GET /sxp/i/224f85302aa2b6ec30aac9a85da2cbf9.js HTTP/1.1
Host: euob.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
content-length: 42496
content-encoding: gzip
server: Caddy
date: Mon, 04 Aug 2025 05:27:38 GMT
cache-control: max-age=43200
expires: Mon, 04 Aug 2025 17:27:38 GMT
etag: "1c463-a58KpXdeaJHjsjAtkPOrxOllwUk"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 8e83ffcea906745255dd96fad91bf456.cloudfront.net (CloudFront)
x-amz-cf-pop: HEL51-P4
x-amz-cf-id: rKOQxTgR48kICCzXLDhUxOmSL9T-2Fbbktd9f8Bm9rOWKClHobG6jw==
age: 12231
X-Firefox-Spdy: h2

GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-length: 11375
server: nginx
date: Mon, 04 Aug 2025 05:29:31 GMT
accept-ranges: bytes
last-modified: Thu, 21 Mar 2024 11:48:11 GMT
etag: "czzekhpxmtxd8rz"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 50a19afbefe1a01ca6a87078a2b119c2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: pc2QRD0hTexg-7PtE-MVcuFFAikyoNd2QXBk_AwQg2uVB3TC9ZlBrQ==
age: 12118
X-Firefox-Spdy: h2

