r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e935ea42be4feaed61a824b0b903913e
f966cfa80d65a805cb9d7c6a53b3340865d7c51a
eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19700
Expires: Thu, 02 Feb 2023 05:19:50 GMT
Date: Wed, 01 Feb 2023 23:51:30 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7e05c8461bd2dc5a149f71e2c465ea29
705983959c887e243cb55a8a1796757b579ee977
4d9ea085d5dda9dabed11af9847c2b0aa6182358673b356a4e2bd631e22a9922
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4D9EA085D5DDA9DABED11AF9847C2B0AA6182358673B356A4E2BD631E22A9922"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3705
Expires: Thu, 02 Feb 2023 00:53:15 GMT
Date: Wed, 01 Feb 2023 23:51:30 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Backoff, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 01 Feb 2023 23:36:02 GMT
content-type: application/json
age: 928
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9a76feabb767086ae0fa54e0ffbf763f
3655d78994a1e9838340669462728b67c8c12e54
bf215ab858c7785b7c01f7d3d437a918f056f00fe9b065820e1cdd09b7bba8f9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BF215AB858C7785B7C01F7D3D437A918F056F00FE9B065820E1CDD09B7BBA8F9"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14897
Expires: Thu, 02 Feb 2023 03:59:47 GMT
Date: Wed, 01 Feb 2023 23:51:30 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Wc6+mygJb9mrvWYVllArS8MpAGA47vDi54u7KJtDkQQ/ouv5LdsDHNHDU5Vr4n9BrlspJR4+9TA=
x-amz-request-id: KA6PA56EDBWGTDV6
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 01 Feb 2023 23:22:51 GMT
age: 1719
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 01 Feb 2023 23:51:30 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
mkkuei4kdsz.com/430/66.html
200 OK 329 B URL HTTP/1.1 mkkuei4kdsz.com/430/66.html
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash ecbcb8bae64098de3e587487b474f8b8
e275409fb40ea27c3826af493f70faf147d0f995
2597a3f2418586d8a9fb0764743a84486ba066c6af3ff194922fb6c65a783688
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /430/66.html HTTP/1.1
Host: mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 01 Feb 2023 23:51:30 GMT
content-type: text/html
last-modified: Wed, 12 Jan 2022 17:20:45 GMT
etag: W/"61df0ded-1ad"
content-encoding: gzip
transfer-encoding: chunked
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
200 OK 28 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
File type ASCII text, with very long lines (65451)
Hash 4b5f47439b640180cc3450f7de05d0d8
5a0dc9bcab80ddc409dd35fcb00a88fe6846fee2
1f85e8b327f42c17c025d69849914068536d9aa95412fe473ae90ffb2f4ebd82
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mkkuei4kdsz.com
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 01 Feb 2023 23:51:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1141949
expires: Mon, 22 Jan 2024 23:51:30 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oh1jNmGs7l0bOqAYFtacA7BWWExVvuuPuUfliIzI7QsoUuX6K23TIPSRgGL0aBs%2B5gyM24UbTTtgHIEObxFr%2BVBWHe1rmEgctKvUALy3iSVFPnOHCzWrPjbWvjyIKzJE2ZfqNiFo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 792e9872af39b51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash f3ab7ac3ea01eea8173330d3b18ec0bc
1ac3e96ca2d5a4aece2870640f733fd626cd8118
6c28e8c6433cbc7b8f629b0df31d7a51ad74149740b57b4fd5d37795dbfc4c0c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "6C28E8C6433CBC7B8F629B0DF31D7A51AD74149740B57B4FD5D37795DBFC4C0C"
Last-Modified: Tue, 31 Jan 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4287
Expires: Thu, 02 Feb 2023 01:02:58 GMT
Date: Wed, 01 Feb 2023 23:51:31 GMT
Connection: keep-alive
mkkuei4kdsz.com/favicon.ico
200 OK 329 B URL HTTP/1.1 mkkuei4kdsz.com/favicon.ico
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash ecbcb8bae64098de3e587487b474f8b8
e275409fb40ea27c3826af493f70faf147d0f995
2597a3f2418586d8a9fb0764743a84486ba066c6af3ff194922fb6c65a783688
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/430/66.html
HTTP/1.1 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Wed, 01 Feb 2023 23:51:31 GMT
content-type: text/html
last-modified: Wed, 12 Jan 2022 17:20:45 GMT
etag: W/"61df0ded-1ad"
content-encoding: gzip
transfer-encoding: chunked
domaincntrol.com/?orighost=http://mkkuei4kdsz.com/430/66.html
200 OK 28 B URL HTTP/2 domaincntrol.com/?orighost=http://mkkuei4kdsz.com/430/66.html
IP
File type ASCII text, with no line terminators
Hash 7aae16ed70d2e07943585bbb1cd02b55
3209123510c034e6e38ca45edf14307f1375a8f5
51bfb53a70df6adc48f0670be59a16a657ab5a2bafc176973a32d5c36a4fc5d3
GET /?orighost=http://mkkuei4kdsz.com/430/66.html HTTP/1.1
