POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9BDC1A9C47D76DC96134B04996050573491D15A2D8B6BE4157791B9D6F0766C9"
Last-Modified: Sat, 27 Jul 2024 06:56:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17860
Expires: Sat, 27 Jul 2024 21:44:22 GMT
Date: Sat, 27 Jul 2024 16:46:42 GMT
Connection: keep-alive

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "552C092E8F81EBCD4575F45F58DBBC32E2813E6E6A988ADF173122916658AE47"
Last-Modified: Sat, 27 Jul 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3081
Expires: Sat, 27 Jul 2024 17:38:03 GMT
Date: Sat, 27 Jul 2024 16:46:42 GMT
Connection: keep-alive

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D2CC1A96F886C04483D570F2FBA83B9B430796D2FAF9D6D115CCA98BC6B713F"
Last-Modified: Sat, 27 Jul 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4357
Expires: Sat, 27 Jul 2024 17:59:19 GMT
Date: Sat, 27 Jul 2024 16:46:42 GMT
Connection: keep-alive

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8FDC10E4C15083F0F547CF016657E65E77BEB95CA9ED87C0AA820AE2054A9A99"
Last-Modified: Sat, 27 Jul 2024 06:57:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13393
Expires: Sat, 27 Jul 2024 20:29:56 GMT
Date: Sat, 27 Jul 2024 16:46:43 GMT
Connection: keep-alive

GET /eb94f07b-5310-40aa-b349-ca8a2594135b?offer=7-reasons-collagen-eat-more-of-this-protein&sub2=ssmith%40slurpmail.net&from=No.1+thyroid+nut-Hello%40BloodSugarFit.com&subject=Thyroid+craves+this+weight-loss+nut&sub1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks HTTP/1.1
Host: trkw.fitterufitness.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-length: 0
location: https://www.wm74trk.com/28KL6/2NL53HT/?sub1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&sub5=wsc4lbnvrfi3p813jqhi5lds&sub3=91.90.42.154
date: Sat, 27 Jul 2024 16:46:43 GMT
cache-control: no-store, no-cache, pre-check=0, post-check=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: eb94f07b-5310-40aa-b349-ca8a2594135b-v4=Img5KFyHfuLwkCPX1CsXOox3nmjkftFrkA6dOwdTMhg; Max-Age=86400; Expires=Sun, 28-Jul-2024 16:46:43 GMT; Domain=trkw.fitterufitness.com; Path=/; Secure; HttpOnly;SameSite=None
voluum-cid-v4=%7B%22cid%22%3A%22wsc4lbnvrfi3p813jqhi5lds%22%2C%22caid%22%3A%22eb94f07b-5310-40aa-b349-ca8a2594135b%22%7D; Max-Age=31536000; Expires=Sun, 27-Jul-2025 16:46:43 GMT; Domain=trkw.fitterufitness.com; Path=/; Secure; HttpOnly;SameSite=None
server: nginx
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: MFcTp6jQDEbE_pZGYuNRclqpUaa6FhV9_NHZtg0VDzdkQkBsBud4LA==
X-Firefox-Spdy: h2

POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 27 Jul 2024 16:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 27 Jul 2024 00:29:57 GMT
Expires: Sun, 28 Jul 2024 00:29:57 GMT
ETag: "3574502ef42681b5f7b706e76567678a4281f529"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

GET /28KL6/2NL53HT/?sub1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&sub5=wsc4lbnvrfi3p813jqhi5lds&sub3=91.90.42.154 HTTP/1.1
Host: www.wm74trk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Sat, 27 Jul 2024 16:46:43 GMT
content-type: text/html; charset=utf-8
content-length: 211
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://fb.nativepath.com/rd/r.php?sid=1065&pub=240073&c1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&c2=&c3=16dcbf625536426191f035990a3a10e8
set-cookie: uniqueClick_2NL53HT=5e7b8c50-1da1-4a03-83ea-e69c2fd98c3c:1722098803; Path=/; Expires=Tue, 30 Jul 2024 16:46:43 GMT; Secure; SameSite=None
transaction_id=16dcbf625536426191f035990a3a10e8; Path=/; Expires=Fri, 25 Oct 2024 16:46:43 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: b213b2c4-2b74-43de-b9c5-e645758ec0aa
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 27 Jul 2024 16:46:43 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 27 Jul 2024 00:29:57 GMT
Expires: Sun, 28 Jul 2024 00:29:57 GMT
ETag: "3574502ef42681b5f7b706e76567678a4281f529"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B2FA48CD576083353B10218B33BFE5DE0D50C16D9D52022E5E2A77CB80DA38B0"
Last-Modified: Sat, 27 Jul 2024 07:44:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13270
Expires: Sat, 27 Jul 2024 20:27:54 GMT
Date: Sat, 27 Jul 2024 16:46:44 GMT
Connection: keep-alive

