Overview

URL medvitro.info/kodeksolhleb_newtrack/?subid=wbo5okuh093s3s2jik7sd00c&subid1=132117&subid2=&subid3=10-24822&utm_source=ads2.bid&utm_term=111135&thank_you_page=thank_you_page&lf_utm_source=ads2.bid&cep=_Ofxh-PQAujebK2fCWGQZMfuj_8LJlLVkU3B9xOJCRlCX215mn8VRPA114qaoOsx3pymJw_ooTJaANGzFZYMcrNfrDKTQDkGWVpBSPFUdgqey8wpAq0i-wSqvKAEd7ns9QyEo9EbKdMdGbcQ_9fGpQGpnX9jM-A1WdwB5Z03Nhz9U4S1-zf9RcH8uo0Ldxi32lcm2bZMgcRBq3FreuatRchpnsEVUaPxX6okIhnAtn7vSV9TXwskygQc7HGSWJI8it4e6Qt00iK_U4qgzZAohIf0xbzhKU613r6Sr1dl1SN2POvEv590xPOo_SSf4ZsjkI997bCC9oidX_n1ZFus3HXhGW-MEuS22o1W90QYXw3jRmaMk61BXusr8JZd4lpizBCoKRax3EztBRwarpadH5-E9qmND_62KWfksAkygidsjKrppxpsAAQsw8M3nQ7l1PBqVQ6bpYQk123KAk4NpYyflSgY_S7Anr1oOIKuNvDixRori0DrQxX1EDi6bmzn&lptoken=1679631230c9595c000b&stream_uuid=22a8a68e-054a-4b78-bdb6-1e407ff81f61&utm_content=132117&utm_medium=10-24822&t_id=8
IP172.67.160.178
ASNCLOUDFLARENET
Location United States
Report completed2022-09-16 04:55:31 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-16 2 static.bestfeedcpm.com/rpe1h8/qh8vil876/2qtq8hh81pm0uvq0y3yh.js Malware
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

No files detected



Passive DNS (12)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS medvitro.info (2) 117897 2021-04-14 13:13:45 UTC 2022-06-20 03:33:03 UTC 104.21.41.55
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-27 20:08:30 UTC 2022-09-16 00:14:15 UTC 143.204.55.36
mnemonic passive DNS cdnjs.cloudflare.com (1) 235 2020-10-20 10:17:36 UTC 2022-09-16 04:31:46 UTC 104.17.25.14
mnemonic passive DNS ocsp.sectigo.com (1) 487 2018-12-17 11:31:55 UTC 2022-09-16 04:29:10 UTC 172.64.155.188
mnemonic passive DNS click.lucky.online (2) 580125 2018-12-14 03:12:33 UTC 2022-09-15 23:30:32 UTC 185.203.72.63
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-09-15 04:47:36 UTC 34.120.237.76
mnemonic passive DNS r3.o.lencr.org (4) 344 2020-12-02 08:52:13 UTC 2022-09-15 04:51:36 UTC 23.36.76.226
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-15 05:55:39 UTC 143.204.55.49
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-15 04:50:53 UTC 34.117.237.239
mnemonic passive DNS static.bestfeedcpm.com (3) 886049 2021-03-08 11:11:12 UTC 2022-09-14 23:31:51 UTC 172.67.177.120
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-09-15 23:57:23 UTC 93.184.220.29
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-15 05:55:58 UTC 35.162.35.244


Recent reports on same IP/ASN/Domain/Screenshot

Last 3 reports on IP: 172.67.160.178

Date UQ / IDS / BL URL IP
2022-09-16 04:55:31 +0000
0 - 0 - 1 medvitro.info/kodeksolhleb_newtrack/?subid=wb (...) 172.67.160.178
2022-09-04 04:00:08 +0000
0 - 0 - 3 ronda-est.com/ 172.67.160.178
2022-09-02 23:33:05 +0000
0 - 0 - 2 ronda-est.com/ 172.67.160.178

Last 5 reports on ASN: CLOUDFLARENET

Date UQ / IDS / BL URL IP
2022-11-30 04:47:17 +0000
0 - 0 - 1 inrisogicom.cf/ 104.21.89.221
2022-11-30 04:47:12 +0000
0 - 0 - 1 ovglenat.cf/ 104.21.83.51
2022-11-30 04:46:59 +0000
0 - 0 - 4 skype-chat.cc/ 104.21.67.25
2022-11-30 04:46:45 +0000
0 - 0 - 2 autumn-block-50de.caitlyn70.workers.dev/ 172.67.176.50
2022-11-30 04:46:08 +0000
0 - 0 - 1 y75icq.cyou/ 172.67.221.161