Host: domaincntrol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mkkuei4kdsz.com
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 01 Feb 2023 23:51:31 GMT
content-type: text/javascript;charset=UTF-8
content-length: 28
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z5Ml8zBH6MnjYa%2FE2Z39f58C9e%2FfCp78ygEyUVfVBtuZkeUD71OAU3edUGAFBvFjcAINIBtsbilvHny6LTkjjS5HA0cjjoaFvw19lajECjkNG7GaJSMVMD3DgRIpHIg8rG8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 792e9873cdd1b512-OSL
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Last-Modified, Cache-Control, Pragma, ETag, Backoff, Content-Type, Alert, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 01 Feb 2023 23:41:43 GMT
age: 588
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8913af0be619500295008bb91f506660
a7b8068ba9aa506205a295b24458c2616997a0d1
6a9838d00256431807ca382fc205064b07c08d5054f2895c2ae3cc4e9094179a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A9838D00256431807CA382FC205064B07C08D5054F2895C2AE3CC4E9094179A"
Last-Modified: Wed, 01 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9622
Expires: Thu, 02 Feb 2023 02:31:53 GMT
Date: Wed, 01 Feb 2023 23:51:31 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: xK79l8P+uoZ97mlVuEY0KQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: i5j1DRUo8riSu5A35xIn7bIrHGQ=
ww2.mkkuei4kdsz.com/
200 OK 1.3 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (700)
Hash d243a8d00690dfda0e1931842ba6b3cc
15423ad0a49aaa85cbdce3c578f7ee1d4cdd0269
20735500352c5f80edaac3348623e5eb33f5513a146f245040a772e0c01405c8
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET / HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
date: Wed, 01 Feb 2023 23:51:32 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_zfi2IAQMFhbeJz7TohoVHVtJWU2hwm7Lrp9mU2CS1tg8fh6Um4KcOzzYJ6LQkNLWAjiGBQP1WU+h5qP7TrTizQ==
last-modified: Wed, 01 Feb 2023 23:51:31 GMT
x-cache-miss-from: parking-668bc7f5cc-5pzkw
server: NginX
content-encoding: gzip
img.sedoparking.com/images/js_preloader.gif
200 OK 4.3 kB URL HTTP/1.1 img.sedoparking.com/images/js_preloader.gif
IP
File type GIF image data, version 89a, 16 x 16\012- data
Hash 90c93102a88c2ab94bff1575b7a6e86e
56d71bf13de464534643db9d127629a0a3bf677a
5f6ad7031600056b578a6e8c6b34bc718d13125cc8256aa4a9050e549576f81a
GET /images/js_preloader.gif HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
HTTP/1.1 200 OK
Date: Wed, 01 Feb 2023 23:51:32 GMT
Content-Type: image/gif
Content-Length: 4254
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Wed, 08 Feb 2023 23:51:32 GMT
X-CFHash: "90c93102a88c2ab94bff1575b7a6e86e"
X-CFF: B
Last-Modified: Fri, 15 Mar 2019 12:24:07 GMT
X-CF3: M
CF4Age: 0
x-cf-tsc: 1672141863
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: 2e7f2bc6bb1207435a277f002f5eb2ff
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes
ww2.mkkuei4kdsz.com/search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3NTI5NTQ5MjJhOGVlZmQ3MjYwMjQ3YzliNmUwMGZjOWMxYzU3YzI0&crc=772870ac749a18b7d58c3d4bcc2298328a16f048&cv=1
200 OK 0 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3NTI5NTQ5MjJhOGVlZmQ3MjYwMjQ3YzliNmUwMGZjOWMxYzU3YzI0&crc=772870ac749a18b7d58c3d4bcc2298328a16f048&cv=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3NTI5NTQ5MjJhOGVlZmQ3MjYwMjQ3YzliNmUwMGZjOWMxYzU3YzI0&crc=772870ac749a18b7d58c3d4bcc2298328a16f048&cv=1 HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
HTTP/1.1 200 OK
date: Wed, 01 Feb 2023 23:51:32 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
x-cache-miss-from: parking-668bc7f5cc-jbdlt
server: NginX
ww2.mkkuei4kdsz.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D
302 Found 0 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Wed, 01 Feb 2023 23:51:32 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Wed, 01 Feb 2023 23:51:32 GMT
location: /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D
x-cache-miss-from: parking-668bc7f5cc-vt2v5
server: NginX
ww2.mkkuei4kdsz.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D
302 Found 311 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 0fad3239c6bd20f61317bf1785c59c03
bee95b366fb07c2f70a8aff3c2bd58ddbe198258
be5a4851583994d8f1ca1f18b5fccebe207fcefa9d2f6595d04ce09d938a623a
Analyzer Verdict Alert quad9 Sinkholed
GET /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DBN6bbNTzKf4_0&v=NGMxZTFmZWFjOTk3OTUyOWUyNWQ0Y2I0Nzk2YTAwMTAJMQl3dzIubWtrdWVpNGtkc3ouY29tNjNkYWZiMDNiYWMyYzUuNjgxNjg4NDgJd3cyLm1ra3VlaTRrZHN6LmNvbTYzZGFmYjAzYmFjNmI3Ljc3ODU0MTQ4CTE2NzUyOTU0OTIJYWRfNjNfMA==&l=OAllZWUyOTQ5OGVlMGMyYmIxMzM2MWE3MWRlNTI0YmEyMgkwCTM1CTAJYzEwYWUxODNiYTBjNDU3MGI3ODkyNWQ4Y2VkZDg1ZTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzUyOTU0OTIJOS4wRS02CU4JMAkxCTE4MDUJMTIwNQkxOTQwNDMxNDIJOTEuOTAuNDIuMTU0CTA%3D HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Wed, 01 Feb 2023 23:51:32 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Wed, 01 Feb 2023 23:51:32 GMT