GET /ct?id=80705&url=https%3A%2F%2Fwww.hs2.wheresmystaterefund.com%2F&sf=0&tpi=&ch=AdsDeli%20-%20domain%20-%20landingpage&uvid=e6c98e00973d998bdf523c4dee432bb6f012f70d&tsf=0&tsfmi=&tsfu=&cb=1754297490022&hl=2&op=0&ag=637386554&rand=9421220127255575980910265690101500181110050005821727618857252572612099820090263705906126&fs=1280x1024&fst=1280x1024&np=win32&nv=&ref=&ss=1280x1024&nc=0&at=&di=W1siZWYiLDgyNTddLFsiYWJuY2giLDIxXSxbLTUsIi0iXSxbLTE3LCI0OCJdLFstMjAsIi0iXSxbLTM2LCJbXCI1LzRcIixcIjUvNFwiXSJdLFstNTIsIi0iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMzLCItIl0sWy0zNCwiLSJdLFstNDIsIjg4MzM5OTAxNiJdLFstNDMsIjAwMDAwMDAxMDAwMDAwMDAwMDExMTAwMTAwMDAwMTAwMDAwMDAwMDAwIl0sWy01MywiMDAxIl0sWy02NywiLSJdLFstMiwiOSxJc045bkduV2JBWUFJeE5mUWFPcUdFMENGQVFzY0cwMEluaE9iWUJBS1lVT3pRTzZFWDAyMEltR0xjdTYydXJkUC9jMmQycE5tVlpBd2YzLy84ejc5R3JIYTFXdTNPbVhQUHZlIl0sWy02LCJ7XCJ3XCI6W1wiMFwiLFwidGNibG9ja1wiLFwic2VhcmNoYm94QmxvY2tcIixcImdldFhNTGh0dHBcIixcImFqYXhRdWVyeVwiLFwiYWpheEJhY2tmaWxsXCIsXCJsb2FkRmVlZFwiLFwieG1sSHR0cFwiLFwibHNcIixcImdldExvYWRGZWVkQXJndW1lbnRzXCIsXCJOb3RpZnlQYWludEV2ZW50XCIsXCJfX2N0Y2dfY3RfODA3MDVfZXhlY1wiXSxcIm5cIjpbXSxcImRcIjpbXX0iXSxbLTgsIi0iXSxbLTksIi0iXSxbLTE1LCItIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTMxLCJmYWxzZSJdLFstNDAsIjM3Il0sWy01MCwiLSJdLFstNjgsIi0iXSxbLTcwLCItIl0sWy0xNiwiMCJdLFstMjMsIisiXSxbLTM4LCJpLC0xLC0xLDI1LDAsMSwwLDI4LDExMiw1NSwtMSwwLCw1NzcsODQyLDg0MiJdLFstNDYsIjAiXSxbLTQ4LCJbXCItXCIsXCItXCIsXCItXCIsXCItXCIsXCItXCJdIl0sWy0zMiwiMCJdLFstNDEsIi0iXSxbLTUxLCItIl0sWy01NSwiMCJdLFstMSwiTGludXggeDg2XzY0Il0sWzEyLCJ7XCJjdHhcIjpcIndlYmdsXCIsXCJ2XCI6XCJtZXNhXCIsXCJyXCI6XCJsbHZtcGlwZVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMFwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wXCIsXCJndmVuXCI6XCJtb3ppbGxhXCIsXCJiZW5cIjo5MixcIndnbFwiOjEsXCJncmVuXCI6XCJsbHZtcGlwZVwiLFwic2VmXCI6NDk0MTk1MDQzLFwic2VjXCI6XCJcIn0iXSxbLTExLCJ7XCJ0XCI6XCJcIixcIm1cIjpbXX0iXSxbLTQ1LCI3NTIsMCwwLDcxOSwwLDAsNzYxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAiXSxbLTQ5LCItIl0sWy01OSwiLSJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstNCwiLSJdLFstMTIsIlwiMVwiIl0sWy0yNSwiLSJdLFstNTgsIi0iXSxbLTYxLCItIl0sWy02MiwiNTgiXSxbLTY1LCItIl0sWy03MywiRWhRPSJdLFstMTAsIi0iXSxbLTE5LCJbMCwwLDAsMCwwLDAsMSwyNCwyNCxcIi1cIiwxMjgwLDEwMjQsMTI4MCwxMDI0LDEyODAsMTAyNCwxMjgwLDEwMjQsMCwwLDAsMCxcIi1cIixcIi1cIiwxMjgwLDEwMjQsbnVsbF0iXSxbLTI0LCJbXSJdLFstMjYsIi0iXSxbLTU0LCJ7XCJoXCI6W1wiMzI5OTcyODQ1MlwiLFwiODIyODIzMTE5XCIsXCJfM1wiLFwiMjYzOTIyMjQ2OFwiXSxcImRcIjpbXSxcImJcIjpbXCJfMFwiLFwiMjY0NjAzODgyXCJdLFwic1wiOjF9Il0sWy01NiwibGFuZHNjYXBlLXByaW1hcnkiXSxbLTU3LCJTM2xSVFUxSlNnTVdGbHhNVmxzWFFGWk1TbHhZU2xKQUYxcFdWQlpLUVVrV1VCWUxDdzFmQVF3S0NRdFlXQXRiRDF4YUNnbFlXRm9BV0FFTVhWZ0xXbHRmQUJkVFNnTUlBdzhNQ1FrS0ZRNElBQlpORjF4QlNWWkxUVW9XQlhsUlRVMUpTZ01XRmx4TVZsc1hRRlpNU2x4WVNsSkFGMXBXVkJaS1FVa1dVQllMQ3cxZkFRd0tDUXRZV0F0YkQxeGFDZ2xZV0ZvQVdBRU1YVmdMV2x0ZkFCZFRTZ01JQXc4TUNBQUFGVXBjVFcxUVZGeFdURTBaVVZoWFhWVmNTeE1PQ0FBV1RSZGNRVWxXUzAxS0ZnVjVVVTFOU1VvREZoWmNURlpiRjBCV1RFcGNXRXBTUUJkYVZsUVdTa0ZKRmxBV0N3c05Yd0VNQ2drTFdGZ0xXdzljV2c9PSJdLFstNjksIldpbjMyfHx8NDh8LXwtIl0sWy03MSwiYTAxMDAxMDExMDAxMDAxMDEwMDAxMDEwMDExMDExMDAwMDAwMTAiXSxbLTcyLCJFeFU9Il0sWy03LCItIl0sWy0yNywiLSJdLFstMzUsIlsxNzU0Mjk3NDg5OTY5LDBdIl0sWyJibmNoIiwzODddLFstMTQsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0yOSwiLSJdLFstNDQsIjAsNSwwLDUiXSxbLTQ3LCJVVEMsZW4tVVMsbGF0bixncmVnb3J5Il0sWy02NiwiLSJdLFstMTMsIi0iXSxbLTE4LCJbMSwwLDAsMF0iXSxbLTIxLCItIl0sWy0zNywiLSJdLFstMzksIltcIjIwMTAwMTAxXCIsMixcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLFwiMjAxODEwMDEwMDAwMDBcIixudWxsLGZhbHNlLG51bGwsZmFsc2UsbnVsbCw1LHRydWUsZmFsc2UsbnVsbCwwLGZhbHNlLGZhbHNlLGZhbHNlLGZhbHNlXSJdLFstNjAsIi0iXSxbLTYzLCItIl0sWy02NCwiLSJdLFstNzQsIi0iXSxbImRkYiIsIjEsOCwwLDAsMSwzLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMywwLDAsMCwzLDAsMCwwLDAsMCwxLDIsMSw1MiwwLDE5LDAsMCwwLDAsMCwxLDIsMCwwLDEsMSwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMSwwLDAsMCwwIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMSwxLDUsNiwwLDk1LDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwyLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwxLDAsMSwwLDEsMSwwLDEsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMSwwIl1d&dep=0&pre=0&sdd=&cri=rvWYWz92A2&pto=1108&ver=65&gac=-&mei=&ap=&fe=1&duid=1.1754297490.K9w7P2hAzJRLZCpk&suid=1.1754297490.eH5DTQICV7vxgjG9&tuid=1.1754297490.7Z47oqPSugAz56zZ&fbc=-&gtm=-&it=9%2C473%2C124&fbcl=-&gacl=-&gacsd=-&rtic=-&rtict=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/javascript
date: Mon, 04 Aug 2025 08:51:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
set-cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60; Max-Age=29030400; Path=/; Expires=Mon, 06 Jul 2026 08:51:30 GMT; HttpOnly; Secure; SameSite=None
timing-allow-origin: https://www.hs2.wheresmystaterefund.com
content-length: 1291
X-Firefox-Spdy: h2