Last 1 reports on domain: medvitro.info

Date UQ / IDS / BL URL IP
2022-09-16 04:55:31 +0000
0 - 0 - 1 medvitro.info/kodeksolhleb_newtrack/?subid=wb (...) 172.67.160.178

No other reports with similar screenshot



JavaScript

Executed Scripts (15)


Executed Evals (0)


Executed Writes (2)

#1 JavaScript::Write (size: 18, repeated: 1) - SHA256: a7bbbc84b291951104eb5814d68ad803fd48af5d4da7fdb47ea136591cd097a6

                                        A5 = BO1@ L 8 > : BO1@ L
                                    

#2 JavaScript::Write (size: 4, repeated: 1) - SHA256: b1ab1e892617f210425f658cf1d361b5489028c8771b56d845fe1c62c1fbc8b0

                                        2022
                                    


HTTP Transactions (25)


Request Response
                                        
                                            GET /kodeksolhleb_newtrack/?subid=wbo5okuh093s3s2jik7sd00c&subid1=132117&subid2=&subid3=10-24822&utm_source=ads2.bid&utm_term=111135&thank_you_page=thank_you_page&lf_utm_source=ads2.bid&cep=_Ofxh-PQAujebK2fCWGQZMfuj_8LJlLVkU3B9xOJCRlCX215mn8VRPA114qaoOsx3pymJw_ooTJaANGzFZYMcrNfrDKTQDkGWVpBSPFUdgqey8wpAq0i-wSqvKAEd7ns9QyEo9EbKdMdGbcQ_9fGpQGpnX9jM-A1WdwB5Z03Nhz9U4S1-zf9RcH8uo0Ldxi32lcm2bZMgcRBq3FreuatRchpnsEVUaPxX6okIhnAtn7vSV9TXwskygQc7HGSWJI8it4e6Qt00iK_U4qgzZAohIf0xbzhKU613r6Sr1dl1SN2POvEv590xPOo_SSf4ZsjkI997bCC9oidX_n1ZFus3HXhGW-MEuS22o1W90QYXw3jRmaMk61BXusr8JZd4lpizBCoKRax3EztBRwarpadH5-E9qmND_62KWfksAkygidsjKrppxpsAAQsw8M3nQ7l1PBqVQ6bpYQk123KAk4NpYyflSgY_S7Anr1oOIKuNvDixRori0DrQxX1EDi6bmzn&lptoken=1679631230c9595c000b&stream_uuid=22a8a68e-054a-4b78-bdb6-1e407ff81f61&utm_content=132117&utm_medium=10-24822&t_id=8 HTTP/1.1 
Host: medvitro.info
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         104.21.41.55
HTTP/1.1 301 Moved Permanently
                                        
Date: Fri, 16 Sep 2022 04:55:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Fri, 16 Sep 2022 05:55:20 GMT
Location: https://medvitro.info/kodeksolhleb_newtrack/?subid=wbo5okuh093s3s2jik7sd00c&subid1=132117&subid2=&subid3=10-24822&utm_source=ads2.bid&utm_term=111135&thank_you_page=thank_you_page&lf_utm_source=ads2.bid&cep=_Ofxh-PQAujebK2fCWGQZMfuj_8LJlLVkU3B9xOJCRlCX215mn8VRPA114qaoOsx3pymJw_ooTJaANGzFZYMcrNfrDKTQDkGWVpBSPFUdgqey8wpAq0i-wSqvKAEd7ns9QyEo9EbKdMdGbcQ_9fGpQGpnX9jM-A1WdwB5Z03Nhz9U4S1-zf9RcH8uo0Ldxi32lcm2bZMgcRBq3FreuatRchpnsEVUaPxX6okIhnAtn7vSV9TXwskygQc7HGSWJI8it4e6Qt00iK_U4qgzZAohIf0xbzhKU613r6Sr1dl1SN2POvEv590xPOo_SSf4ZsjkI997bCC9oidX_n1ZFus3HXhGW-MEuS22o1W90QYXw3jRmaMk61BXusr8JZd4lpizBCoKRax3EztBRwarpadH5-E9qmND_62KWfksAkygidsjKrppxpsAAQsw8M3nQ7l1PBqVQ6bpYQk123KAk4NpYyflSgY_S7Anr1oOIKuNvDixRori0DrQxX1EDi6bmzn&lptoken=1679631230c9595c000b&stream_uuid=22a8a68e-054a-4b78-bdb6-1e407ff81f61&utm_content=132117&utm_medium=10-24822&t_id=8
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yVq5TLkrMUqFzXo2jsFnrWSlg3QLqnK5PH2MK2PpAP8ANPmMTTRtfXRaX1bS1RD5pWnxSAT2I%2F6g7NvxViFMFnfWJW29MkKpAnSivUAiFruAmRg0gJy2BXQCgr0dkmay"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74b7025fcc09b523-OSL
alt-svc: h2=":443"; ma=60