location: http://xml.sedodna.com/click?i=BN6bbNTzKf4_0
x-cache-miss-from: parking-668bc7f5cc-vt2v5
server: NginX
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10420
Expires: Thu, 02 Feb 2023 02:45:13 GMT
Date: Wed, 01 Feb 2023 23:51:33 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10420
Expires: Thu, 02 Feb 2023 02:45:13 GMT
Date: Wed, 01 Feb 2023 23:51:33 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10420
Expires: Thu, 02 Feb 2023 02:45:13 GMT
Date: Wed, 01 Feb 2023 23:51:33 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10420
Expires: Thu, 02 Feb 2023 02:45:13 GMT
Date: Wed, 01 Feb 2023 23:51:33 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e30ba8-4b02-4bad-8cbf-1a128aa4376f.jpeg
200 OK 9.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e30ba8-4b02-4bad-8cbf-1a128aa4376f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3366ef4f8733cb9c89a5c88f63a0a441
7da46843b6d885f38a4759a08e6c899906ab7b97
7114397ee5c251cc5cb46f3433c2cc17ff68a08e0872e227671198e9b61eba0a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e30ba8-4b02-4bad-8cbf-1a128aa4376f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9600
x-amzn-requestid: 91987222-d376-4099-a4e9-5f877b5212be
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLzO2FSDIAMFktg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce325e-281a7e062ee3039d42ae8f83;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:08:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: SEH32iK4aCkxhxQyu3fSlW8uVM1Oj5hwnl2U09k_THEOdAqdEeVMJw==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:03:43 GMT
age: 6470
etag: "7da46843b6d885f38a4759a08e6c899906ab7b97"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdab614ba-4572-4b54-9079-a26b68b1ece7.jpeg
200 OK 15 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdab614ba-4572-4b54-9079-a26b68b1ece7.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6bb5b89e738516f4862491eec286bf6d
8fb46b9ca85f2c578eb2a56d0007859183e12209
7f164a37b675bf39f8473392b07a2a383397da003303965fb190fd4f455bb43b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdab614ba-4572-4b54-9079-a26b68b1ece7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15051
x-amzn-requestid: 72a3f2ae-538e-40dc-9496-86c28334ba0d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frc6jGTAIAMFy4A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadb76-72178ed13a2e70d462785b90;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:36:54 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: CKTfQzCvXa4oL6Lm2n8Rw_9Uhj69YfgpDTP9s0zoaX5qW1vcqWIXDA==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 21:54:58 GMT
age: 6995
etag: "8fb46b9ca85f2c578eb2a56d0007859183e12209"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00c1df1d-5e83-46c4-87de-093028c17afe.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00c1df1d-5e83-46c4-87de-093028c17afe.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dbb3b7fe13504478f3fe5e8c0190b8db
b8ca03ed416b5ab9cd118f32a1890ffa764a7aec
e47f269c393ee8d87bfce593f31fd49309e1d9b47b8745dd3b6568036da50d55
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00c1df1d-5e83-46c4-87de-093028c17afe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7416
x-amzn-requestid: c4e8c4e6-5f2a-4b94-ad48-f10fb51c78c2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frc5BH1-IAMF17g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadb6c-40e58e6e49f919a3740bb92a;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:36:44 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2-O9YJrb-baVaEYFpesrbfMrIDBautEp2f5ilm1-vmHcjUGxE0c1VA==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:29:58 GMT
etag: "b8ca03ed416b5ab9cd118f32a1890ffa764a7aec"
content-type: image/jpeg
age: 4895
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg
200 OK 5.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7c823f1d6bf1c50d58eb263b85e6e37c
a7b74d11494fb3254df907e5cc1eead070d84617
b2706961eb756383e0988dfdb501dc424aea59697aedd1e4a6c294c314a31935
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5356
x-amzn-requestid: fef22c83-35a4-4990-9008-af5853f838d1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frc5BEB6oAMFczg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadb6c-68d3017555c069bc3107d150;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:36:44 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: i697kJpdT4ZPeMLWIftWf16pWCic0-v4tL4GDKfVfTZLo-E4-3FwDQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:21:38 GMT
