Edit tour

Windows Analysis Report
https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html

Overview

General Information

Sample URL:	https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html
Analysis ID:	1365347
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected HtmlPhish10

Creates files inside the system directory

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded SVGs detected

HTML body with high number of embedded images detected

HTML title does not match URL

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3804 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2024,i,12957562014909011986,829188280163330352,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6456 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_322	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	Avira URL Cloud: detection malicious, Label: phishing
Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for submitted file

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html

Virustotal: Detection: 16%

Perma Link

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_322, type: DROPPED

Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse

HTTP Parser: Iframe src: https://www.americanexpress.com/marketing-placements/map/us/en/ad.html

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: Number of links: 1
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: Number of links: 0
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: Number of links: 0

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.americanexpress.com/?inav=NavLogo

HTTP Parser: Total embedded SVG size: 710627

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: Total embedded image size: 126128
Source: https://www.americanexpress.com/?inav=NavLogo	HTTP Parser: Total embedded image size: 15844
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: Total embedded image size: 15766
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: Total embedded image size: 15766
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: Total embedded image size: 15766
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: Total embedded image size: 15766

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html

HTTP Parser: Title: Log In to My Account | American Express US does not match URL

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: Form action: asu.php
Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: Form action: asu.php
Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: Form action: asu.php

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: <input type="password" .../> found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: <input type="password" .../> found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: <input type="password" .../> found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: <input type="password" .../> found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: <input type="password" .../> found

Source: https://www.americanexpress.com/?inav=NavLogo	HTTP Parser: No favicon
Source: https://www.americanexpress.com/?inav=NavLogo	HTTP Parser: No favicon
Source: https://www.americanexpress.com/?inav=NavLogo	HTTP Parser: No favicon
Source: https://www.cdn-path.com/s2?t=AcrePMpo65tgqqD6kg4sro%2Bz&x=1&sid=ee490b8fb9a4d570&tid=LOGIN-92894ccf-5ab7-4c17-ac9c-70221aa451ab	HTTP Parser: No favicon
Source: https://www.americanexpress.com/marketing-placements/map/us/en/ad.html	HTTP Parser: No favicon
Source: https://www.americanexpress.com/marketing-placements/map/us/en/ad.html	HTTP Parser: No favicon
Source: https://www.americanexpress.com/marketing-placements/map/us/en/ad.html	HTTP Parser: No favicon
Source: https://8527c960aa27fb15093fad69b99a5dc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1	HTTP Parser: No favicon
Source: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: No <meta name="author".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="author".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="author".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="author".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: No <meta name="author".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: No <meta name="author".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: No <meta name="author".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: No <meta name="author".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: No <meta name="author".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: No <meta name="author".. found