GET /rd/r.php?sid=1065&pub=240073&c1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&c2=&c3=16dcbf625536426191f035990a3a10e8 HTTP/1.1
Host: fb.nativepath.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Sat, 27 Jul 2024 16:46:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Server: nginx/1.12.2
Set-Cookie: uid1065=598862452-20240727094644-210f734dbd1d1fa3b6f6ae376ad9dd46-5569; domain=nativepath.com; expires=Sat, 03-Aug-2024 16:46:44 GMT; path=/; SameSite=None; Secure
Location: https://health.nativepath.com/7-reasons-everyone-should-be-taking-this-protien-1065-v13?hpcid=1065&pub=240073&hit=598862452&c1=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&c2=&c3=16dcbf625536426191f035990a3a10e8&utm_source=as_square-mw6gw-yp-TW-PM1-07-27-24-Thyroid-Renew-Advertorial-01-Paleohacks&utm_medium=cpc&utm_campaign=&utm_content=16dcbf625536426191f035990a3a10e8&cont=1

GET /js/LazyImage.a698675f6fd38cb87757.js HTTP/1.1
Host: g.fastcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://health.nativepath.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Jul 2024 16:46:45 GMT
content-type: application/javascript
content-length: 1162
cache-control: public, max-age=31536000
expires: Sun, 27 Jul 2025 16:46:45 GMT
last-modified: Wed, 19 Jun 2024 09:15:27 GMT
etag: "67ce7db2b9d01eb08e0ee3f7eddd1bbf"
vary: Accept-Encoding
x-goog-generation: 1718788527554276
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 1162
content-encoding: gzip
x-goog-hash: crc32c=YCOE0Q==, md5=Z859srnQHrCODuP37d0bvw==
x-goog-storage-class: MULTI_REGIONAL
x-guploader-uploadid: ACJd0NqOLmjnoiOwJyScYbFAaYicUDDUefaCBMR3tprCRzmF05YES2_6OitadjIj5lSc0UgVX-uJMCn9UA
cf-cache-status: HIT
age: 1925948
accept-ranges: bytes
server: cloudflare
cf-ray: 8a9e1b7cfc51b503-OSL
X-Firefox-Spdy: h2

GET /js/sptw.2fff3c07e91a81e507a4.js HTTP/1.1
Host: g.fastcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://health.nativepath.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 27 Jul 2024 16:46:45 GMT
content-type: application/javascript
content-length: 20505
cache-control: public, max-age=31536000
expires: Sun, 27 Jul 2025 16:46:45 GMT
last-modified: Wed, 19 Jun 2024 09:15:29 GMT
etag: "6ef7f49017e8190f22a389f4a0462fae"
vary: Accept-Encoding
x-goog-generation: 1718788529050056
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 20505
content-encoding: gzip
x-goog-hash: crc32c=ddebnQ==, md5=bvf0kBfoGQ8io4n0oEYvrg==
x-goog-storage-class: MULTI_REGIONAL
x-guploader-uploadid: ACJd0Nrkbw63gEAJNMP5-2b3Awh6KlfobvYcwP-ScdV2cJYGATvb3L9I-b6A70W3L2q9rmWh-iEOD-O2Yg
cf-cache-status: HIT
age: 1925948
accept-ranges: bytes
server: cloudflare
cf-ray: 8a9e1b7cfc55b503-OSL
X-Firefox-Spdy: h2

GET /js/cm.js HTTP/1.1
Host: g.fastcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://health.nativepath.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 27 Jul 2024 16:46:45 GMT
content-type: application/javascript
content-length: 17906
x-guploader-uploadid: ABPtcPpuBnJVPbAHoRQ8pzqSGloYEKfNNMKSFHSs3Ywslbz6mq-VbtjQvynuDVsYuH75ER_I4E6CNa8MIg
cache-control: public, max-age=31536000
expires: Sun, 27 Jul 2025 16:46:45 GMT
last-modified: Thu, 30 Jun 2022 02:12:17 GMT
etag: "8e466d98fa1f746c74b1b409d20a0cf3"
vary: Accept-Encoding
x-goog-generation: 1656555137097208
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 17906
content-encoding: gzip
x-goog-hash: crc32c=ZpZBfw==, md5=jkZtmPofdGx0sbQJ0goM8w==
x-goog-storage-class: MULTI_REGIONAL
cf-cache-status: HIT
age: 3820842
accept-ranges: bytes
server: cloudflare
cf-ray: 8a9e1b7cfc57b503-OSL
X-Firefox-Spdy: h2

GET /js/Cradle.8725edce5135a9515d48.js HTTP/1.1
Host: g.fastcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://health.nativepath.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Jul 2024 16:46:45 GMT
content-type: application/javascript
content-length: 4338
cache-control: public, max-age=31536000
expires: Sun, 27 Jul 2025 16:46:45 GMT
last-modified: Wed, 19 Jun 2024 09:15:27 GMT
etag: "c528792ad836c9b1c9c4c9e8e0c3e9f3"
vary: Accept-Encoding
x-goog-generation: 1718788527077613
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 4338
content-encoding: gzip
x-goog-hash: crc32c=0PTwwA==, md5=xSh5Ktg2ybHJxMno4MPp8w==
x-goog-storage-class: MULTI_REGIONAL
x-guploader-uploadid: ACJd0NprdBBLMdQjlAh9Yrke6Z14-4aGP2vmpUsguMSYf0zSIUCTODbu43azYToNEePheYqI4l-N8BYACg
cf-cache-status: HIT
age: 3302103
accept-ranges: bytes
server: cloudflare
cf-ray: 8a9e1b7d2cb7b503-OSL
X-Firefox-Spdy: h2