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Content-Length, Backoff, Retry-After, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 16 Sep 2022 04:10:45 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 057fdebf738f5915bf38a78949190758.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: YVBzrRlXv-dWnI2W5JuGt5tl0G6l59fL3JhxULYGChoRCkyiCXz6eQ==
Age: 2675


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    99b7d23c1748d0526782b9ff9ea45f09
Sha1:   eadd801a3ba2aa00632c6fb52e1f9125bd6d5b4f
Sha256: 48f81668f76955320480b484138aebdad5d03c471036b4449c737aca1ecab08e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "FEF9CE9F75EC19E7AE2CCBFFB6654DB2473A2B4ACC94C1B4303E5EC24149465F"
Last-Modified: Thu, 15 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13274
Expires: Fri, 16 Sep 2022 08:36:34 GMT
Date: Fri, 16 Sep 2022 04:55:20 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.49
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 20 Aug 2022 23:18:05 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 16 Sep 2022 04:35:16 GMT
etag: "742edb4038f38bc533514982f3d2e861"
x-cache: Hit from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: dODDGe3K3iSKjLMLZFDq0kzOR7gQriusr1VdPAavRrGIjD2WWWQrmA==
age: 1205
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    742edb4038f38bc533514982f3d2e861
Sha1:   cc3a20c8dc2a8c632ef9387a2744253f1e3fdef1
Sha256: b6bfa49d3d135035701231db2fffc0c0643444394009a94c6a1b4d829d6b8345
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 16 Sep 2022 04:55:20 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 16 Sep 2022 04:55:20 GMT
content-length: 26909
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-14e4a"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 2018644
expires: Wed, 06 Sep 2023 04:55:20 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KiIVXKboHGRD7uvI0kHSM7D55h9iOEhG9voyNVN7ryY0RJgYer5cwDu9DOrbJNchlo%2B23AUD3wQXkxIP1bPKueBibVTO%2B2DovSmcPcqkwWmrIYj4PACwxrO8xQBNJktKGm5RIHGp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 74b70262a96cb515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (32065)
Size:   26909
Md5:    63827323c175768ccb0e8ed54589a3e5
Sha1:   9760e238d6ecced66396798559f70593793d801e
Sha256: 196f9479a27db836a2a7454e222f0cb52d4eeb162e0a50e69401ba1a8d81b564
                                        
                                            GET /qc98qh7bj1iuo0pypk/t2qtq2/tq2/pm0t2quel27r.js HTTP/1.1 
Host: static.bestfeedcpm.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         172.67.177.120
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 16 Sep 2022 04:55:20 GMT
content-length: 0
cf-bgj: minify
etag: "62f60e8f-0"
last-modified: Fri, 12 Aug 2022 08:25:51 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 1980
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jA51s9B0tiTNM93IAt3%2FKRDHZbR8c7JqOyHuIDywSyJfxr31a4nDJeL4JVRIE%2B6AfI%2BulSlUKF7%2FQnwziUilNIes1xVuNjHlLhDR%2BMFnYaEjvAJnkz5NeT%2FHM8r3xEOzcoSCCj6wQYct"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74b70262de6ab523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Fri, 16 Sep 2022 04:03:22 GMT
Cache-Control: max-age=3600
Expires: Fri, 16 Sep 2022 04:14:12 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 b9f0050ca4d212d7c855e005be54b1ac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: loOta4el93kicECyvztq0bZZLtab0XgGMpJ1Kl6Y3utg9USDYnx82A==
Age: 3119


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         172.64.155.188
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 16 Sep 2022 04:55:21 GMT
Content-Length: 472
Connection: keep-alive
Last-Modified: Tue, 13 Sep 2022 09:34:13 GMT
Expires: Tue, 20 Sep 2022 09:34:12 GMT
Etag: "c6a52960705b810de300b8f8257753638f2fa90a"
Cache-Control: max-age=361730,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 74b702654aa90b49-OSL

