMT
x-amz-version-id: ugN9qMzqnDLrUO3WWb5eWYaX1SM9HzLN
Content-Encoding: gzip
ETag: W/"4acf5bbac675a722da47d4d2150eeced"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: NN-4zmfof0jTrKdkh3XQKtkFFYNoUO6VTYCvDxTCyPbzMbC_6bKFqA==
Cache-Control: max-age=86400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5FXDwRA3bvdvA%2BRMCVBUL7U4ZqvkvTk9GzETfZUR9CKBuJL2go1IhWGZLVLgQNWoeBgCLWy92r8wjt%2BPsrVbCwkLh%2BzECTQxyaB8mME41L%2FokeycxdYLr7xYffpldWhlFA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 791b3564bfb2b505-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text, with very long lines (7221), with no line terminators
Size:   3282
Md5:    f7f3046b1d2b3a613fa3665cca511d17
Sha1:   5a46738f82faae852045cd6b76b87bfab95049ad
Sha256: b11a797775add50160154ce389dee8ef2c5cf63e6b27934540299676c7a79466
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "2456263DD21986D49EA478D5A5D69EE7B741B3291BB456E9CC4F9CF0CF2A5CB2"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7342
Expires: Mon, 30 Jan 2023 17:25:46 GMT
Date: Mon, 30 Jan 2023 15:23:24 GMT
Connection: keep-alive

                                        
                                            GET /media/images/antivirus/antivirus_lp_za_26.jpg HTTP/1.1 
Host: basebonecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ae.continuetoplay.com/

search
                                         172.67.190.201
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Content-Length: 47883
Connection: keep-alive
Last-Modified: Thu, 08 Oct 2020 09:01:53 GMT
x-amz-version-id: 46LHVJpFrKp3z61HEhiKHz6wgouOP.E8
ETag: "1a8414abd9e7991ed9cdaf2a65266162"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: VwBDBAWhZ0wG54eI2HX-FWeLGO4k2l-n56baGsI90X_AFQ715rVy3w==
Cache-Control: max-age=86400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ipupTaUoikmw57zs29Ls1%2FRCdsxQYddPHuEiZhQKaRTIsMx3asix3CtR9TOG4WfdrAwn1rlVPMPaCdJCRmKBK2IXvksLNfvRTIugjH2ddI0FvGaZ36VtfIwBQY9%2FcSTnCM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 791b3564ba1a1c06-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 480x317, components 3\012- data
Size:   47883
Md5:    1a8414abd9e7991ed9cdaf2a65266162
Sha1:   f7c475d3bc6a28f2e93fea88b7142586915b0e4b
Sha256: 39e05d3bc5426bbb8bf22aef88e1eb5b16d4e51f26035da25058823343e2fc47
                                        
                                            GET /p.js?f=sync&lr=1&partner=e4433d196201dabb3d3131ccb7cd09dc39b5898761466ff24d75e42ccade3155 HTTP/1.1 
Host: my.rtmark.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ae.continuetoplay.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         139.45.195.8
HTTP/2 200 OK
content-type: text/javascript
                                        
server: nginx
date: Mon, 30 Jan 2023 15:23:24 GMT
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   697
Md5:    a6d255f2eb0b2c7d64159cef20667aec
Sha1:   14c29b6145a612e72bd1dc59bb0ccb55415c530b
Sha256: 910c9a08dbacc4603c934adbc5b6f057c2c37833d1e0bc5bee5465eee94bfea9
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: ae.continuetoplay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ae.continuetoplay.com/t/17844/?SES=4802782244&a=9csm9&w=2182323
Connection: keep-alive
Cookie: router_id=b89cfcc4bd858c4; LPSID=CB7; uv=1; token=74543f97fdae0370935b677e394004bb3f9d9bfaaf8ac41772d40c9aaf789785

search
                                         54.230.111.8
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
                                        
Content-Length: 1406
Connection: keep-alive
Date: Mon, 30 Jan 2023 15:23:24 GMT
Server: Apache
Last-Modified: Thu, 16 Aug 2018 11:13:01 GMT
ETag: "57e-5738b86b699ef"
Accept-Ranges: bytes
X-Cache: Miss from cloudfront
Via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: UQhXCwfp6p4R7N8GvgA_S_2CEtfrfR2mLvWUtZsX2tDndgJlTN8trA==


