GET /d4fe8430-3181-4c9a-8eb2-c98118833b9c?zoneid=4429639&bannerid=19288438&zonetype={zone_type}&campaignid=7541871&device=desktop&region=03&isp=blix%20group%20as&useragent=Mozilla/5.0%20(X11;%20Linux%20x86_64;%20rv:109.0)%20Gecko/20100101%20Firefox/111.0&language=en&connectiontype=broadband&cost=0.001127&visitor_id=737936387457954520 HTTP/1.1
Host: resionsfrester.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Tue, 17 Oct 2023 00:07:45 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://href.li/?https://www.google.com/url?q=https://sikrebettingsider.com/casino/krypto/&;source=gmail&;ust=1697536242097000&;usg=AOvVaw3bI-B0dI3qDCp5bT8FZE3-
pragma: no-cache
set-cookie: d4fe8430-3181-4c9a-8eb2-c98118833b9c-v4=vyE6g5PhK6-SEuJWXt32jP8W-JltTfOjElWf07F_54U; Max-Age=86400; Expires=Wed, 18-Oct-2023 00:07:45 GMT; Domain=resionsfrester.com; Path=/; Secure; HttpOnly;SameSite=None
cc-v4=S3lA0AG0juPdjyiHPPeyO8oAD%2Bsl5hdBAdY2LUwArSCBAmuQwiL4lDj9TLS2aZemHGJIF%2Boc6fLRYr1KIZGYhktCK1W9qUstk11dnF3dgqgukneqZ0r6frGWLPpL8932WRruCg7nDbi%2F%2FDnKK5717g%3D%3D; Max-Age=31536000; Expires=Wed, 16-Oct-2024 00:07:45 GMT; Domain=resionsfrester.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2

POST /img.gif?f=merge&userId=75db6b6c973d4f1e9a6e45c4fcedad45 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 00:07:45 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: null
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=75db6b6c973d4f1e9a6e45c4fcedad45; expires=Wed, 16 Oct 2024 00:07:45 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 00:07:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET /?https://www.google.com/url?q=https://sikrebettingsider.com/casino/krypto/&;source=gmail&;ust=1697536242097000&;usg=AOvVaw3bI-B0dI3qDCp5bT8FZE3- HTTP/1.1
Host: href.li
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 00:07:46 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding
content-encoding: br
x-ac: 3.arn _dca MISS
X-Firefox-Spdy: h2

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 00:07:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

GET /favicon.ico HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/url?q=https://sikrebettingsider.com/casino/krypto/&;source=gmail&;ust=1697536242097000&;usg=AOvVaw3bI-B0dI3qDCp5bT8FZE3-
Cookie: SOCS=CAESHAgBEhJnd3NfMjAyMjA5MjktMF9SQzEaAnJvIAEaBgiAkvOZBg; __Secure-ENID=15.SE=j8rlMbq1YXm867runp4kkW4T5DI6VevnAL-URCapyVqngyS3EHQlp8iM6h6bEroFHYgIKbuqASg45cTVVns9_Ue1LRweUbbtFo9dyH0T0M0C62P-R88fJxTRPByCv5GHilDYHDZXUUXe90I_E0WTFkZ2fHlZwKDEzA6-72-98ok; CONSENT=PENDING+446
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1494
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 16 Oct 2023 17:54:15 GMT
expires: Tue, 24 Oct 2023 17:54:15 GMT
cache-control: public, max-age=691200
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
content-type: image/x-icon
vary: Accept-Encoding
age: 22411
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET /url?q=https://sikrebettingsider.com/casino/krypto/&;source=gmail&;ust=1697536242097000&;usg=AOvVaw3bI-B0dI3qDCp5bT8FZE3- HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: SOCS=CAESHAgBEhJnd3NfMjAyMjA5MjktMF9SQzEaAnJvIAEaBgiAkvOZBg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 17 Oct 2023 00:07:46 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-KkJhpOkKHHz9-lnlNp1jQA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 663
x-xss-protection: 0
set-cookie: __Secure-ENID=15.SE=j8rlMbq1YXm867runp4kkW4T5DI6VevnAL-URCapyVqngyS3EHQlp8iM6h6bEroFHYgIKbuqASg45cTVVns9_Ue1LRweUbbtFo9dyH0T0M0C62P-R88fJxTRPByCv5GHilDYHDZXUUXe90I_E0WTFkZ2fHlZwKDEzA6-72-98ok; expires=Fri, 15-Nov-2024 16:26:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
CONSENT=PENDING+446; expires=Thu, 16-Oct-2025 00:07:46 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2