                                        
                                            GET /click/ip-location.html HTTP/1.1 
Host: click.lucky.online
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://medvitro.info
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         185.203.72.63
HTTP/1.1 200 OK
Content-Type: application/vnd.api+json; charset=UTF-8
                                        
Server: nginx
Date: Fri, 16 Sep 2022 04:55:21 GMT
Transfer-Encoding: chunked
Access-Control-Allow-Origin: *
X-VARITI-CCR: 6585140448:40
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Set-Cookie: rerf=AAAAAGMkAbmLRjw7A97/Ag==; expires=Sun, 16-Oct-22 04:55:21 GMT; path=/ ipp_uid=1663304121421/hP4KIhvVDPrSWk3n/olhlGbisMjkbZBDIujPUng==; Expires=Tue, 31 Dec 2030 23:59:59 GMT; Path=/
Connection: keep-alive
Keep-Alive: timeout=60


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with no line terminators
Size:   80
Md5:    bedc094f62f1b09a6d437aaf811a9320
Sha1:   5d76550369b0e0fdec52709037c847ccf31285d1
Sha256: 62496c36689b0a0b3582c298b3cd0fb425b286203e04b1063851dbeaace3c5a9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6500
Cache-Control: 'max-age=158059'
Date: Fri, 16 Sep 2022 04:55:21 GMT
Last-Modified: Fri, 16 Sep 2022 03:07:01 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /click/ip-location.html HTTP/1.1 
Host: click.lucky.online
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://medvitro.info
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         185.203.72.63
HTTP/1.1 200 OK
Content-Type: application/vnd.api+json; charset=UTF-8
                                        
Server: nginx
Date: Fri, 16 Sep 2022 04:55:21 GMT
Transfer-Encoding: chunked
Access-Control-Allow-Origin: *
X-VARITI-CCR: 6585137368:98
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Set-Cookie: rerf=AAAAAGMkAbl97zwbA00MAg==; expires=Sun, 16-Oct-22 04:55:21 GMT; path=/ ipp_uid=1663304121528/lGOjIjkucJIWKivx/fU/3rspppH5qdKcX+XcjvQ==; Expires=Tue, 31 Dec 2030 23:59:59 GMT; Path=/
Connection: keep-alive
Keep-Alive: timeout=60


--- Additional Info ---
Magic:  JSON data\012- , Unicode text, UTF-8 text, with no line terminators
Size:   80
Md5:    bedc094f62f1b09a6d437aaf811a9320
Sha1:   5d76550369b0e0fdec52709037c847ccf31285d1
Sha256: 62496c36689b0a0b3582c298b3cd0fb425b286203e04b1063851dbeaace3c5a9
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: CJ27SlSD0vqIpPLXTlB4cA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.162.35.244
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: KfbqDMZbAYIhXMUXVjlq2s+vaUg=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "63C277B85854C244E38F5B3E60A073EB15962A0784BA1B726353E3EC0C3E9E02"
Last-Modified: Thu, 15 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16604
Expires: Fri, 16 Sep 2022 09:32:06 GMT
Date: Fri, 16 Sep 2022 04:55:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "63C277B85854C244E38F5B3E60A073EB15962A0784BA1B726353E3EC0C3E9E02"
Last-Modified: Thu, 15 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16604
Expires: Fri, 16 Sep 2022 09:32:06 GMT
Date: Fri, 16 Sep 2022 04:55:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "63C277B85854C244E38F5B3E60A073EB15962A0784BA1B726353E3EC0C3E9E02"
Last-Modified: Thu, 15 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16604
Expires: Fri, 16 Sep 2022 09:32:06 GMT
Date: Fri, 16 Sep 2022 04:55:22 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a73e855-9877-4793-b59a-30b8e5a96117.png HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8435
x-amzn-requestid: f6efd924-4f54-41a6-8771-087803b5b8ac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YhU0-EJaoAMFvtQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63239b52-37c21ee857fe27d104b70337;Sampled=0
x-amzn-remapped-date: Thu, 15 Sep 2022 21:38:26 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: rgjwYJ-ZzVF3bv7pl1l8TN8EAoENIcaSAXJU_YhFOSNRCzrCuPuKbQ==
via: 1.1 773ca14e6bd4bf9244988cb69fc9dca8.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 21:44:10 GMT
age: 25872
etag: "b6e634ef27eba9da38c6472565e0fdca6898e4f0"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8435
Md5:    b7d4ee58e0f26ec6817dbab72aa7db6d
Sha1:   b6e634ef27eba9da38c6472565e0fdca6898e4f0
Sha256: 07db05a6ee70a699164ad55da47bfca58e6639956e256d902cbe0388cd7995c6
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc7e55a42-9f36-46db-9415-ab10753c0fb8.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10163
x-amzn-requestid: 7c849e5d-468e-4f6a-ad44-c7995bfa81bb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YYvuGFU5oAMF_Og=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63202cc0-5376d2432c79a3146b6c29f4;Sampled=0
x-amzn-remapped-date: Tue, 13 Sep 2022 07:09:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: XGVoNQZeoG0AQ6LabPW2Zg7pAQqdl-bGTFAhbNpLlgTWNWx55-wEUQ==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 21:45:14 GMT
age: 25808
etag: "10262867cfb19d3ba8f618e235d1a98531048f34"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10163
Md5:    3a4ed510756efe784c4ca84c61c4b5ba
Sha1:   10262867cfb19d3ba8f618e235d1a98531048f34
Sha256: b5ba0de5ce381579e49e3e3c23244048fc8aac693ce0c977560f28b9a51f6a0b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ac817a0-279c-44ad-92b0-a799997b91ed.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8843
x-amzn-requestid: 055dc4af-96bb-48af-823a-56e606701c01
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YhVAlFseoAMFurw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63239b9d-67ba7aaf2b588234573e1c9c;Sampled=0
x-amzn-remapped-date: Thu, 15 Sep 2022 21:39:41 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: WkdIyxNFlhmlhe5c3iNkCNWQmRrMrfKqD4pYMe5J7iYzUgo0XorwAg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 21:53:59 GMT
age: 25283
etag: "2029669d941625cb78a23b52cd6511af111c8591"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8843
Md5:    918f9961aa6acc47b01feb731750d208
Sha1:   2029669d941625cb78a23b52cd6511af111c8591
Sha256: 1f8cfc977ecea3b3dba2992fd4e310f8d426be1316c467f516e5ed2332ecaf96
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdbd68450-8c97-4e9a-a798-8484ec30f381.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8854
x-amzn-requestid: ae78dca7-cd78-40ad-8ef3-5b287d99b0e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YO1suGFuoAMFptg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631c3651-12f3fedb07f856af06e8b1e5;Sampled=0
x-amzn-remapped-date: Sat, 10 Sep 2022 07:01:37 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: h1Q93ahPFyzjb40UxQcoDZPKkpLtrkcj1vE_mB4AW2Gn9CAibFnd6A==
via: 1.1 1f6e68152880a39d72e6bf2996cd6a60.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 22:03:47 GMT
age: 24695
etag: "28bf10400e47ad48eee5db04829b88340e021840"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8854
Md5:    e4f3e6b013d785036c9b9c16aef3404f
Sha1:   28bf10400e47ad48eee5db04829b88340e021840
Sha256: 98596627e914528b177b8a3d2be8766bdf210c62415961ab99afefa465440819
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0053b897-d5d2-4791-96ec-ae4e53604954.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11012
x-amzn-requestid: 66cb9bab-3baf-48ef-91ad-42dcd10d0c76
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YbfSkF3CIAMFz8Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632145a9-0e7a611671d4fa54167eab0e;Sampled=0
x-amzn-remapped-date: Wed, 14 Sep 2022 03:08:25 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: v9DQj5GkWLvZgOjCUozeMGFnX7cuQg2_SCVewZCoFYqk7TcBpg_3Bg==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 20:24:22 GMT
age: 30660
etag: "81decab499a04586b7da56e5aa967733aa32af0b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11012
Md5:    18cc65a8655bbf7eb093d77f55bf01bf
Sha1:   81decab499a04586b7da56e5aa967733aa32af0b
Sha256: e5204f0bb2c0e02dd6758ac46a01cb36a66d0b80a3c75ef9c8bb2edf26817139
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8e3eca0d-da18-4b3c-8625-afa9f187d0e3.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4955
x-amzn-requestid: e7c21397-14e0-42fd-86f3-3f1e6940da8a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YhU0zG1uIAMF_mA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63239b51-386abef75b6435a0656e86cd;Sampled=0
x-amzn-remapped-date: Thu, 15 Sep 2022 21:38:25 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: w0izptVhe4GTDP0l4M18uTvK6vQeKiiaGSZ5UfZATWGIyjL5C8sURQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Sep 2022 21:55:30 GMT
etag: "2b8a6de0faac5c1a99b48c28da9c05f520ef6add"
age: 25192
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4955
Md5:    8bedb04287b8f09d30fed0ae386b9bcc
Sha1:   2b8a6de0faac5c1a99b48c28da9c05f520ef6add
Sha256: cec3955f3330184ace4388b7c00262b52c9ca43e9ece6fb8f2fdec2ee9e53a9e
                                        
                                            GET /kodeksolhleb_newtrack/?subid=wbo5okuh093s3s2jik7sd00c&subid1=132117&subid2=&subid3=10-24822&utm_source=ads2.bid&utm_term=111135&thank_you_page=thank_you_page&lf_utm_source=ads2.bid&cep=_Ofxh-PQAujebK2fCWGQZMfuj_8LJlLVkU3B9xOJCRlCX215mn8VRPA114qaoOsx3pymJw_ooTJaANGzFZYMcrNfrDKTQDkGWVpBSPFUdgqey8wpAq0i-wSqvKAEd7ns9QyEo9EbKdMdGbcQ_9fGpQGpnX9jM-A1WdwB5Z03Nhz9U4S1-zf9RcH8uo0Ldxi32lcm2bZMgcRBq3FreuatRchpnsEVUaPxX6okIhnAtn7vSV9TXwskygQc7HGSWJI8it4e6Qt00iK_U4qgzZAohIf0xbzhKU613r6Sr1dl1SN2POvEv590xPOo_SSf4ZsjkI997bCC9oidX_n1ZFus3HXhGW-MEuS22o1W90QYXw3jRmaMk61BXusr8JZd4lpizBCoKRax3EztBRwarpadH5-E9qmND_62KWfksAkygidsjKrppxpsAAQsw8M3nQ7l1PBqVQ6bpYQk123KAk4NpYyflSgY_S7Anr1oOIKuNvDixRori0DrQxX1EDi6bmzn&lptoken=1679631230c9595c000b&stream_uuid=22a8a68e-054a-4b78-bdb6-1e407ff81f61&utm_content=132117&utm_medium=10-24822&t_id=8 HTTP/1.1 
Host: medvitro.info
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                         
                                         104.21.41.55
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
date: Fri, 16 Sep 2022 04:55:20 GMT
x-powered-by: PHP/7.2.20
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NuMXO%2BoXLQpVQgpbnZRzrdz6aBHWYsY69Me7LUxPwd%2FNR1j64D60g9Z%2ByxNDZ3Blh4d3D6uzwRSDcXB8VA94CHo4FPyvuPO4OmQEw7bon9Mhhglg2B%2FJ1%2BWSC9%2Fj0t7%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74b702616e59b527-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /rpe1h8/qh8vil876/2qtq8hh81pm0uvq0y3yh.js HTTP/1.1 
Host: static.bestfeedcpm.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         172.67.177.120
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 16 Sep 2022 04:55:20 GMT
cf-bgj: minify
etag: W/"62f60e8f-d89"
last-modified: Fri, 12 Aug 2022 08:25:51 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 1980
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yqX4xnet%2BUOoAKWqW6L61w0C2CjzCGupbmneRCcVB5aSmiYJ31F8bfzObD521Hi%2B32NGhfqsEpTgwc4N8lPdTp2PBgHLak1m3%2BIZZw%2BRdrXPB6HHaZ1ybNWUjRBHWA4t%2F874w5%2FTW%2Bke"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74b70262de60b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /zhn97aiu1/9a7/91217l/l17qt20mp/p0mbj7rhl.js HTTP/1.1 
Host: static.bestfeedcpm.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://medvitro.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         172.67.177.120
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Fri, 16 Sep 2022 04:55:20 GMT
cf-bgj: minify
etag: W/"62f60e8f-12a"
last-modified: Fri, 12 Aug 2022 08:25:51 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 1980
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rr7YDuDXE0%2Fx282qXXF13Nr0b7aexfkyM4DLQfIh3pZfDK9WPs%2BvhUdk9yIgZ3Eg8uIcroMvWhk3iF%2B1q%2BjEvgbgCVoQEWRWCEZGeUNFWgiPP8uHWeBahuqI8QPvIPingpY8Di9MKbzy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 74b70262ee6eb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---