GET /munin/a/tr/answercheck/yes?domain=wheresmystaterefund.com&caf=1&toggle=answercheck&answer=yes&uid=MTc1NDI5NzQ4OS4xMDU6ZTFlMmVmY2I4OTQyMTIwOTgwNzJjMTNmNzM3YzE5OTY2OWIzOTZkNjVjNjM0ZmM3OGI1Yjk1OGVmODQ1ZDA3MDo2ODkwNzQ5MTE5YTU1 HTTP/1.1
Host: www.hs2.wheresmystaterefund.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: _cq_duid=1.1754297490.K9w7P2hAzJRLZCpk; _cq_suid=1.1754297490.eH5DTQICV7vxgjG9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ch: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
accept-ch-lifetime: 30
access-control-allow-origin: *
alt-svc: h3=":8443"; ma=2592000
content-type: text/html; charset=UTF-8
date: Mon, 04 Aug 2025 08:51:30 GMT
via: 1.1 Caddy, 0.0 Caddy
x-custom-track: answercheck
content-length: 0
X-Firefox-Spdy: h2

POST /mon HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1917
Origin: https://www.hs2.wheresmystaterefund.com
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.hs2.wheresmystaterefund.com
content-type: application/json
date: Mon, 04 Aug 2025 08:51:33 GMT
content-length: 0
X-Firefox-Spdy: h2

POST /mon HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1920
Origin: https://www.hs2.wheresmystaterefund.com
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.hs2.wheresmystaterefund.com
content-type: application/json
date: Mon, 04 Aug 2025 08:51:45 GMT
content-length: 0
X-Firefox-Spdy: h2

GET /munin/a/tr/browserjs?domain=wheresmystaterefund.com&toggle=browserjs&uid=MTc1NDI5NzQ4OS4xMDU6ZTFlMmVmY2I4OTQyMTIwOTgwNzJjMTNmNzM3YzE5OTY2OWIzOTZkNjVjNjM0ZmM3OGI1Yjk1OGVmODQ1ZDA3MDo2ODkwNzQ5MTE5YTU1 HTTP/1.1
Host: www.hs2.wheresmystaterefund.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ch: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
accept-ch-lifetime: 30
access-control-allow-origin: *
alt-svc: h3=":8443"; ma=2592000
content-type: text/html; charset=UTF-8
date: Mon, 04 Aug 2025 08:51:29 GMT
via: 1.1 Caddy, 0.0 Caddy
x-custom-track: browserjs
content-length: 0
X-Firefox-Spdy: h2

GET /munin/a/ls?t=68907491&token=e6c98e00973d998bdf523c4dee432bb6f012f70d HTTP/1.1
Host: www.hs2.wheresmystaterefund.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 201 Created
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":8443"; ma=2592000
date: Mon, 04 Aug 2025 08:51:29 GMT
server: Caddy
via: 1.1 Caddy
x-log-success: 68907491644d6186439beabb
content-length: 0
X-Firefox-Spdy: h2

GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Mon, 04 Aug 2025 08:51:29 GMT
expires: Mon, 04 Aug 2025 08:51:29 GMT
cache-control: private, max-age=3600
etag: "15828379506924220754"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET /afs/ads?adtest=off&psid=5837883959&pcsa=false&channel=000001%2Cbucket003%2Cbucket077&client=dp-teaminternet04_3ph&r=m&hl=no&ivt=0&rpbu=https%3A%2F%2Fwww.hs2.wheresmystaterefund.com%2F%3Fts%3DeyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.9lGis30Vi94etbnn9NUasWAJtvY6s0Gpx14E4IEzyHANIeZryoUBYg.thePuptIhYSZ1Pvz7sLcMg.4Bn-UKlcu4R8QZR_fv19joYhIDUvS2LNNzq37OTPwztPL7WyIp1sHksovKz8hYOdxBn_jKuBDp1CJkOsQrPx2C-DYif7phS6qpVuCtZJR4BRlulMz4hKdNx0_6RmAypAep9PAICZ3ECPaSER9lSE2QJRBW-itWeV7CSR0GPBQ7AVf7RmwLmX-1yJkG7YW_Q0A9Q-5SPtFhjJgBgoAXOgJpW3AqRwcFkjRAJdb_15k5JrG6znEkvkeVtm6K_zRceNXyceFYnh_ccXcK9ARGikxMvuMR6w7Vq81lL48RYDUPZblyQ1UjWVoZ1A4lg5nwm2YeSyqQ_ZfWksK3bVnALo8vyh1EcNPF6vwjedxQQfzObUv7_e3U1R5UGcW-q0ZV_H5XB0HKwAWoj4UshzaSagnWWYWgf0n1Z6onp7kPoSagLxhV4aVmmBDAP8zWk4eWYxzH4SZIXztDufO8OmonCh8_Hys4iRzAVkxQ_GEJGD_HIWkPF_iehx1cHd7ikc5jYgi7--lf3eZtpZBVcv8-R4QkX86hSoLSOzHXed8L9VTkH32NAbLQOPidhtOTyc12mGv0LXfuoJpxnuF7aaDK7wZBFZ9Vl-dIyaZ4snw54baNu5ZNlnE2NFJZ4yzhhGyMsZOkx52zQcZjvefcrkT9C6Pw.WTv7kKe-VeqgXdTJVqRjIw&max_radlink_len=40&type=3&swp=as-drid-2995986513634288&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108%2C17301544&format=r3%7Cs&nocache=651754297489924&num=0&output=afd_ads&domain_name=www.hs2.wheresmystaterefund.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1754297489925&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=788436323&rurl=https%3A%2F%2Fwww.hs2.wheresmystaterefund.com%2F HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Mon, 04 Aug 2025 08:51:30 GMT
expires: Mon, 04 Aug 2025 08:51:30 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-IKNRAu7JUnYUKdQHhnzArA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
accept-ch: Downlink, RTT
content-encoding: br
server: gws
content-length: 3468
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