age: 5395
etag: "a7b74d11494fb3254df907e5cc1eead070d84617"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9dac6192-89b0-4161-86a2-38f3998a1bc4.jpeg
200 OK 6.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9dac6192-89b0-4161-86a2-38f3998a1bc4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f1d06527f75868ea84da730b7c8b5660
6c0cb65a477d6bc7d013529411d5735bd39e3d46
2ff4fb12b9ac4dff67bf89cc69f1bfce3ffa738696f904172044a5a537a704c9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9dac6192-89b0-4161-86a2-38f3998a1bc4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6783
x-amzn-requestid: 5ab60169-ec65-483a-828b-3312c74ee4b2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frc5BGjqoAMFV6g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadb6c-73a465244f89adaa27626246;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:36:44 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: EnMwKHnlZQbvGDjPKuFqW9G8CBaRAV6QKzJ2VFOtRPDm3EIgVUpmYQ==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 21:57:29 GMT
age: 6844
etag: "6c0cb65a477d6bc7d013529411d5735bd39e3d46"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b1e36ab-6847-48e2-8227-fc589124cb93.jpeg
200 OK 7.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b1e36ab-6847-48e2-8227-fc589124cb93.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6f4dbd75e0cdc28265ccbe825c5c5b6c
78187b014be0ee8bf7543fb873915db8a9c8dbc4
bf49642b990d73f58ca5f9ee979271ba2ab80bae94c8f333fa5737b16016d1c8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b1e36ab-6847-48e2-8227-fc589124cb93.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7036
x-amzn-requestid: 9d54dd82-add1-4d7d-97b7-53c92eecb724
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fmJxCHAqoAMF3qA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d8bcd3-109d34d11a9834886e3080ee;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 07:01:39 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: U45NW79hI4Vtd7fV7kXnxqlxRQzC-u9PVlNK4D1pBkAa8CBYuUf9ig==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 07:09:17 GMT
age: 60136
etag: "78187b014be0ee8bf7543fb873915db8a9c8dbc4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
xml.sedodna.com/click?i=BN6bbNTzKf4_0
302 Found 0 B URL HTTP/1.1 xml.sedodna.com/click?i=BN6bbNTzKf4_0
IP
ASN #27257 WEBAIR-INTERNET
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?i=BN6bbNTzKf4_0 HTTP/1.1
Host: xml.sedodna.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: https://mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5XEuPzWq_Ou8m-TPPz2Cn8RG_6U4hqQTcO4eq_lgR48_oiQJuDuwoS9gcFc4_-stlmbd3B7sGcRAkoDlrhq7v09i6czQKU3WjqWfap4yUt_iPH1TzciB1Qg6AZUDRz9bjOEX4iGGchU1Apy7TE6BJMSSLAIB5vnWt1PrtVJbBzLpMCvzPr3UDnWvQMhV3fSpW-sfQHTPE_NOUAFqAJEKb8pSSu7ysWNeEXRK5plpnfidc3u4QgWuKxa0KxrUKsEwPEDTLQAL52Ht1kcYEH36gx1cFSLpeQzn3tPO3upLU_PYagqXMHC-Hab7eSF45F9WdulDaWvFVjm2a6TGqkJjBBmHChzqbPMVy7Y3DWWJmeIjaPADs2SrgyF__sv4q1GugovFIKnc4h47jWAPYQA4zyX4mssHhUMpCRlgL4YMCECFDoxvdvJBk7KsAenm9amqJ7eqB80xbrd8jBpM4uDHwcl_17alocfNDu20jA2_4hM8LdK9z-_K17maOeI8FDW03xuQ-S15Gg8vPjOpfTGeNgKnJLI9jMp_dr3qhjUJa4NnDDbFFK7KdINInHpb6jah8Cic28wWVjKlTg_HXb5hqI5mXg7i9pN12S_7dUtBEED_WkaJRmWqv4N2AXTAxuGqBjGRMT89xx875oDwZEeBEAdWtwOVJiBVJL5xH348d5YhVYWySHz1zHVDKvRE0ZeZDxN0stQzDZsgzRc2i5VdmdioxSnkZLSToOrv8W5VcVO648_LwkxofKLCzHY20qbUhNK6I3aOeLBvFOivbDzD5tmzXz3MPdAOHksZm5-qIScMzKZ7G8oNqBIt9e7r_ZxeUEsQo6RtW5Wjkb01DwSfcuMzhj1cIyndffZIqqILnt_l0XaT_nuXE9mv9EZV8DkWl8UoBOkqvD1RDAbVc0Osr3NIWDlvMfvheaSH2adxiDTDRy1Zo7PG1p2azryzCafhm8xDaWGolfKCoTkcaOBjecaMkoY6W39U-bkmdqJZ5QwywxOifFafq2KtSStWeSexnBDUsAjReqsC8T6FZOp0ZMrgPoxdNST-TuiC5-ZNuWGuljBpiiaAB4JUkBB2MaGQM4rP3Im4ZOgqZeCnOLRXoGZks-TjXqhLbsW5EU-chnfq_9NtuYLCXRKaETcsPEOSAaUBFX-kezBK5jzxtn1QkmiqDc7pQu8wKrtg5Yuugvl7nAA319rQT5Ud6a0Dn6eNJZbhSXBsuqp4TKI2qVF_upugCggYFh3EAoiiZxlTdJcUbO7pWllwGdVGZXxgmhR3INz-QU0tQexjS1sjTSDdvxjTnBG6KLohwyqV7tETR7cP-o1a3gHjZa_gjn5QKyssU7dq2rVA9fmvq9IaY6LYxIeiF1cs76ErxCBdlQonnkAtH2nCzpVOQcBJKWnGaCo17onOqLNsrJIIZq0s55ffWLO9XXK-5-bqjWweKlvXeRvlT78LKb3Zm23b9cqc1MzCvqwpc5t7Yo_2McijoxVxzpSdI6q2B4HaurXtVVrcM9JHif67yiu6p1diUOItSwgcyRCmuI0tSEk_a_Gei7StA-CFjNx6Toj9kghgbOnleKyz947GP4TsT26NezqvwtmGKUTpGk9yX0sr4SfHbi0RDkFmhaS5DjZ7fq1QONt9OxTf7WLbPkU3hnuULpSBOclApGnETwPbCednl8usGYgrUihltjPnnWR7ArmQLfoUt5WaRwCIXpnHq8I0bYtXdmST4aCvw1mX2qEUhYBeUO1dAajXaSwjszpoemvdNVb-Ai2sCC7QSYRJxkXd-d-Km4x3zpGL3jwDO2rKic6os2yskgrCLYR7wB-v9Wa_x1wU3pDZetrPeDa_33O76AwuK8-pP
Pragma: no-cache
ocsp.sectigo.com/
200 OK 472 B IP
Hash bc288310c7a5f80bbc8e5dbeace292af
d68ca97515594770b04f3c3ae943d186e75ad2c5
6def27992aed1f32911f4820b432dca388db29e13b623596229f8e2ccfb9435f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 01 Feb 2023 23:51:33 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sun, 29 Jan 2023 19:25:42 GMT
Expires: Sun, 05 Feb 2023 19:25:41 GMT
Etag: "d68ca97515594770b04f3c3ae943d186e75ad2c5"
Cache-Control: max-age=329047,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 792e98827a4ab4f7-OSL
mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5XEuPzWq_Ou8m-TPPz2Cn8RG_6U4hqQTcO4eq_lgR48_oiQJuDuwoS9gcFc4_-stlmbd3B7sGcRAkoDlrhq7v09i6czQKU3WjqWfap4yUt_iPH1TzciB1Qg6AZUDRz9bjOEX4iGGchU1Apy7TE6BJMSSLAIB5vnWt1PrtVJbBzLpMCvzPr3UDnWvQMhV3fSpW-sfQHTPE_NOUAFqAJEKb8pSSu7ysWNeEXRK5plpnfidc3u4QgWuKxa0KxrUKsEwPEDTLQAL52Ht1kcYEH36gx1cFSLpeQzn3tPO3upLU_PYagqXMHC-Hab7eSF45F9WdulDaWvFVjm2a6TGqkJjBBmHChzqbPMVy7Y3DWWJmeIjaPADs2SrgyF__sv4q1GugovFIKnc4h47jWAPYQA4zyX4mssHhUMpCRlgL4YMCECFDoxvdvJBk7KsAenm9amqJ7eqB80xbrd8jBpM4uDHwcl_17alocfNDu20jA2_4hM8LdK9z-_K17maOeI8FDW03xuQ-S15Gg8vPjOpfTGeNgKnJLI9jMp_dr3qhjUJa4NnDDbFFK7KdINInHpb6jah8Cic28wWVjKlTg_HXb5hqI5mXg7i9pN12S_7dUtBEED_WkaJRmWqv4N2AXTAxuGqBjGRMT89xx875oDwZEeBEAdWtwOVJiBVJL5xH348d5YhVYWySHz1zHVDKvRE0ZeZDxN0stQzDZsgzRc2i5VdmdioxSnkZLSToOrv8W5VcVO648_LwkxofKLCzHY20qbUhNK6I3aOeLBvFOivbDzD5tmzXz3MPdAOHksZm5-qIScMzKZ7G8oNqBIt9e7r_ZxeUEsQo6RtW5Wjkb01DwSfcuMzhj1cIyndffZIqqILnt_l0XaT_nuXE9mv9EZV8DkWl8UoBOkqvD1RDAbVc0Osr3NIWDlvMfvheaSH2adxiDTDRy1Zo7PG1p2azryzCafhm8xDaWGolfKCoTkcaOBjecaMkoY6W39U-bkmdqJZ5QwywxOifFafq2KtSStWeSexnBDUsAjReqsC8T6FZOp0ZMrgPoxdNST-TuiC5-ZNuWGuljBpiiaAB4JUkBB2MaGQM4rP3Im4ZOgqZeCnOLRXoGZks-TjXqhLbsW5EU-chnfq_9NtuYLCXRKaETcsPEOSAaUBFX-kezBK5jzxtn1QkmiqDc7pQu8wKrtg5Yuugvl7nAA319rQT5Ud6a0Dn6eNJZbhSXBsuqp4TKI2qVF_upugCggYFh3EAoiiZxlTdJcUbO7pWllwGdVGZXxgmhR3INz-QU0tQexjS1sjTSDdvxjTnBG6KLohwyqV7tETR7cP-o1a3gHjZa_gjn5QKyssU7dq2rVA9fmvq9IaY6LYxIeiF1cs76ErxCBdlQonnkAtH2nCzpVOQcBJKWnGaCo17onOqLNsrJIIZq0s55ffWLO9XXK-5-bqjWweKlvXeRvlT78LKb3Zm23b9cqc1MzCvqwpc5t7Yo_2McijoxVxzpSdI6q2B4HaurXtVVrcM9JHif67yiu6p1diUOItSwgcyRCmuI0tSEk_a_Gei7StA-CFjNx6Toj9kghgbOnleKyz947GP4TsT26NezqvwtmGKUTpGk9yX0sr4SfHbi0RDkFmhaS5DjZ7fq1QONt9OxTf7WLbPkU3hnuULpSBOclApGnETwPbCednl8usGYgrUihltjPnnWR7ArmQLfoUt5WaRwCIXpnHq8I0bYtXdmST4aCvw1mX2qEUhYBeUO1dAajXaSwjszpoemvdNVb-Ai2sCC7QSYRJxkXd-d-Km4x3zpGL3jwDO2rKic6os2yskgrCLYR7wB-v9Wa_x1wU3pDZetrPeDa_33O76AwuK8-pP
302 Found 0 B URL HTTP/2 mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5XEuPzWq_Ou8m-TPPz2Cn8RG_6U4hqQTcO4eq_lgR48_oiQJuDuwoS9gcFc4_-stlmbd3B7sGcRAkoDlrhq7v09i6czQKU3WjqWfap4yUt_iPH1TzciB1Qg6AZUDRz9bjOEX4iGGchU1Apy7TE6BJMSSLAIB5vnWt1PrtVJbBzLpMCvzPr3UDnWvQMhV3fSpW-sfQHTPE_NOUAFqAJEKb8pSSu7ysWNeEXRK5plpnfidc3u4QgWuKxa0KxrUKsEwPEDTLQAL52Ht1kcYEH36gx1cFSLpeQzn3tPO3upLU_PYagqXMHC-Hab7eSF45F9WdulDaWvFVjm2a6TGqkJjBBmHChzqbPMVy7Y3DWWJmeIjaPADs2SrgyF__sv4q1GugovFIKnc4h47jWAPYQA4zyX4mssHhUMpCRlgL4YMCECFDoxvdvJBk7KsAenm9amqJ7eqB80xbrd8jBpM4uDHwcl_17alocfNDu20jA2_4hM8LdK9z-_K17maOeI8FDW03xuQ-S15Gg8vPjOpfTGeNgKnJLI9jMp_dr3qhjUJa4NnDDbFFK7KdINInHpb6jah8Cic28wWVjKlTg_HXb5hqI5mXg7i9pN12S_7dUtBEED_WkaJRmWqv4N2AXTAxuGqBjGRMT89xx875oDwZEeBEAdWtwOVJiBVJL5xH348d5YhVYWySHz1zHVDKvRE0ZeZDxN0stQzDZsgzRc2i5VdmdioxSnkZLSToOrv8W5VcVO648_LwkxofKLCzHY20qbUhNK6I3aOeLBvFOivbDzD5tmzXz3MPdAOHksZm5-qIScMzKZ7G8oNqBIt9e7r_ZxeUEsQo6RtW5Wjkb01DwSfcuMzhj1cIyndffZIqqILnt_l0XaT_nuXE9mv9EZV8DkWl8UoBOkqvD1RDAbVc0Osr3NIWDlvMfvheaSH2adxiDTDRy1Zo7PG1p2azryzCafhm8xDaWGolfKCoTkcaOBjecaMkoY6W39U-bkmdqJZ5QwywxOifFafq2KtSStWeSexnBDUsAjReqsC8T6FZOp0ZMrgPoxdNST-TuiC5-ZNuWGuljBpiiaAB4JUkBB2MaGQM4rP3Im4ZOgqZeCnOLRXoGZks-TjXqhLbsW5EU-chnfq_9NtuYLCXRKaETcsPEOSAaUBFX-kezBK5jzxtn1QkmiqDc7pQu8wKrtg5Yuugvl7nAA319rQT5Ud6a0Dn6eNJZbhSXBsuqp4TKI2qVF_upugCggYFh3EAoiiZxlTdJcUbO7pWllwGdVGZXxgmhR3INz-QU0tQexjS1sjTSDdvxjTnBG6KLohwyqV7tETR7cP-o1a3gHjZa_gjn5QKyssU7dq2rVA9fmvq9IaY6LYxIeiF1cs76ErxCBdlQonnkAtH2nCzpVOQcBJKWnGaCo17onOqLNsrJIIZq0s55ffWLO9XXK-5-bqjWweKlvXeRvlT78LKb3Zm23b9cqc1MzCvqwpc5t7Yo_2McijoxVxzpSdI6q2B4HaurXtVVrcM9JHif67yiu6p1diUOItSwgcyRCmuI0tSEk_a_Gei7StA-CFjNx6Toj9kghgbOnleKyz947GP4TsT26NezqvwtmGKUTpGk9yX0sr4SfHbi0RDkFmhaS5DjZ7fq1QONt9OxTf7WLbPkU3hnuULpSBOclApGnETwPbCednl8usGYgrUihltjPnnWR7ArmQLfoUt5WaRwCIXpnHq8I0bYtXdmST4aCvw1mX2qEUhYBeUO1dAajXaSwjszpoemvdNVb-Ai2sCC7QSYRJxkXd-d-Km4x3zpGL3jwDO2rKic6os2yskgrCLYR7wB-v9Wa_x1wU3pDZetrPeDa_33O76AwuK8-pP
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Phishing
GET /aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5XEuPzWq_Ou8m-TPPz2Cn8RG_6U4hqQTcO4eq_lgR48_oiQJuDuwoS9gcFc4_-stlmbd3B7sGcRAkoDlrhq7v09i6czQKU3WjqWfap4yUt_iPH1TzciB1Qg6AZUDRz9bjOEX4iGGchU1Apy7TE6BJMSSLAIB5vnWt1PrtVJbBzLpMCvzPr3UDnWvQMhV3fSpW-sfQHTPE_NOUAFqAJEKb8pSSu7ysWNeEXRK5plpnfidc3u4QgWuKxa0KxrUKsEwPEDTLQAL52Ht1kcYEH36gx1cFSLpeQzn3tPO3upLU_PYagqXMHC-Hab7eSF45F9WdulDaWvFVjm2a6TGqkJjBBmHChzqbPMVy7Y3DWWJmeIjaPADs2SrgyF__sv4q1GugovFIKnc4h47jWAPYQA4zyX4mssHhUMpCRlgL4YMCECFDoxvdvJBk7KsAenm9amqJ7eqB80xbrd8jBpM4uDHwcl_17alocfNDu20jA2_4hM8LdK9z-_K17maOeI8FDW03xuQ-S15Gg8vPjOpfTGeNgKnJLI9jMp_dr3qhjUJa4NnDDbFFK7KdINInHpb6jah8Cic28wWVjKlTg_HXb5hqI5mXg7i9pN12S_7dUtBEED_WkaJRmWqv4N2AXTAxuGqBjGRMT89xx875oDwZEeBEAdWtwOVJiBVJL5xH348d5YhVYWySHz1zHVDKvRE0ZeZDxN0stQzDZsgzRc2i5VdmdioxSnkZLSToOrv8W5VcVO648_LwkxofKLCzHY20qbUhNK6I3aOeLBvFOivbDzD5tmzXz3MPdAOHksZm5-qIScMzKZ7G8oNqBIt9e7r_ZxeUEsQo6RtW5Wjkb01DwSfcuMzhj1cIyndffZIqqILnt_l0XaT_nuXE9mv9EZV8DkWl8UoBOkqvD1RDAbVc0Osr3NIWDlvMfvheaSH2adxiDTDRy1Zo7PG1p2azryzCafhm8xDaWGolfKCoTkcaOBjecaMkoY6W39U-bkmdqJZ5QwywxOifFafq2KtSStWeSexnBDUsAjReqsC8T6FZOp0ZMrgPoxdNST-TuiC5-ZNuWGuljBpiiaAB4JUkBB2MaGQM4rP3Im4ZOgqZeCnOLRXoGZks-TjXqhLbsW5EU-chnfq_9NtuYLCXRKaETcsPEOSAaUBFX-kezBK5jzxtn1QkmiqDc7pQu8wKrtg5Yuugvl7nAA319rQT5Ud6a0Dn6eNJZbhSXBsuqp4TKI2qVF_upugCggYFh3EAoiiZxlTdJcUbO7pWllwGdVGZXxgmhR3INz-QU0tQexjS1sjTSDdvxjTnBG6KLohwyqV7tETR7cP-o1a3gHjZa_gjn5QKyssU7dq2rVA9fmvq9IaY6LYxIeiF1cs76ErxCBdlQonnkAtH2nCzpVOQcBJKWnGaCo17onOqLNsrJIIZq0s55ffWLO9XXK-5-bqjWweKlvXeRvlT78LKb3Zm23b9cqc1MzCvqwpc5t7Yo_2McijoxVxzpSdI6q2B4HaurXtVVrcM9JHif67yiu6p1diUOItSwgcyRCmuI0tSEk_a_Gei7StA-CFjNx6Toj9kghgbOnleKyz947GP4TsT26NezqvwtmGKUTpGk9yX0sr4SfHbi0RDkFmhaS5DjZ7fq1QONt9OxTf7WLbPkU3hnuULpSBOclApGnETwPbCednl8usGYgrUihltjPnnWR7ArmQLfoUt5WaRwCIXpnHq8I0bYtXdmST4aCvw1mX2qEUhYBeUO1dAajXaSwjszpoemvdNVb-Ai2sCC7QSYRJxkXd-d-Km4x3zpGL3jwDO2rKic6os2yskgrCLYR7wB-v9Wa_x1wU3pDZetrPeDa_33O76AwuK8-pP HTTP/1.1
Host: mybettermb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Wed, 01 Feb 2023 23:51:33 GMT
content-length: 0
set-cookie: rhid=82811952538; Max-Age=15552000; Expires=Mon, 31-Jul-2023 23:51:33 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
location: https://p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEmzfmZhaSJ4VDvQkXSI-ukWfvXBKZ_OYCBdYtJCkbRkxbaMHjMW5FMVZ1q7sg30V1X0j3MVUJ4vmn3Zyn6-Rw-YR_ep3g43JQoLurTSybV3_zVVlMvpZOzxY7hA_5WLvNF7vPMElssBC8QYVDSNYmQ3hu-U9ACuKtcekCIShJdvtuB6OXN_rsgcmEGqekUBiP2KUlfY2PGaU&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukMNIsZgrZCPtMbBCVTa3AtgkGCIeh8M6bWlW8Uiy9Zkk3hWnhqCRb6od7vq7ycv2nR_n0EpVw-U5g&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=_IMbbubN2xw&rr=1&abtg=0
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 48eb85cb00ff4fe5949be1c2bc721f56
05ec70386a3d17cd38a520f951fea3a74f005dd8
e21e4298c0ad90f1fd080011036ce84e7285d0be15572c3a9531d508b7061821
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E21E4298C0AD90F1FD080011036CE84E7285D0BE15572C3A9531D508B7061821"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10718
Expires: Thu, 02 Feb 2023 02:50:12 GMT
Date: Wed, 01 Feb 2023 23:51:34 GMT
Connection: keep-alive
qvikar.com/symantec/security/438203600
302 Found 0 B URL HTTP/2 qvikar.com/symantec/security/438203600
IP
ASN #46606 UNIFIEDLAYER-AS-1
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /symantec/security/438203600 HTTP/1.1
Host: qvikar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
location: https://www.clkmg.com/qvikar/symantec/security/438203600/
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 01 Feb 2023 23:51:34 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 63b4556ac978fa934dfcbe56dedcd0c1
100a265e55512c90d74518d7f41b34d0e636c787
aa86c26e4f6af235ed0433ac30708ca2b648b4155197d185c12c98f6543f406b
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1423
Server: nginx
Content-Type: application/ocsp-response
Expires: Sun, 05 Feb 2023 23:20:36 GMT
ETag: "100a265e55512c90d74518d7f41b34d0e636c787"
Last-Modified: Wed, 01 Feb 2023 23:20:37 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 01 Feb 2023 23:51:35 GMT
Age: 1858
X-Served-By: cache-qpg1280-QPG, cache-bma1639-BMA
X-Cache: HIT, MISS
X-Cache-Hits: 5, 0
X-Timer: S1675295495.187761,VS0,VE401
www.clkmg.com/qvikar/symantec/security/438203600/
302 Found 252 B URL HTTP/1.1 www.clkmg.com/qvikar/symantec/security/438203600/
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash f8e0d84321b2e3784347d18576532a0c
4618d65b989caf526cdd39434e52a42c74dd93ec
f886f67905fa02b7c13894be500f5a1736fe20542e0a57561444ce84be3824a5
GET /qvikar/symantec/security/438203600/ HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Date: Wed, 01 Feb 2023 23:51:35 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 252
Connection: keep-alive
P3P: CP="This is not a P3P policy! See https://www.clkmg.com for more info."
Set-Cookie: alc=1; domain=.clkmg.com; expires=Wed Feb 1 23:51:40 2023; path=/;
lids=1537844-154434+; domain=.clkmg.com; expires=Thu Feb 1 23:51:35 2024; path=/;
Location: https://www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 300
X-CM-FE: httpfe-01.clickmagick.com
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
200 OK 1.4 kB URL HTTP/1.1 www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fbf6005663528fbffb7fdf9c8fa995bc
de4dc1559fd1bd3026d94887738125a83b4012b6
972ee94dbdbea4c5e3a75afbb7d2b5ee9dd6e5558b8d09603491b51b7ccbb704
GET /err/?u=qvikar&l=symantec&s=A&e=403 HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: lids=1537844-154434+
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Wed, 01 Feb 2023 23:51:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="This is not a P3P policy! See http://www.clkmg.com for more info."
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 300
X-CM-FE: httpfe-01.clickmagick.com
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cdn.clkmg.com/misc/css/style.css
200 OK 4.5 kB URL HTTP/1.1 cdn.clkmg.com/misc/css/style.css
IP
Hash e540f61448a0e598774be6738463a0c5
75c83228491705c9a412383803decd6878c3f163
263bd19121ab72d1db5109850141dd62598ee8d4240b4cbfb3bce40a85c5da3c
GET /misc/css/style.css HTTP/1.1
Host: cdn.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Cookie: lids=1537844-154434+
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 4498
Connection: keep-alive
Date: Sun, 08 Jan 2023 01:39:24 GMT
Last-Modified: Sat, 06 Aug 2022 19:05:46 GMT
ETag: "62eebb8a-1192"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 300
Expires: Tue, 07 Feb 2023 01:39:24 GMT
Cache-Control: max-age=2592000, public, no-transform
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: hg8sCI3zCNKvpltU44qhYUY-DW5-7dBk3g8X6Ag-EkOi7vYtVPRfDg==
Age: 2153532
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
cdn.clkmg.com/images/spacer.gif
200 OK 43 B URL HTTP/1.1 cdn.clkmg.com/images/spacer.gif
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash fc94fb0c3ed8a8f909dbc7630a0987ff
56d45f8a17f5078a20af9962c992ca4678450765
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
GET /images/spacer.gif HTTP/1.1
Host: cdn.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Cookie: lids=1537844-154434+
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Date: Mon, 09 Jan 2023 02:31:58 GMT
Last-Modified: Thu, 23 Feb 2017 23:21:15 GMT
ETag: "58af6e6b-2b"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 300
Expires: Sun, 09 Apr 2023 02:31:58 GMT
Cache-Control: max-age=7776000, public, no-transform
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: lvWv90o-e3zWw8hyP1hPaWikFZQo4PL6avcmUGF-yBxfS-7Jx8ewrA==
Age: 2063978
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash e74879bb734179328ccc50ac337e6df8
56bb86d0afe92ee75eeb276741ba66ea149fd97b
9e27fca715c7474b3355b8468c8f05a68d7bcf67f1781be11a75131b63c74d91
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1423
Server: nginx
Content-Type: application/ocsp-response
Expires: Sun, 05 Feb 2023 23:51:35 GMT
ETag: "56bb86d0afe92ee75eeb276741ba66ea149fd97b"
Last-Modified: Wed, 01 Feb 2023 23:51:36 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 01 Feb 2023 23:51:36 GMT
Age: 0
X-Served-By: cache-qpg1262-QPG, cache-bma1621-BMA
X-Cache: MISS, HIT
X-Cache-Hits: 0, 1
X-Timer: S1675295496.215425,VS0,VE189
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash e74879bb734179328ccc50ac337e6df8
56bb86d0afe92ee75eeb276741ba66ea149fd97b
9e27fca715c7474b3355b8468c8f05a68d7bcf67f1781be11a75131b63c74d91
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1423
Server: nginx
Content-Type: application/ocsp-response
Expires: Sun, 05 Feb 2023 23:51:35 GMT
ETag: "56bb86d0afe92ee75eeb276741ba66ea149fd97b"
Last-Modified: Wed, 01 Feb 2023 23:51:36 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 01 Feb 2023 23:51:36 GMT
Age: 0
X-Served-By: cache-qpg1262-QPG, cache-bma1680-BMA
X-Cache: MISS, HIT
X-Cache-Hits: 0, 1
X-Timer: S1675295496.216402,VS0,VE187
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash e74879bb734179328ccc50ac337e6df8
56bb86d0afe92ee75eeb276741ba66ea149fd97b
9e27fca715c7474b3355b8468c8f05a68d7bcf67f1781be11a75131b63c74d91
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1423
Server: nginx
Content-Type: application/ocsp-response
Expires: Sun, 05 Feb 2023 23:51:35 GMT
ETag: "56bb86d0afe92ee75eeb276741ba66ea149fd97b"
Last-Modified: Wed, 01 Feb 2023 23:51:36 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 01 Feb 2023 23:51:36 GMT
Age: 0
X-Served-By: cache-qpg1262-QPG, cache-bma1639-BMA
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Timer: S1675295496.197973,VS0,VE206
cdn.clickmagick.com/misc/fonts/website/v3/Inter-Regular.woff
200 OK 149 kB URL HTTP/2 cdn.clickmagick.com/misc/fonts/website/v3/Inter-Regular.woff
IP
File type Web Open Font Format, TrueType, length 149344, version 0.0\012- data
Size 149 kB (149344 bytes)
Hash ea2c76b525641c2051cdf7d930e465ba
b3ffc2515b8429e92540e084fd6011f32b8df368
6ab2042219a7bbc2f5523d61ad24c9f1e3627f2cbb891669d981da8bb019c11e
GET /misc/fonts/website/v3/Inter-Regular.woff HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://cdn.clkmg.com/
Origin: https://www.clkmg.com
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/font-woff
content-length: 149344
date: Wed, 01 Feb 2023 15:02:55 GMT
last-modified: Wed, 22 Jun 2022 15:39:23 GMT
etag: "62b337ab-24760"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-max-age: 300
x-cm-fe: httpfe-01.clickmagick.com
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: HJ0JiXbrYOVikcMIvWO4CMXM1OeBFYfRmbCO8718TE6-nc_Vdhc3tA==
age: 31721
x-robots-tag: noindex
X-Firefox-Spdy: h2
cdn.clickmagick.com/images/logo.gif
200 OK 4.3 kB URL HTTP/2 cdn.clickmagick.com/images/logo.gif
IP
File type GIF image data, version 89a, 300 x 64\012- data
Hash 1bfe88368945f71f6b145f8fdc431c3f
2650030369e5c327d5eaf4a6b9fd175786bda751
b069053ff474120a849ba3e9f1d4110f4311608883e9ec1cdbe68e1b181dcc73
GET /images/logo.gif HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 4252
date: Wed, 01 Feb 2023 14:15:12 GMT
last-modified: Wed, 27 Jul 2022 23:18:29 GMT
etag: "62e1c7c5-109c"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-max-age: 300
expires: Tue, 02 May 2023 14:15:12 GMT
cache-control: max-age=7776000, public, no-transform
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: YQKuxJSu5n3_JzI3OvNu1M8AUNcWZ8Cbvbsw_FxeI7U3JZqklMZvtw==
age: 34584
x-robots-tag: noindex
X-Firefox-Spdy: h2
cdn.clickmagick.com/misc/fonts/website/v3/Inter-Medium.woff
200 OK 158 kB URL HTTP/2 cdn.clickmagick.com/misc/fonts/website/v3/Inter-Medium.woff
IP
File type Web Open Font Format, TrueType, length 157888, version 0.0\012- data
Size 158 kB (157888 bytes)
Hash 6b5a42f0603ea013e7099c2160e007e7
1a817b28d15fba7537a6ac0ed28126589062f303
860f80f683dd2cca3acc4680a798cd8a1a8dd8d6a0e18312692d9504f3792242
GET /misc/fonts/website/v3/Inter-Medium.woff HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://cdn.clkmg.com/
Origin: https://www.clkmg.com
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/font-woff
content-length: 157888
date: Wed, 01 Feb 2023 15:02:55 GMT
last-modified: Wed, 22 Jun 2022 15:39:23 GMT
etag: "62b337ab-268c0"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-max-age: 300
x-cm-fe: httpfe-02.clickmagick.com
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 4X0HbY6z2OdAR8GIosMsyDxHzruA-Gwc32Yfa8P-5sV_Wa9LAP7F-g==
age: 31721
x-robots-tag: noindex
X-Firefox-Spdy: h2
www.clkmg.com/favicon.ico
200 OK 78 B URL HTTP/1.1 www.clkmg.com/favicon.ico
IP
File type MS Windows icon resource - 1 icon, 1x1, 2 colors\012- data
Hash c9e1efa761b83f4a25a07dc85c207f95
7c1df040d4119e1c1b4f875c362f363ad1f6ba13
91634633ca6d34044c356a9a0baa832f1927d8326e1ae1a95af22b864d30dd7f
GET /favicon.ico HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
Cookie: lids=1537844-154434+
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Wed, 01 Feb 2023 23:51:36 GMT
Content-Type: image/x-icon
Content-Length: 78
Last-Modified: Thu, 21 Apr 2022 16:32:44 GMT
Connection: keep-alive
ETag: "6261872c-4e"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Max-Age: 300
Expires: Fri, 03 Mar 2023 23:51:36 GMT
Pragma: public
Cache-Control: max-age=2592000, public
Accept-Ranges: bytes
p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEmzfmZhaSJ4VDvQkXSI-ukWfvXBKZ_OYCBdYtJCkbRkxbaMHjMW5FMVZ1q7sg30V1X0j3MVUJ4vmn3Zyn6-Rw-YR_ep3g43JQoLurTSybV3_zVVlMvpZOzxY7hA_5WLvNF7vPMElssBC8QYVDSNYmQ3hu-U9ACuKtcekCIShJdvtuB6OXN_rsgcmEGqekUBiP2KUlfY2PGaU&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukMNIsZgrZCPtMbBCVTa3AtgkGCIeh8M6bWlW8Uiy9Zkk3hWnhqCRb6od7vq7ycv2nR_n0EpVw-U5g&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=_IMbbubN2xw&rr=1&abtg=0
200 OK 0 B URL HTTP/2 p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEmzfmZhaSJ4VDvQkXSI-ukWfvXBKZ_OYCBdYtJCkbRkxbaMHjMW5FMVZ1q7sg30V1X0j3MVUJ4vmn3Zyn6-Rw-YR_ep3g43JQoLurTSybV3_zVVlMvpZOzxY7hA_5WLvNF7vPMElssBC8QYVDSNYmQ3hu-U9ACuKtcekCIShJdvtuB6OXN_rsgcmEGqekUBiP2KUlfY2PGaU&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukMNIsZgrZCPtMbBCVTa3AtgkGCIeh8M6bWlW8Uiy9Zkk3hWnhqCRb6od7vq7ycv2nR_n0EpVw-U5g&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=_IMbbubN2xw&rr=1&abtg=0
IP
GET /adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEmzfmZhaSJ4VDvQkXSI-ukWfvXBKZ_OYCBdYtJCkbRkxbaMHjMW5FMVZ1q7sg30V1X0j3MVUJ4vmn3Zyn6-Rw-YR_ep3g43JQoLurTSybV3_zVVlMvpZOzxY7hA_5WLvNF7vPMElssBC8QYVDSNYmQ3hu-U9ACuKtcekCIShJdvtuB6OXN_rsgcmEGqekUBiP2KUlfY2PGaU&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukMNIsZgrZCPtMbBCVTa3AtgkGCIeh8M6bWlW8Uiy9Zkk3hWnhqCRb6od7vq7ycv2nR_n0EpVw-U5g&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=_IMbbubN2xw&rr=1&abtg=0 HTTP/1.1
Host: p201298.mybettermb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Cookie: rhid=82811952538
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Wed, 01 Feb 2023 23:51:33 GMT
content-type: text/html;charset=ISO-8859-1
vary: Accept-Encoding
set-cookie: rhid=82811952538; Max-Age=15552000; Expires=Mon, 31-Jul-2023 23:51:33 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
loi=ad_857954_off_361683_aff_11454_cid_201298-MKKUEI4KDSZ.COM_ts_1675295493; Max-Age=3600; Expires=Thu, 02-Feb-2023 00:51:33 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
content-encoding: gzip
X-Firefox-Spdy: h2
64.225.91.73
64.190.63.136
104.17.24.14
23.36.77.32