GET /campaign/click?msgId=&test=true&target=https://tireshavash.bg/new/auth/wequkrz3gzpfkklv6s6vfvfv5g2t4q24xnatfsrylyv1whe7oynti50ipkmxjkxihdzhedroky5edjdhwrujppojqkodcngbtdkd5qsubkw34ndme34bu41x22xjmggwvsvry2hndo8i3amsuxpuwylosqi0uetvp1hkxqalsyndvgalbzyqsf5ycrnu8nvs2a2dgvcl/YWxleHZAYXRzZHVjdC5jb20= HTTP/1.1
Host: tracker.club-os.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 303 See Other
date: Tue, 06 Feb 2024 14:58:47 GMT
content-length: 0
location: https://tireshavash.bg/new/auth/wequkrz3gzpfkklv6s6vfvfv5g2t4q24xnatfsrylyv1whe7oynti50ipkmxjkxihdzhedroky5edjdhwrujppojqkodcngbtdkd5qsubkw34ndme34bu41x22xjmggwvsvry2hndo8i3amsuxpuwylosqi0uetvp1hkxqalsyndvgalbzyqsf5ycrnu8nvs2a2dgvcl/YWxleHZAYXRzZHVjdC5jb20=
server: Apache/2.4.57 () OpenSSL/1.0.2k-fips
X-Firefox-Spdy: h2

GET /new/auth/wequkrz3gzpfkklv6s6vfvfv5g2t4q24xnatfsrylyv1whe7oynti50ipkmxjkxihdzhedroky5edjdhwrujppojqkodcngbtdkd5qsubkw34ndme34bu41x22xjmggwvsvry2hndo8i3amsuxpuwylosqi0uetvp1hkxqalsyndvgalbzyqsf5ycrnu8nvs2a2dgvcl/YWxleHZAYXRzZHVjdC5jb20= HTTP/1.1
Host: tireshavash.bg
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
refresh: 0;url=https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/replicationservice.html#alexv@atsduct.com
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 14:58:47 GMT
server: Apache
X-Firefox-Spdy: h2

GET /replicationservice.html HTTP/1.1
Host: pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 06 Feb 2024 14:58:48 GMT
Content-Type: text/html
Content-Length: 690
Connection: keep-alive
Accept-Ranges: bytes
ETag: "40dad66b5d14fb0d83ac7ee51f1c99de"
Last-Modified: Tue, 06 Feb 2024 11:20:34 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 851440db3e70712e-OSL

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 06 Feb 2024 14:58:48 GMT
access-control-allow-origin: *
vary: accept-encoding
location: /turnstile/v0/g/ea25f566/api.js?onload=onloadTurnstileCallback
cache-control: max-age=300, public
server: cloudflare
cf-ray: 851440dd58e9569c-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET /mach/wwqoil/host24.0/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1
Host: artamedianet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Feb 2024 14:58:48 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
Content-Encoding: gzip

GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Feb 2024 14:58:49 GMT
content-type: application/javascript; charset=utf-8
content-length: 14107
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e2d-bb78"
last-modified: Mon, 04 May 2020 16:09:17 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2802611
expires: Sun, 26 Jan 2025 14:58:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJdvULoUBc0pjaK2p3nPyoCPZlN8pSdQHV3%2Bo%2FhSfm9Ogw703ZnM%2F5d2iyYU%2BslJz70lDN847oWuwyNr5CKstB4yVA381WSwnPa9EXiAl9Y4%2Br4JxvHcgif4pyMtEtG2CHiNlot0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 851440e17fefb529-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 06 Feb 2024 14:58:49 GMT
age: 12430929
x-served-by: cache-lga21947-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 104871
x-timer: S1707231529.215584,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

GET /favicon.ico HTTP/1.1
Host: pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-40b0d18cdab34f6db619eb936249b4b5.r2.dev/replicationservice.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Tue, 06 Feb 2024 14:58:49 GMT
Content-Type: text/html
Content-Length: 27242
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 851440e1e9c5712e-OSL