--- Additional Info ---
Magic:  MS Windows icon resource - 1 icon, 16x16\012- data
Size:   1406
Md5:    011201ab56695ce86ea2f190bce2670b
Sha1:   bb8fad6accf293e619360935047c23f00da3c769
Sha256: a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-LF1R1KY13H&cid=631543157.1675092217&gtm=2oe1p0&aip=1&uid=874eb068770ab3828004ff2ad08b742e&z=504094142 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.163
HTTP/2 200 OK
content-type: image/gif
                                        
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 30 Jan 2023 15:23:24 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /frontend/google/ga4.php HTTP/1.1 
Host: api.basebone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 125
Origin: http://ae.continuetoplay.com
Connection: keep-alive
Referer: http://ae.continuetoplay.com/

search
                                         80.74.141.5
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 30 Jan 2023 15:23:24 GMT
Server: Apache
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Transfer-Encoding: chunked
Content-Encoding: gzip
Set-Cookie: LPSID=CB3; path=/


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   27
Md5:    399089a5a4aa675f2de0020c0d2dfe56
Sha1:   4bb635c9d4d04ad3937179af9084cbe3b4a01a0a
Sha256: 4f4cc2c452d815cfc35c7cbaa804b74337b980231bc0a0dd1405ac93f80d82bf
                                        
                                            GET /img.gif?f=sync&partner=e4433d196201dabb3d3131ccb7cd09dc39b5898761466ff24d75e42ccade3155&ttl=&rurl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3FSES%3D4802782244%26a%3D9csm9%26w%3D2182323 HTTP/1.1 
Host: my.rtmark.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         139.45.195.8
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Mon, 30 Jan 2023 15:23:24 GMT
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=eee8720cf65c46aa874d9b664cef7797; expires=Tue, 30 Jan 2024 15:23:24 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    b4491705564909da7f9eaf749dbbfbb1
Sha1:   279315d507855c6a4351e1e2c2f39dd9cd2fccd8
Sha256: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
                                        
                                            POST /g/collect?v=2&tid=G-LF1R1KY13H&gtm=2oe1p0&_p=2141987499&_gaz=1&cid=631543157.1675092217&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675092217&sct=1&seg=0&dl=http%3A%2F%2Fae.continuetoplay.com%2Ft%2F17844%2F%3FSES%3D4802782244%26a%3D9csm9%26w%3D2182323&dr=http%3A%2F%2Ftrack.fkg.tv%2F&dt=New%20Antivirus&uid=874eb068770ab3828004ff2ad08b742e&en=virtual_page_view&_fv=1&_nsi=1&_ss=1&ep.page_type=visit_landing&epn.context_id=4802782244&ep.alias=9csm9&ep.advertising_campaign_id=109836&ep.webad=2182323&ep.flow_page=index&ep.messaging_platform_id=88&ep.product_id=11&ep.publisher_id=20223&ep.sub_affiliate_id=not_set&ep.monetization_channel=network&ep.traffic_source=ad_networks&ep.template_id=17844&ep.monetization_type=internal&ep.page_path=%2Ft%2F17844%2F&upn.country_id=220&up.country_iso=AE&upn.network_id=103&up.network_name=internet HTTP/1.1 
Host: region1.analytics.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ae.continuetoplay.com
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

search
                                         216.239.32.36
HTTP/2 204 No Content
content-type: text/plain
                                        
access-control-allow-origin: http://ae.continuetoplay.com
date: Mon, 30 Jan 2023 15:23:25 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /g/collect?v=2&tid=G-LF1R1KY13H&cid=631543157.1675092217&gtm=2oe1p0&aip=1&uid=874eb068770ab3828004ff2ad08b742e HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ae.continuetoplay.com
Connection: keep-alive
Referer: http://ae.continuetoplay.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

search
                                         173.194.221.154
HTTP/2 204 No Content
content-type: text/plain
                                        
access-control-allow-origin: http://ae.continuetoplay.com
date: Mon, 30 Jan 2023 15:23:25 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Mon, 30 Jan 2023 15:23:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN