s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
302 Found 245 B URL HTTP/1.1 s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 819dda8a3b13d62f47b1c4879368ae9f
b98e36a0747ef292250e75d7d43ec4d59697940a
870769246c0a76875a1bb0128542361d9e42a4ee45b9352d6e1870b846360e7b
GET /server19/dgtzfx/Yakuza_0_TR_Yama.rar.html HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Location: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Content-Length: 245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3d0727e32cd103ddd4b73f28c81758aa
197a7bf43d63723fc532c23c6dced68d5cc36652
d3f75d03561d6a47d19370292e821a86e58381466f0c69386a21175de55882ff
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D3F75D03561D6A47D19370292E821A86E58381466F0C69386A21175DE55882FF"
Last-Modified: Fri, 11 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4438
Expires: Sat, 12 Nov 2022 14:17:18 GMT
Date: Sat, 12 Nov 2022 13:03:20 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash de470c6bab46e7c4b7cc69f392900fe7
189e4dcc4c2b8bf1f050e06bd68bce8a99618918
86f57134ddebd23a25615dc4d59c4b1ca8919e3e0495e1f006cbe7c0f39aa27e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6174
Cache-Control: max-age=169849
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:20 GMT
Etag: "636f75f3-1d7"
Expires: Mon, 14 Nov 2022 12:14:09 GMT
Last-Modified: Sat, 12 Nov 2022 10:31:15 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Length, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 12 Nov 2022 12:44:11 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1149
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a8391107bfc5e4673e8a706f90f63768
5295ed0b1cb8bad4d3e851049acc7f0270937d12
ed5c27510100ffc4481be474ebcb020d147c645beb110604d5284eeeb8b97c02
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "ED5C27510100FFC4481BE474EBCB020D147C645BEB110604D5284EEEB8B97C02"
Last-Modified: Fri, 11 Nov 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3608
Expires: Sat, 12 Nov 2022 14:03:28 GMT
Date: Sat, 12 Nov 2022 13:03:20 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 0Q+862cAD6/nCcHO6YnO3W/Efkypwjn5t8C2GRWnkz0IxnVctrAukrviihut1PslC4+vhdej0oc=
x-amz-request-id: DC42XRGPSH3MZNW9
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 12 Nov 2022 12:12:59 GMT
age: 3021
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
200 OK 5.1 kB URL HTTP/1.1 s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ISO-8859 text
Hash 67a0add8bfa97de78c828272fd204714
c485964f04d29646afd0975525840ed38d49c0c0
8a358cae065abcbc195d1910e7511af244e4f422f54528f822315a86a6fe26c1
GET /server19/dgtzfx/Yakuza_0_TR_Yama.rar.html HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-9
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:20 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
s2.dosya.tc/style/style.css
200 OK 2.0 kB URL HTTP/1.1 s2.dosya.tc/style/style.css
IP
ASN #24940 Hetzner Online GmbH
File type assembler source, ASCII text
Hash ac278d5531b52b2d9cc32edf71749d43
5685f1c07b37853ce04e029c1e6c3b64f5d2baae
9b3f0f81ca9ca1c387b9940500e893aa22e23751225254fd73367736ec7e3389
GET /style/style.css HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Wed, 09 Mar 2022 23:11:06 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2005
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
s2.dosya.tc/style/bootstrap.css
200 OK 21 kB URL HTTP/1.1 s2.dosya.tc/style/bootstrap.css
IP
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (386)
Hash 39ad3e06a3173c16b7880ba0521421cf
11e2c09c3b9aac81b2091b5e5b9b212f7ebf5fac
5b94944555ae7f74b41956b7629c6bd090518ae6b187f4a6341d5805ccb7ca74
GET /style/bootstrap.css HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Fri, 18 Mar 2022 20:22:45 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 21275
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecada59942620975710c6593893e700c
82eb5c603865f238210bb7056e9840acdd9ff5c5
661769f73cd2713ee35badd425e205fb543e960fb50a064f8f00de9c2076b1c5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "661769F73CD2713EE35BADD425E205FB543E960FB50A064F8F00DE9C2076B1C5"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7271
Expires: Sat, 12 Nov 2022 15:04:31 GMT
Date: Sat, 12 Nov 2022 13:03:20 GMT
Connection: keep-alive
s2.dosya.tc/images/footer-icon2.png
200 OK 850 B URL HTTP/1.1 s2.dosya.tc/images/footer-icon2.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 35 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash 51a472b4a51ea9245ee6f4386f07818f
a19e86c411dc6da3592d1f90e89ddf68df1fee3c
eea1befd43d3dc930a0eb0335c56ed8bc7e14aa1ee3e6c546cd21c1826362750
GET /images/footer-icon2.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:38 GMT
Accept-Ranges: bytes
Content-Length: 850
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/footer-icon3.png
200 OK 1.7 kB URL HTTP/1.1 s2.dosya.tc/images/footer-icon3.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 35 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash 3a61d85a6bb0a45429b1e4b7d945aa95
6fcdf44c20d1ed269303583e16a98e245fa7b69b
c84a015988434d7fa0c884f5590de727799abacb9c4a4ad6b4cadea4b97ea732
GET /images/footer-icon3.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:38 GMT
Accept-Ranges: bytes
Content-Length: 1702
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/logo.png
200 OK 7.2 kB URL HTTP/1.1 s2.dosya.tc/images/logo.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 191 x 53, 8-bit/color RGB, non-interlaced\012- data
Hash 2a193802d40b18cd55b0d159571bf63c
1a4e4bdf88317471241d9e5ee29d9572be3f37e3
77eba513db8685e5a4b7633684b1d6b175bf8272ccfff3c6a1c0735d37d1d57a
GET /images/logo.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:40 GMT
Accept-Ranges: bytes
Content-Length: 7157
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/uye-girisi.png
200 OK 3.0 kB URL HTTP/1.1 s2.dosya.tc/images/uye-girisi.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 140 x 51, 8-bit/color RGB, non-interlaced\012- data
Hash 6925e8f5c208aae4dd55cadd1340f180
a03365e7fb59c9588b3b7963e18c0b3e5d4cb369
6bfa03e8b7d8249e9927cafe801657559f7b7064248bb970b55fb4b689611f2d
GET /images/uye-girisi.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:41 GMT
Accept-Ranges: bytes
Content-Length: 2979
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/download-img.png
200 OK 6.8 kB URL HTTP/1.1 s2.dosya.tc/images/download-img.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 313 x 117, 8-bit/color RGB, non-interlaced\012- data
Hash 1edfa391c712325a169fa384adbfbfa7
4ae0807157e873cf80df3a3b0f8b2b67a098b0de
e7cfbf6b7de5e77de00e7376302839e106d3f0ab89637d2af07eb74b86ef4d4f
GET /images/download-img.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:37 GMT
Accept-Ranges: bytes
Content-Length: 6819
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/footer-icon1.png
200 OK 582 B URL HTTP/1.1 s2.dosya.tc/images/footer-icon1.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 35 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash e62d200d08f565563cc9b713729bbaa6
3a130f79117f2aaa91154eb56a22b47de8c06a50
101d88dc759a5588d5c064fe233b6b19c565966a527a03eb9cdc29c733b8d4c3
GET /images/footer-icon1.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:37 GMT
Accept-Ranges: bytes
Content-Length: 582
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/menu-ayrac.png
200 OK 125 B URL HTTP/1.1 s2.dosya.tc/images/menu-ayrac.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 2 x 52, 8-bit/color RGB, non-interlaced\012- data
Hash 35a0591c63feeb75e3e547e894ff6e2d
7dd00c2e8d4e9203b71d3fcb9a660e717b8dca7c
9700fc9abb23b0fa04c070487f5aebdcec2cbb22f10788ab7898032abe3fcced
GET /images/menu-ayrac.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/style/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:41 GMT
Accept-Ranges: bytes
Content-Length: 125
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/images/background.webp
200 OK 113 kB URL HTTP/1.1 s2.dosya.tc/images/background.webp
IP
ASN #24940 Hetzner Online GmbH
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1050, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size 113 kB (112776 bytes)
Hash 2b08bddebb64127b30bc913f73cdab61
f8911fd91f0302e88e7fe6e089ba20af32269b79
0804b26a6993fc6ee8e977f77aa9ce5ddf9c4fe69773b296cc292ee7b2a5ac1b
GET /images/background.webp HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/style/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:35 GMT
Accept-Ranges: bytes
Content-Length: 112776
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/webp
phicmune.net/zone?pub=0&zone_id=5030740&is_mobile=false&domain=s2.dosya.tc&var=&ymid=&var_3=
200 OK 755 B URL HTTP/2 phicmune.net/zone?pub=0&zone_id=5030740&is_mobile=false&domain=s2.dosya.tc&var=&ymid=&var_3=
IP
File type JSON data\012- , ASCII text, with very long lines (754)
Hash ebcb4a7e2c30be02b68f411f05ce64e1
208f114f5364939cad33c8a591c6ab5a64a1faf8
f526a05d05dc7af60bdd98e084d62965885c03dcef024fe290b58dd95432c580
GET /zone?pub=0&zone_id=5030740&is_mobile=false&domain=s2.dosya.tc&var=&ymid=&var_3= HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/
Origin: https://s2.dosya.tc
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:20 GMT
content-type: application/json; charset=utf-8
content-length: 755
x-trace-id: 81b2a5c67eec7517e954fcfe37eb28fd
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
phicmune.net/pfe/current/tag.min.js?z=5030740
200 OK 6.4 kB URL HTTP/2 phicmune.net/pfe/current/tag.min.js?z=5030740
IP
Hash 835fa24ee6d6a68ed36e67c9a5a5a503
b26fee3455193eb2d729198357ba8826bc82fdd4
0bec60127745784d29050cbcfa85457546b89c94724213ac509b5d1ccfc8095c
GET /pfe/current/tag.min.js?z=5030740 HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:20 GMT
content-type: application/javascript
last-modified: Tue, 08 Nov 2022 14:20:39 GMT
etag: W/"636a65b7-39be"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
s2.dosya.tc/apple-touch-icon.png
200 OK 6.6 kB URL HTTP/1.1 s2.dosya.tc/apple-touch-icon.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced\012- data
Hash bfd9b50e03f63b25c253a5d6fa5c5ef4
b4c68746da8a1da96b57d37990bfbfb0f716c14b
ca0f27136956761254299ac92d78aecca2c21841760c56904d894eb13ea0237f
GET /apple-touch-icon.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:16 GMT
Accept-Ranges: bytes
Content-Length: 6556
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/png
s2.dosya.tc/favicon-16x16.png
200 OK 1.6 kB URL HTTP/1.1 s2.dosya.tc/favicon-16x16.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 16 x 16, 8-bit colormap, non-interlaced\012- data
Hash 05c5d89a72c5dc5e863e151cc5fa9b68
df5a0242031f54494fe0bf1b2d7290cd5e864a15
cd6cef0b6624ec979018be137e45b606f36c018b2d64cfe7e3d39815c0936a46
GET /favicon-16x16.png HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:20 GMT
Server: Apache
Last-Modified: Mon, 24 Jan 2022 08:27:20 GMT
Accept-Ranges: bytes
Content-Length: 1594
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e7dc2623cb841be51d3e8857e015d8e1
cbfdb2a7b965598de893fef89d47e17763501acf
df1fc0809a603469e6abcf1f07a13d792550d68c862f80e38c00e47e9b233a5b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 23dd8b12572b78e5d32d491b3d0d9d32
718c3e3abcc55c295c72e5ee4e5441fe5acc1363
f72c359246ea96d4f28bbc5aee8d4d24fcba9f47dfc691693f6c49e370d9b103
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1325)
Hash 47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 12 Nov 2022 12:41:09 GMT
expires: Sat, 12 Nov 2022 14:41:09 GMT
cache-control: public, max-age=7200
age: 1332
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e7dc2623cb841be51d3e8857e015d8e1
cbfdb2a7b965598de893fef89d47e17763501acf
df1fc0809a603469e6abcf1f07a13d792550d68c862f80e38c00e47e9b233a5b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/j/collect?v=1&_v=j98&a=1147340939&t=pageview&_s=1&dl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&ul=en-us&de=windows-1254&dt=Yakuza_0_TR_Yama.rar%20dosyas%C4%B1n%C4%B1%20indir%20-%20download&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=1771533171&gjid=1791537361&cid=1600487285.1668258200&tid=UA-60205436-1&_gid=1314698032.1668258200&_r=1&_slc=1&z=1123796986
200 OK 4 B URL HTTP/2 www.google-analytics.com/j/collect?v=1&_v=j98&a=1147340939&t=pageview&_s=1&dl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&ul=en-us&de=windows-1254&dt=Yakuza_0_TR_Yama.rar%20dosyas%C4%B1n%C4%B1%20indir%20-%20download&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=1771533171&gjid=1791537361&cid=1600487285.1668258200&tid=UA-60205436-1&_gid=1314698032.1668258200&_r=1&_slc=1&z=1123796986
IP
File type ASCII text, with no line terminators
Hash 9e92e190700c1af4539b40c2171320a9
209bcdb79e6067b51091ce8586d4b977f25b67d8
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
POST /j/collect?v=1&_v=j98&a=1147340939&t=pageview&_s=1&dl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&ul=en-us&de=windows-1254&dt=Yakuza_0_TR_Yama.rar%20dosyas%C4%B1n%C4%B1%20indir%20-%20download&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=1771533171&gjid=1791537361&cid=1600487285.1668258200&tid=UA-60205436-1&_gid=1314698032.1668258200&_r=1&_slc=1&z=1123796986 HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://s2.dosya.tc
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://s2.dosya.tc
date: Sat, 12 Nov 2022 13:03:21 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
200 OK 55 kB URL HTTP/2 pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
IP
File type ASCII text, with very long lines (2776)
Hash ea063ff3a4bccdb3920dc52903f1c833
f7c3af68c20d6b482d627b2643bc7bb12f121433
684d2790a40d4f715a6efaddd3fec54689f87993763a049f40ffc45115e8a18e
GET /pagead/js/adsbygoogle.js HTTP/1.1
Host: pagead2.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 12 Nov 2022 13:03:21 GMT
expires: Sat, 12 Nov 2022 13:03:21 GMT
cache-control: private, max-age=3600
content-type: text/javascript; charset=UTF-8
etag: 11590857892603447454
access-control-allow-origin: *
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 55057
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 23dd8b12572b78e5d32d491b3d0d9d32
718c3e3abcc55c295c72e5ee4e5441fe5acc1363
f72c359246ea96d4f28bbc5aee8d4d24fcba9f47dfc691693f6c49e370d9b103
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
phicmune.net/custom
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Phishing
OPTIONS /custom HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://s2.dosya.tc/
Origin: https://s2.dosya.tc
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2
s2.dosya.tc/sw.js
200 OK 2.4 kB IP
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (5235)
Hash 1d6c1729cc0355d80de21444da3b79de
b4f29f327d3fadf1b15383b782470437cc51ba8d
bb27c7c719c8137e74182cf656b46a985ac5ccc2fbc4f7fe93535193f6725b2b
GET /sw.js HTTP/1.1
Host: s2.dosya.tc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/server19/dgtzfx/Yakuza_0_TR_Yama.rar.html
Connection: keep-alive
Cookie: _ga=GA1.2.1600487285.1668258200; _gid=GA1.2.1314698032.1668258200; _gat=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:21 GMT
Server: Apache
Last-Modified: Mon, 18 Apr 2022 10:21:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2381
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript
ocsp.digicert.com/
200 OK 471 B IP
Hash ae51f1958554de4457c22a7d5a9ba8b6
173e90a8c6ee36b7ec569dbea47436a90d7e7c76
dc43a04e1e26243f63a8e628f2ebcb23a9527fd4bc40dc6d1d61879b0f95bb21
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3589
Cache-Control: max-age=162200
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Etag: "636f622c-1d7"
Expires: Mon, 14 Nov 2022 10:06:41 GMT
Last-Modified: Sat, 12 Nov 2022 09:06:52 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471
phicmune.net/custom
200 OK 39 B IP
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Analyzer Verdict Alert fortinet Phishing
POST /custom HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/
Content-Type: application/json
Origin: https://s2.dosya.tc
Content-Length: 400
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 44837ce0bbb67e527642f9cff071edb0
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 62138099a537fcaa3158a30e93d1f6ab
5851ab167d0335d6a14d3f78721f54a685baae6d
bffa19cc7d3d8321658b5ee0df729a2e2b34d6c72b419655a39c098fb101882e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BFFA19CC7D3D8321658B5EE0DF729A2E2B34D6C72B419655A39C098FB101882E"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18033
Expires: Sat, 12 Nov 2022 18:03:54 GMT
Date: Sat, 12 Nov 2022 13:03:21 GMT
Connection: keep-alive
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-60205436-1&cid=1600487285.1668258200&jid=1771533171&gjid=1791537361&_gid=1314698032.1668258200&_u=IEBAAEAAAAAAACAAI~&z=797022735
200 OK 1 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-60205436-1&cid=1600487285.1668258200&jid=1771533171&gjid=1791537361&_gid=1314698032.1668258200&_u=IEBAAEAAAAAAACAAI~&z=797022735
IP
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-60205436-1&cid=1600487285.1668258200&jid=1771533171&gjid=1791537361&_gid=1314698032.1668258200&_u=IEBAAEAAAAAAACAAI~&z=797022735 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://s2.dosya.tc
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://s2.dosya.tc
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 12 Nov 2022 13:03:21 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash 256a23c0d2234937127b8caca4cfffd4
5d86f9d007f079f3883443f2b39eed7424fa3c4b
5a042f557a822317bc8fc32ddee52f85e53ac62a9f3d13e5e5f25db474adf890
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2423
Cache-Control: max-age=158157
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Etag: "636f56f0-116"
Expires: Mon, 14 Nov 2022 08:59:18 GMT
Last-Modified: Sat, 12 Nov 2022 08:18:56 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
200 OK 278 B IP
Hash 256a23c0d2234937127b8caca4cfffd4
5d86f9d007f079f3883443f2b39eed7424fa3c4b
5a042f557a822317bc8fc32ddee52f85e53ac62a9f3d13e5e5f25db474adf890
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2423
Cache-Control: max-age=158157
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Etag: "636f56f0-116"
Expires: Mon, 14 Nov 2022 08:59:18 GMT
Last-Modified: Sat, 12 Nov 2022 08:18:56 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 278
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: M0yLWrX5rVw63HZYNv1IHw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 3nREqTj8BZ/WF/3IO/aT4WtPUSo=
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 7178c97c15d49f214dd4e238628d8123
60c15885ccb9910621dd369fc0578a344bdab734
c668912ace8d705981ac3a28ffef7075f373ef1352b58d6384f44aae1c386baf
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e569acd833d180f3c2fba0919fbeb704
60a3121c9bf8e08a8a7fe70001c24b6f8c9981f5
994bee0670c93479c3e835985d24d7ce41fbc0a3013e173d79ea1ea5f63ac85c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
adservice.google.no/adsid/integrator.js?domain=s2.dosya.tc
200 OK 100 B URL HTTP/2 adservice.google.no/adsid/integrator.js?domain=s2.dosya.tc
IP
File type ASCII text, with no line terminators
Hash 917951a58be8c6c6f3680159550ba3c2
21cd25c2a4eb9ec7e0f37021ce7b69e852dab4b4
cd8c45d9a0d98ca2e23d967483ec538bcafa246afdcf434bf60c8257acfacfac
GET /adsid/integrator.js?domain=s2.dosya.tc HTTP/1.1
Host: adservice.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: private, no-cache, no-store
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 12 Nov 2022 13:03:21 GMT
server: cafe
content-length: 100
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
adservice.google.com/adsid/integrator.js?domain=s2.dosya.tc
200 OK 100 B URL HTTP/2 adservice.google.com/adsid/integrator.js?domain=s2.dosya.tc
IP
File type ASCII text, with no line terminators
Hash 917951a58be8c6c6f3680159550ba3c2
21cd25c2a4eb9ec7e0f37021ce7b69e852dab4b4
cd8c45d9a0d98ca2e23d967483ec538bcafa246afdcf434bf60c8257acfacfac
GET /adsid/integrator.js?domain=s2.dosya.tc HTTP/1.1
Host: adservice.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: private, no-cache, no-store
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 12 Nov 2022 13:03:21 GMT
server: cafe
content-length: 100
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 7178c97c15d49f214dd4e238628d8123
60c15885ccb9910621dd369fc0578a344bdab734
c668912ace8d705981ac3a28ffef7075f373ef1352b58d6384f44aae1c386baf
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e569acd833d180f3c2fba0919fbeb704
60a3121c9bf8e08a8a7fe70001c24b6f8c9981f5
994bee0670c93479c3e835985d24d7ce41fbc0a3013e173d79ea1ea5f63ac85c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.sectigo.com/
200 OK 471 B IP
Hash 21817fa3c60612398404dbe75d383a1a
2d5e08988401c8d0adb24fb26987a0ee26544b4e
12cf02219c8cf9fe9b31f48e19ec88ff888a4ca87a7af1c47eff60a9c5865bfe
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:21 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 18:25:29 GMT
Expires: Thu, 17 Nov 2022 18:25:28 GMT
Etag: "2d5e08988401c8d0adb24fb26987a0ee26544b4e"
Cache-Control: max-age=450726,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 768f779f2d40b4ee-OSL
my.rtmark.net/gid.js?userId=5532131e73e74648a348e4180559a64e
200 OK 65 B URL HTTP/2 my.rtmark.net/gid.js?userId=5532131e73e74648a348e4180559a64e
IP
File type JSON data\012- , ASCII text
Hash 34ecd014d881fdb258c2b9dd64c5878e
c8f3a10d5f9d75d26beb76245409a6515dfc09cb
9dbaf88cc899bd4d592d71e206dd36d1d26698c15e0cf1947ad487c5d102cc80
GET /gid.js?userId=5532131e73e74648a348e4180559a64e HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://s2.dosya.tc
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=5532131e73e74648a348e4180559a64e; expires=Sun, 12 Nov 2023 13:03:21 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash 6ffc8975b423f6c1bb8d3d367a01c350
554e4b343ccf3b3060acf2816467874e4cadd70f
af764593f6b0a3ae942eb2dac304f03526ccdf67e20d9141b3cf6ac768415b38
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 13:03:21 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 11 Nov 2022 13:33:15 GMT
Expires: Fri, 18 Nov 2022 13:33:14 GMT
Etag: "554e4b343ccf3b3060acf2816467874e4cadd70f"
Cache-Control: max-age=519592,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 768f779ff86ab524-OSL
datatechonert.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
200 OK 12 B URL HTTP/1.1 datatechonert.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
Analyzer Verdict Alert quad9 Sinkholed
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f HTTP/1.1
Host: datatechonert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 924
Origin: https://s2.dosya.tc
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Sat, 12 Nov 2022 13:03:21 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://s2.dosya.tc
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c7532175bdda623cb1f7d83c236772d4
71a1540c0d3e9acb10807b74b44228af537c6785
fba2db2a9be13aebe95a85d8c7086b97794e4ebc19781a967c4d157f78c4626a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
partner.googleadservices.com/gampad/cookie.js?domain=s2.dosya.tc&callback=_gfp_s_&client=ca-pub-9775275426073837&gpid_exp=1
200 OK 245 B URL HTTP/2 partner.googleadservices.com/gampad/cookie.js?domain=s2.dosya.tc&callback=_gfp_s_&client=ca-pub-9775275426073837&gpid_exp=1
IP
File type ASCII text, with very long lines (383), with no line terminators
Hash c6d62d517215a80ef371a16426f2f39a
9bb0b48d51ac29048cdaa7f1d32cb31d167583bd
ae6f6ff8702569e1385b2ebf4fe2d3b34e6f2ebc70de2c25c8415f7959537b9e
GET /gampad/cookie.js?domain=s2.dosya.tc&callback=_gfp_s_&client=ca-pub-9775275426073837&gpid_exp=1 HTTP/1.1
Host: partner.googleadservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sat, 12 Nov 2022 13:03:21 GMT
server: cafe
cache-control: private
content-length: 245
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c7532175bdda623cb1f7d83c236772d4
71a1540c0d3e9acb10807b74b44228af537c6785
fba2db2a9be13aebe95a85d8c7086b97794e4ebc19781a967c4d157f78c4626a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e3f9965225cba49c71506d7dee4c1647
d1d30248236cfe679fa182860d69634d30f5b0ca
8a2641a2fa1026f8893b4acf7f7c78c633a1408779f3063c87ad292729300d97
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e3f9965225cba49c71506d7dee4c1647
d1d30248236cfe679fa182860d69634d30f5b0ca
8a2641a2fa1026f8893b4acf7f7c78c633a1408779f3063c87ad292729300d97
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/mysidia/6ab016790426e7d037bac2fbd741d34d.js?tag=client_fast_engine_2019
200 OK 4.2 kB URL HTTP/2 www.gstatic.com/mysidia/6ab016790426e7d037bac2fbd741d34d.js?tag=client_fast_engine_2019
IP
File type ASCII text, with very long lines (2137)
Hash 0b2ba66f23eb1d36fff86d76c08141d5
0c8231b3c842ff1865e79ee32c32540eb00b0b99
7b2d4cd9bfc6953d32723119244c26edb019d2bd3a3e32604d1622e9edf6824a
GET /mysidia/6ab016790426e7d037bac2fbd741d34d.js?tag=client_fast_engine_2019 HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="mysidia"
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-length: 4168
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Nov 2022 20:19:57 GMT
expires: Wed, 08 Feb 2023 20:19:57 GMT
cache-control: public, max-age=7776000
last-modified: Wed, 02 Nov 2022 20:40:29 GMT
content-type: text/javascript
age: 146605
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4b46bbcd35c85c4678b0e3e409bba3bc
bb0705335e28414345ad5fcdd61104cf2fbbbbc4
6c3df7e6d0a8491fe24c03df2ccba059ba2f84155a680a4a22f217d3870cff95
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash f9533c06ce6bd005a0381f22d8032ece
95b9dd46b751726ae3d6250585105e085fbbc7b7
37ea4c706c53921f683204f0ceaa377c1fff606a307a7dd611f085bfb51f0b3d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/mysidia/40f44225e0a1c31e628c89e0882e5f2b.js?tag=text/vanilla_highlight
200 OK 4.3 kB URL HTTP/2 www.gstatic.com/mysidia/40f44225e0a1c31e628c89e0882e5f2b.js?tag=text/vanilla_highlight
IP
File type C++ source, ASCII text, with very long lines (2080)
Hash e9d252bd73d83e3391161b824ea749d8
36e9683986113d645b27d63c01d9472fa1118063
f435cf69bdfe1c33b3545cf1f754926c3a19fc1507cb59e13c027bafd19ef32c
GET /mysidia/40f44225e0a1c31e628c89e0882e5f2b.js?tag=text/vanilla_highlight HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="mysidia"
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-length: 4273
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 11 Nov 2022 22:52:50 GMT
expires: Thu, 09 Feb 2023 22:52:50 GMT
cache-control: public, max-age=7776000
age: 51032
last-modified: Wed, 02 Nov 2022 20:40:29 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
200 OK 48 kB URL HTTP/2 www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
IP
File type ASCII text, with very long lines (3502)
Hash 297e24828abaf97fb29460fd75369140
e9e02d737f1bcf9874a55562edff5f795a1c170c
cdbe4e689ca060e94f00f0aa4c45a89efacddac90df42929ff42a3bff44a9d3e
GET /activeview/js/current/rx_lidar.js?cache=r20110914 HTTP/1.1
Host: www.googletagservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-length: 48265
date: Sat, 12 Nov 2022 13:03:22 GMT
expires: Sat, 12 Nov 2022 13:03:22 GMT
cache-control: private, max-age=3000
etag: "1668095300071091"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/abg_lite_fy2021.js
200 OK 9.4 kB URL HTTP/2 tpc.googlesyndication.com/pagead/js/r20221109/r20110914/abg_lite_fy2021.js
IP
File type ASCII text, with very long lines (1596)
Hash 61a31a8fa19074dd3a2caefe62aaf600
c690e93af674a4665e72f86222b5791b09f83bd0
b95200048fd3773414f89f0c36dfad0811af2ccf77492a981707907e9d4ef2e0
GET /pagead/js/r20221109/r20110914/abg_lite_fy2021.js HTTP/1.1
Host: tpc.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 9405
x-xss-protection: 0
date: Fri, 11 Nov 2022 17:31:42 GMT
expires: Fri, 25 Nov 2022 17:31:42 GMT
cache-control: public, max-age=1209600
age: 70300
etag: 9394538439156335931
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js
200 OK 7.4 kB URL HTTP/2 tpc.googlesyndication.com/pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js
IP
File type ASCII text, with very long lines (2319)
Hash a7dd11b89b54d8c122fb58d0c73c5348
25f332e299f79b2cec29c81951fae20d5644a4f5
a36e41263c4a519cce2521a5b1827064632374db6166017fba75892941993e8d
GET /pagead/js/r20221109/r20110914/client/qs_click_protection_fy2021.js HTTP/1.1
Host: tpc.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 7417
x-xss-protection: 0
date: Fri, 11 Nov 2022 17:24:29 GMT
expires: Fri, 25 Nov 2022 17:24:29 GMT
cache-control: public, max-age=1209600
age: 70733
etag: 18318620284716439044
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e3f9965225cba49c71506d7dee4c1647
d1d30248236cfe679fa182860d69634d30f5b0ca
8a2641a2fa1026f8893b4acf7f7c78c633a1408779f3063c87ad292729300d97
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4b46bbcd35c85c4678b0e3e409bba3bc
bb0705335e28414345ad5fcdd61104cf2fbbbbc4
6c3df7e6d0a8491fe24c03df2ccba059ba2f84155a680a4a22f217d3870cff95
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
200 OK 1.6 kB URL HTTP/2 fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
IP
Hash 4a56110d9397c129f31d543bc1a6033a
15751d0165a391d4b171f6b3cb9be6fd000afc17
e6aaad26f9452d5b80ec97cfd388f90a3b3e6ad7fbacae81358d64d9928495d6
GET /css?family=Google%20Sans%3A400%2C500 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 12 Nov 2022 13:03:22 GMT
date: Sat, 12 Nov 2022 13:03:22 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
200 OK 28 kB URL HTTP/2 fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 28288, version 1.0\012- data
Hash 53b5e785dfdca21fa7adf7119fa1f8cc
a3a86dfd216ad29183ba5493ae39d45b62f9d8b8
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
GET /s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://googleads.g.doubleclick.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 28288
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Nov 2022 15:21:36 GMT
expires: Thu, 09 Nov 2023 15:21:36 GMT
cache-control: public, max-age=31536000
age: 250906
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 86d1ab5f5a5b326dd100a4bfcda8ceed
ed17be3586e93321dd2ab1a340ae41d6f86e293d
db7591e84a7adaa4ff3ddd38458e379bbb15751e31a10937c6202cba94a8c602
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/pagead/drt/ui
302 Found 0 B URL HTTP/2 www.google.com/pagead/drt/ui
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pagead/drt/ui HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 12 Nov 2022 13:03:22 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7942
Expires: Sat, 12 Nov 2022 15:15:44 GMT
Date: Sat, 12 Nov 2022 13:03:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7942
Expires: Sat, 12 Nov 2022 15:15:44 GMT
Date: Sat, 12 Nov 2022 13:03:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7942
Expires: Sat, 12 Nov 2022 15:15:44 GMT
Date: Sat, 12 Nov 2022 13:03:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5823b629e86542b63f4355ec5e67a126
97cbdbbb6b03e6ef7f3f45449245470ad8bd8292
96d8e39efb6eebd1413a4bc0fa6800781f636e70dc0ccadf6a546f26fa022755
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96D8E39EFB6EEBD1413A4BC0FA6800781F636E70DC0CCADF6A546F26FA022755"
Last-Modified: Thu, 10 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7942
Expires: Sat, 12 Nov 2022 15:15:44 GMT
Date: Sat, 12 Nov 2022 13:03:22 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 94a390953f36bf9902cb9f04007c36c1
13535f16f207d4c19c1b6019757f6739a4531eeb
37d73300955a979e5b9d3dabc6e924c4e9734c6c63d92c42c709f8cb0d5aeabb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9f88d70-47ed-4a86-9b90-ea63f189df00.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5902
x-amzn-requestid: 9c8be25c-9c96-4861-89c8-8b7bf06ffc16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdNBrH2DoAMFqbg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec20a-6c770a86581d1f7f4599684f;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:43:38 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: T6_3oJ8lEFeYF3wFDvIVfSRZbILHdbpDuAd50fwkzcYji2yVLUQkmQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:44:57 GMT
age: 55105
etag: "13535f16f207d4c19c1b6019757f6739a4531eeb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
200 OK 8.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 084ca839d34b15916cd2f5034440a1ef
7764777ce9a862c1590712ef33032df72edefffd
b8893d7f327f88316cb909ded7fd8f4e1809190a7da807677785bf953f6e33fb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8482
x-amzn-requestid: 79e5e211-afc8-4531-b361-6f6f3386f16e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUGJsIAMF7Mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-5a0ba4a93eba91c81ba3a9bc;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: uZ6Nth8jaUp7GXRXknKB8k90AgzBj4Yv3YfduSF7yajyFESb9oOh3A==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:51:45 GMT
age: 54697
etag: "7764777ce9a862c1590712ef33032df72edefffd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp
200 OK 9.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 516f1bfefb1c1a737ea2441f85343b32
0cc22d7bf9092fb30f31e2ca8f242c197b891669
733824d4f6f7c5b54ce4e02ecaf152cfc1e10f3f6a801d7e2c55a02460e40087
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d4e929-d0bb-41b7-bdcd-0e67258b428a.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9012
x-amzn-requestid: 83eac9e7-5387-4e11-9769-182fa3f7fffb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdNC6FxzoAMF80w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec212-5ca277b90a5a9a4c437edc1e;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:43:46 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 7wqdiuomEgaQlE1P5gopDGXbAkmh3ohPXYDcBWczuYFEcj8nczk9_w==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:52:57 GMT
age: 54625
etag: "0cc22d7bf9092fb30f31e2ca8f242c197b891669"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash faa8e3cf2ab3c1d53a1735def5bb7476
ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f
e81a8fa312ec478871427f1d04ba7fe563573c683809153f75dec8df979d6efe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6577
x-amzn-requestid: b4587cfb-6041-453c-9e74-fa35ecd31448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMjIGHRoAMF26g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec147-29e7ec741b0e6f6f674aef75;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 2y97S3ITb7MLXuIIAQfCCKjgvOXisdCT5mod7OD588LOhPCy_OrUXQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:02:21 GMT
age: 54061
etag: "ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe5720fc8-63c5-4f5e-bb64-33809e0069fe.jpeg
200 OK 9.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe5720fc8-63c5-4f5e-bb64-33809e0069fe.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f09e254cd6f2e29b3bf198cc5d58a46f
fa34520e849bf746ff43aec3d28beb9e4be44f4d
2e29eace95fd8cb5b6d77df880d2044ecab4206cba47931c3a95e77c1b4e9d9a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe5720fc8-63c5-4f5e-bb64-33809e0069fe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8953
x-amzn-requestid: 2a2d20f4-3aa5-475e-8ec2-fc569766335e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhQGAhIAMFrjw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-26dc0259793ec94814f3d41a;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: BcjpdZlgZPqBX1rk3Th_XlwHrDYoeAT8pWaH7I21WnkfFzvzJE8ekw==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:42:55 GMT
age: 55227
etag: "fa34520e849bf746ff43aec3d28beb9e4be44f4d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 848af62ec10d0c297922f8600b6ad12d
4eadbf5f0dade92dcc6d68c8ebb70898aadb9a7d
a3b4eb6768259876819d7e6c7ac9e21c603d54f60bf70ed077cb820711e2ae74
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7b66f592-618a-4463-834d-ff9bbe8866ae.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11316
x-amzn-requestid: 8456b25a-b87f-490d-86b3-fb217afea082
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bWlniESaIAMF3Qg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636c1c96-30ed3b0972418bae4700edc8;Sampled=0
x-amzn-remapped-date: Wed, 09 Nov 2022 21:33:10 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NeIY2s01XJFjeone0iZ62qWRqoDGoqdFqPsXP2IG6DD9Hub4eqR1pQ==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 5954c6394458ffb44c970b3819d7ff2a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 12 Nov 2022 03:49:13 GMT
age: 33249
etag: "4eadbf5f0dade92dcc6d68c8ebb70898aadb9a7d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 825b44d24d8bc851404dded7ee683a42
2887c729f065c930e405c4d2a39132e4716701c0
09076a8b67da7f3a4fc47d793de28b62433a97dd68d9b1ffb27355c27fad9b14
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl=
200 OK 0 B URL HTTP/2 googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl=
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl= HTTP/1.1
Host: googleads4.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://googleads.g.doubleclick.net/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
access-control-allow-origin: *
content-type: image/gif
x-content-type-options: nosniff
date: Sat, 12 Nov 2022 13:03:22 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 12-Nov-2022 13:18:22 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 12 Nov 2022 13:03:22 GMT
X-Firefox-Spdy: h2
s0.2mdn.net/simgad/9341098113225924566
200 OK 65 kB URL HTTP/2 s0.2mdn.net/simgad/9341098113225924566
IP
File type PNG image data, 728 x 90, 8-bit/color RGBA, non-interlaced\012- data
Hash 475b91f41d618f189d1d1ca9b5035649
4e9079b0797611429d095875836ff77bcfd48379
4bdabd3950096493c4db2dcf1be56bcef42039a463dcceef8cc4d5e138563ea5
GET /simgad/9341098113225924566 HTTP/1.1
Host: s0.2mdn.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://googleads.g.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 65242
x-content-type-options: nosniff
x-dns-prefetch-control: off
server: sffe
x-xss-protection: 0
date: Thu, 10 Nov 2022 21:38:30 GMT
expires: Fri, 10 Nov 2023 21:38:30 GMT
cache-control: public, max-age=31536000
age: 141892
last-modified: Tue, 26 Jul 2022 23:23:28 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 825b44d24d8bc851404dded7ee683a42
2887c729f065c930e405c4d2a39132e4716701c0
09076a8b67da7f3a4fc47d793de28b62433a97dd68d9b1ffb27355c27fad9b14
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 13:03:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=454&vt=11&dtpt=452&dett=2&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl=
200 OK 0 B URL HTTP/2 googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=454&vt=11&dtpt=452&dett=2&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl=
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pcs/view?xai=AKAOjsvc0FBvQQzxwT_RL8e1NqUpeZNQJ4X43WMu9ovEiaihz6l8Wckunqw2JSSXcLxK3Xq00pdrgFGXIxsM-Ka82qMePDnbGPGmdv5wtZt3WGIQ7bUlGtk_Dm7I0h0gF77jK-brtP9_bWYbYJtQmJq2rSozzySsH2kZtGm9K5KCn_yF69qJLFvOpIpDYnbT7oXSzjGDfEHm3EyVKCFwyqR1R7PrpqTDdwOhITFqgR8sQiW4liqmXRGmV1cy3vRK3oeyK5Xahzbuq8ewtUXqaj5-LC80BjGbjxQsbeYAg2EulDnpIFu33RsHMS24MFijz08f8NvErq0m_qMalich45f5aPfVD-iQnzQ-U8eLoRVmU5v6GUDF1wdUtyXQ9xWVdC2w6PhN4UJ0tw95WH-W-cgo0jijLLYsL7hvrhP5eHCGwi2iFRb0tvj4Qvbqm4RS5UQncvApwYKAqIo4MEcIackvYZZleA76PoMUyDnQ_5JZ4H6vVTxCzuAywGUXpG4HdZA_iKTbX6Yo4RwzdQfEVQ0krxo-03hzxB0sehLgQgQhq5kSzv53MyH8OWyRYKR3sBdb-_mVLZlEGUHphKB6fGUH2T8Vqk_ei2-sqbHUGb_0J2zh4cg2lX2D5kRUQnzQXqi0WF3tDLAOdLRVoKQeIlaTSeBB4kNL0qmpHAqOr1gDpQOQXrgGe93jrJy8LpUG-gYOkTrRw7D08wD_azy0PMzkyyXDpf45VKedzy6pBQEsveb0GEPRpF-IkxrcVKGCmKY5Xt8O480-L2bYYubMtRvyeWgzXrhTawj10Z9eHdTo6OTjtmEeImDe7ASa-z7qi3w2VrJcrHj-Gkx5nRp6KTqpaqzXRSSU39mqsw43_FWyQJW-pKqIgujFn5hEXWhdO6HUe4bx4btsLKXHMrHvVce0HB7d5AKRiQpxTGjQtaCP_nCYWIL6IuIG5eHkAEVrIs4gw5fT8yu2T6ImqFLNAcxZ6i8sOsMqVAHB8wr2AHRD1nhCCTc1fuwunICTv8L2kCi_2pv2pYgaw_QV1zalbcsQl8jwWRIfYkkEtR0eP2rCcgw905MMXeXlnR2ekgcX5JRMRCjh-yv8nSWvWZLj9OGP6b1bi74n5hEhJwCd9cYYNgGEnzsPAW5xg2QAwZA4fwblfMMRW6qwsAATlIPpsUxOmibl2xeLb855aUZWRDQnheNdoczJwXf2sukjkszXSnob&sai=AMfl-YQEBFUo11Xgugx8enD8OTzbLTwNC1fVNZWndp8f3eTsdUL2eFzwbZxZfBpjssjtMCr99UzWpFasDliozkbXP-poX1pijE-RssyV_zChqNgpUtVmSZr83tMnbzTipM1CtqmSze3YykTGetoua48TeGsAPikP2kkTIJB33SDBCWZKd9AUxdAuPPrrCEigQo4nlsmvAgmnNjaqmpAgzErJ4LQiL7KIyXKesWHqlQinkX96bwWUY00_gw&sig=Cg0ArKJSzPe2dEEyb9baEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=454&vt=11&dtpt=452&dett=2&cstd=0&cisv=r20221109.75779&arae=0&ftch=1&adurl= HTTP/1.1
Host: googleads4.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://googleads.g.doubleclick.net/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cache-control: private
access-control-allow-origin: *
content-type: image/gif
x-content-type-options: nosniff
date: Sat, 12 Nov 2022 13:03:22 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 12-Nov-2022 13:18:22 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 12 Nov 2022 13:03:22 GMT
X-Firefox-Spdy: h2
phicmune.net/custom
200 OK 39 B IP
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Analyzer Verdict Alert fortinet Phishing
POST /custom HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/
Content-Type: application/json
Origin: https://s2.dosya.tc
Content-Length: 761
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:22 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: d94b5c7d44f3e7a923d5b4c79db57eeb
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
phicmune.net/pfe/current/universal.min.js?v=3.1.403
200 OK 0 B URL HTTP/2 phicmune.net/pfe/current/universal.min.js?v=3.1.403
IP
GET /pfe/current/universal.min.js?v=3.1.403 HTTP/1.1
Host: phicmune.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/
Origin: https://s2.dosya.tc
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:20 GMT
content-type: application/javascript
last-modified: Tue, 08 Nov 2022 14:20:39 GMT
etag: W/"636a65b7-180b9"
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
cdn.itskiddien.club/apu.php?zoneid=5426561
200 OK 0 B URL HTTP/2 cdn.itskiddien.club/apu.php?zoneid=5426561
IP
GET /apu.php?zoneid=5426561 HTTP/1.1
Host: cdn.itskiddien.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: application/javascript
x-trace-id: 72f43fdda533b14aa611391225b6aa65
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=5532131e73e74648a348e4180559a64e; expires=Sun, 12 Nov 2023 13:03:21 GMT; path=/; secure; SameSite=None
oaidts=1668258201; expires=Sun, 12 Nov 2023 13:03:21 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
tzegilo.com/stattag.js
200 OK 0 B IP
GET /stattag.js HTTP/1.1
Host: tzegilo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://s2.dosya.tc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: application/javascript
last-modified: Tue, 18 Oct 2022 14:05:58 GMT
etag: W/"634eb2c6-32d9"
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin
cache-control: max-age=14400
cf-cache-status: HIT
age: 5916
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjZsc7jTtJVAVxXe1f5w6mowSt1VfdevURdBpBuLKQ3RFFEBb5dDcZ7LG7pS23YWU%2BPddpiwcc8sy4l2M8Cx%2FzDNQWdejFAavUhLFEXjSMFREQUBVzR8c8gVG7xUVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 768f779edf7cb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.itskiddien.club/?rb=fFlxY0N1j238mbhas1KmI-uTg23w9Zc895T6kVA17mjTSOn94Yg7nTdXVfp5vfTMGOXVuGHMRU4pCzw1eCO9lwcwgX5vDPu1ArCbo0SM_kI2IDHPV9aT6B8RUa8J8gFuNhYYykAvVsYGudS3WRfYrwF01gt_0Nz4cwWyRXprar1bLUBZjPPeraoYf8OnpzT2J6nNoyynprpMETdvrcql3eRGPFgwZnwIS7Q4lQ%3D%3D&request_ab2=0&zoneid=5426561&js_build=iclick-v1.448.2&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=939&wiw=1280&wfc=1&pl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.448.2&bs=6d308b13-cbf7-4009-96cb-a13611864a80&userId=5532131e73e74648a348e4180559a64e&m=link
200 OK 0 B URL HTTP/2 cdn.itskiddien.club/?rb=fFlxY0N1j238mbhas1KmI-uTg23w9Zc895T6kVA17mjTSOn94Yg7nTdXVfp5vfTMGOXVuGHMRU4pCzw1eCO9lwcwgX5vDPu1ArCbo0SM_kI2IDHPV9aT6B8RUa8J8gFuNhYYykAvVsYGudS3WRfYrwF01gt_0Nz4cwWyRXprar1bLUBZjPPeraoYf8OnpzT2J6nNoyynprpMETdvrcql3eRGPFgwZnwIS7Q4lQ%3D%3D&request_ab2=0&zoneid=5426561&js_build=iclick-v1.448.2&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=939&wiw=1280&wfc=1&pl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.448.2&bs=6d308b13-cbf7-4009-96cb-a13611864a80&userId=5532131e73e74648a348e4180559a64e&m=link
IP
GET /?rb=fFlxY0N1j238mbhas1KmI-uTg23w9Zc895T6kVA17mjTSOn94Yg7nTdXVfp5vfTMGOXVuGHMRU4pCzw1eCO9lwcwgX5vDPu1ArCbo0SM_kI2IDHPV9aT6B8RUa8J8gFuNhYYykAvVsYGudS3WRfYrwF01gt_0Nz4cwWyRXprar1bLUBZjPPeraoYf8OnpzT2J6nNoyynprpMETdvrcql3eRGPFgwZnwIS7Q4lQ%3D%3D&request_ab2=0&zoneid=5426561&js_build=iclick-v1.448.2&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wih=939&wiw=1280&wfc=1&pl=https%3A%2F%2Fs2.dosya.tc%2Fserver19%2Fdgtzfx%2FYakuza_0_TR_Yama.rar.html&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.448.2&bs=6d308b13-cbf7-4009-96cb-a13611864a80&userId=5532131e73e74648a348e4180559a64e&m=link HTTP/1.1
Host: cdn.itskiddien.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s2.dosya.tc/
Origin: https://s2.dosya.tc
Connection: keep-alive
Cookie: OAID=5532131e73e74648a348e4180559a64e; oaidts=1668258201
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 13:03:21 GMT
content-type: application/json
x-trace-id: 6bd2bcf52a44d10453a50423efb65046
access-control-allow-origin: https://s2.dosya.tc
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=5532131e73e74648a348e4180559a64e; expires=Sun, 12 Nov 2023 13:03:21 GMT; path=/; secure; SameSite=None
oaidts=1668258201; expires=Sun, 12 Nov 2023 13:03:21 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Sat, 19 Nov 2022 13:03:21 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
168.119.136.27
142.250.74.66
139.45.197.251
23.36.76.226
104.21.84.149