POST /mon HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 2685
Origin: https://www.hs2.wheresmystaterefund.com
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.hs2.wheresmystaterefund.com
content-type: application/json
date: Mon, 04 Aug 2025 08:51:31 GMT
content-length: 0
X-Firefox-Spdy: h2

GET /afs/gen_204?client=dp-teaminternet04_3ph&output=uds_ads_only&zx=3nxit1p05kep&cd_fexp=72717108%2C17301544&aqid=knSQaPbcBYqfxdwPqMXmsAw&psid=5837883959&pbt=bs&adbx=375&adby=132&adbh=498&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet04_3ph&errv=788436323&csala=6%7C0%7C332%7C111%7C139&lle=0&ifv=1&hpt=1 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-nJp5ZesecmonePKl7jocVw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
date: Mon, 04 Aug 2025 08:51:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST /mon HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1920
Origin: https://www.hs2.wheresmystaterefund.com
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.hs2.wheresmystaterefund.com
content-type: application/json
date: Mon, 04 Aug 2025 08:51:40 GMT
content-length: 0
X-Firefox-Spdy: h2

GET /adsense/domains/caf.js?pac=0 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Mon, 04 Aug 2025 08:51:30 GMT
expires: Mon, 04 Aug 2025 08:51:30 GMT
cache-control: private, max-age=3600
etag: "13613409647395789916"
x-content-type-options: nosniff
link: <https://syndicatedsearch.goog>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET /tracker/tc_imp.gif?e=37dfbd8ee84e00126feac53ced43839d9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d56118a6d2217071a10acf9f29f671fd387dc5428394efa2e7655873b8c62c30338007291570357305056cfed6d4f77be26bb25cb43e29a3aee5b6fb2092f6410df57fe5aecd2948a7fe07f52a13ad2a24710d14e681f2d1586d31c64e56ac8bf88b71208fe59f1d329e921c46bcf40e25c7ea8290ee95c400035db386ee683e99332bd06b442c316f0496f70bfc72f02431e24f97999c140ab51258fc6e279126332a5de6c7fd6d5431f294c6f0715a7902c701e56f2ab0b2093aef6298ee35d60013ee9f3e4869265e8d8d809e8559d0d3664cebd9cb2f062c4d4e23fc63508d6fdcf7d1814f0643cba8c063abbcaf1778807fc4eae965d8013d9c56d9c7c71d6da2dc77ad795afedd7ace1076dae7af4eeb9741877f88227c5f617e5001855c90e05d8cfc38681fa827090799edea58f7bff717774dc297dc2dad14f6788a85f8641a9d34dd62ffc33025c578c6ee9439cd7a97bbf9728c00ca7d79c9b29ce584e2da51e37556f6f79c9a721fb07d2c18827ae9227b2d222d98eeff5718aa2e45a613ec6a95247cfbc0c5914ffe1ee74ae28c4f840fdb77fc120f964cb17ad40c5a22eda083bf6f8c0156366355d6e720805a0f3917ece10f5195c4942fbb04bc39b1c0be2b9dfbabc6cdeece4fc86fbb3f04b4f3cff5b87b6596e8b5f641bd761556d6df67bac7405c3ebc160827cd33996a824cea4109879073d3d037f1180dde7d33b6748991e4189cedabdb0d64e029fb5a16091ce7b67c5d4103c75e496d8573daa20845b8307e53f9a0ec6ce13fcd72ef0cfcd8bcc5568fde125628573a28fb9ac12956c2a6d0cd36f2352e9d215f58e68a0eadb9346d195c476576355b42faa1bab52b7856b9f35472841242807e42eeae04a26df6886efa26faec65f906637ea48283e95fad0145be974f18c19dd03380054bb512885f09608a81269ebcf16a795b7ed9c50981d03301f991a3940ded4554eb03cfbec957ccb8290510e2de6337f56669a4009b9c7fc12138c702586d5954bcad0bed34b62e761a90d6b4ade0e7e2a97c20e428fd2ffc4a2ef51f330a672c77a82dc53d6e7f93725b0c51397dcacb8c7f7d2d1261dcfb56747913f8e18c408b4f621a9d3df8432a08cd0f8f8467f88f3a4ba1a8746820c533e4e74d8c97a4f9c17b60286d16ff3403ae83b0f9273e6c3&cri=rvWYWz92A2&ts=243&cb=1754297490265 HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
date: Mon, 04 Aug 2025 08:51:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
content-length: 43
X-Firefox-Spdy: h2

GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 03 Aug 2025 11:59:49 GMT
expires: Mon, 04 Aug 2025 10:59:49 GMT
cache-control: public, max-age=82800
age: 75101
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

POST /mon HTTP/1.1
Host: obseu.youseasky.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1917
Origin: https://www.hs2.wheresmystaterefund.com
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Cookie: cg_uuid=fa4ec46e4f1a00c04785a25385d99c60
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.hs2.wheresmystaterefund.com
content-type: application/json
date: Mon, 04 Aug 2025 08:51:35 GMT
content-length: 0
X-Firefox-Spdy: h2

GET / HTTP/1.1
Host: www.hs2.wheresmystaterefund.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ch: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
accept-ch-lifetime: 30
alt-svc: h3=":8443"; ma=2592000
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 04 Aug 2025 08:51:29 GMT
vary: Accept-Encoding
via: 1.1 Caddy, 0.0 Caddy
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_K6Q3OkUG4GLIQvtNV1o+BI8nbalQxmj56igKciKwx0Bw0qcxGop43w6CwJ7Jlsp+qm5ruPBmdZ4RoTOOLId3Ew==
x-buckets: bucket003,bucket077
x-domain: wheresmystaterefund.com
x-language: norwegian
x-pcrew-blocked-reason: hosting network
x-pcrew-ip-organization: Blix Solutions
x-subdomain: www.hs2
x-template: tpl_CleanPeppermintBlack_twoclick
X-Firefox-Spdy: h2

GET /favicon.ico HTTP/1.1
Host: www.hs2.wheresmystaterefund.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
alt-svc: h3=":8443"; ma=2592000
content-type: image/vnd.microsoft.icon
date: Mon, 04 Aug 2025 08:51:29 GMT
etag: "dbq3yx0sj1pj0"
last-modified: Thu, 31 Jul 2025 08:47:31 GMT
server: Caddy
vary: Accept-Encoding
via: 1.1 Caddy
content-length: 0
X-Firefox-Spdy: h2

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://syndicatedsearch.goog/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 03 Aug 2025 12:11:50 GMT
expires: Mon, 04 Aug 2025 11:11:50 GMT
cache-control: public, max-age=82800
age: 74380
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET /afs/gen_204?client=dp-teaminternet04_3ph&output=uds_ads_only&zx=jvlfwt4fhdi7&cd_fexp=72717108%2C17301544&aqid=knSQaPbcBYqfxdwPqMXmsAw&psid=5837883959&pbt=bv&adbx=375&adby=132&adbh=498&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet04_3ph&errv=788436323&csala=6%7C0%7C332%7C111%7C139&lle=0&ifv=1&hpt=1 HTTP/1.1
Host: syndicatedsearch.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.hs2.wheresmystaterefund.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-67uncxHwckb0h5cv27uLww' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
date: Mon, 04 Aug 2025 08:51:32 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000