Source: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	HTTP Parser: No <meta name="copyright".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="copyright".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="copyright".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: No <meta name="copyright".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Fdashboard%3Finav%3Dmenu_myacct_acctsum%26appv5%3Dfalse	HTTP Parser: No <meta name="copyright".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: No <meta name="copyright".. found
Source: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: No <meta name="copyright".. found
Source: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.com%2Factivity%3Finav%3Dmenu_myacct_viewstmt	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:50193 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /americanexpress-com.connect-online.page/amexs.html HTTP/1.1Host: browndoguniversity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery.mask/1.14.10/jquery.mask.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://browndoguniversity.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/369c26_b396f2977e5a40839e2fc77a6f9aac2b~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://browndoguniversity.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /media/369c26_b396f2977e5a40839e2fc77a6f9aac2b~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=n+aseSwH7oPhhnB&MD=Xo26N4r4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.americanexpress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.americanexpress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=04500034833736687162518089606440343901&ts=1703118096329 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.americanexpress.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703125296s%7CNONE%7CvVersion%7C5.0.0
Source: global traffic	HTTP traffic detected: GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/uxa.js HTTP/1.1Host: ct.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.americanexpress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=04500034833736687162518089606440343901&ts=1703118096329 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_sess=%20merevar8%3DNavLogo%3B; s_ecid=MCMID%7C04500034833736687162518089606440343901; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703125296s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.0.0
Source: global traffic	HTTP traffic detected: GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/ptc.js HTTP/1.1Host: ct.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.americanexpress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/pcc.js HTTP/1.1Host: ct.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.americanexpress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/wr.js HTTP/1.1Host: ct.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.americanexpress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/activity/src=189445;type=2015b0;cat=amexland;ord=1;num=1? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=333619020577900&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px?id=1074652&seg=17009710&redir=https%3A%2F%2Fpixel.mediaiqdigital.com%2Fpixel%3Fu3%3D%26u4%3D%26pixel_id%3D1074652%26uid%3D%24%7BUID%7D&t=2cb=43980388.17658056 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/activity/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&ocp_id=FoWDZdq2HLeKqMwPgp-JuAg&random=2030149056&sscte=1&crd=&pscrd=IhMI2pmIrKGfgwMVNwWKAx2CTwKH HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr?id=333619020577900&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fpx%3Fid%3D1074652%26seg%3D17009710%26redir%3Dhttps%253A%252F%252Fpixel.mediaiqdigital.com%252Fpixel%253Fu3%253D%2526u4%253D%2526pixel_id%253D1074652%2526uid%253D%2524%257BUID%257D%26t%3D2cb%3D43980388.17658056 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=19604228964754290
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1 HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&random=2030149056&crd=&is_vtc=1&cid=CAQSGwAvHhf_wrQeCHIPZfD03ihwRlnUO3iKqfYp9g&random=1991465498 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw&is_vtc=1&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&cid=CAQSGwAvHhf_BIsYsPSfDBnunIQ6WwhgwrmzMdmT-w&random=1344538949 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pixel?u3=&u4=&pixel_id=1074652&uid=19604228964754290 HTTP/1.1Host: pixel.mediaiqdigital.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1 HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw&is_vtc=1&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&cid=CAQSGwAvHhf_BIsYsPSfDBnunIQ6WwhgwrmzMdmT-w&random=1344538949 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&random=2030149056&crd=&is_vtc=1&cid=CAQSGwAvHhf_wrQeCHIPZfD03ihwRlnUO3iKqfYp9g&random=1991465498 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pixel?u3=&u4=&pixel_id=1074652&uid=19604228964754290 HTTP/1.1Host: pixel.mediaiqdigital.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /quota?ct=0 HTTP/1.1Host: q-aus1.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageview?pid=3776&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118103&pn=1&dw=1273&dh=2644&ww=1280&wh=907&sw=1280&sh=1024&dr=&url=https%3A%2F%2Fwww.americanexpress.com%2F%3Finav%3DNavLogo&uc=1&la=en-US&cvars=%7B%222%22%3A%5B%22pageName%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%224%22%3A%5B%22PageID%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%226%22%3A%5B%22pageName2%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%227%22%3A%5B%22businessUnit%22%2C%22AMEX%22%5D%2C%228%22%3A%5B%22PageIdentifier%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%7D&cvarp=%7B%222%22%3A%5B%22pageName%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%224%22%3A%5B%22PageID%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%226%22%3A%5B%22pageName2%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%227%22%3A%5B%22businessUnit%22%2C%22AMEX%22%5D%2C%228%22%3A%5B%22PageIdentifier%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%7D&v=13.59.1&pvt=n&ex=&r=239332 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2o8cjPTQUTBYnpqQDpNhkOFQAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=404778 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2o8cjPTQUTBYnpqQAddx1wGwAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=084362 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2Py2rDMBAAf2XRKYHYlppIeZ1MU1qTugTikkNTjGytUhHFNpb6TPPvVWnZ0y4zDHsmjw779ICNJwuSt1%2FGWpnwmMJgZxrVvjt4KIDRmC4hHMRkCR9iMoS06yzusFobn%2FDxNB4LGKzvivx%2BBNYcEW6xPrZDuH7p2xMmjE1j%2BjuwlVr25l8hI3LzFsoupLNT16Nzpm2%2BO3nArPHYy9qHPVDpJi9XRbn9A7JV4ClVyGeyirSqeSQrpaIZchFRJuaKXVVcznnMgqsNWlXKRtpPb2pX6ldrg3%2FekxDU4V1Ue7J4er6Qyw%2FgoteVDQEAAA%3D%3D&ct=2&r=161215 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/recording?rt=5&rst=1703118103064&let=1703118104059&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2 HTTP/1.1Host: k-aus1.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iu3?pid=afb12f81-e4ec-483e-8e95-2fc48324fe1c&event=CPSC9_ZZ HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3fb1%26type%3D55%26m%3D1&ex-fch=416613&ex-src=https://www.americanexpress.com/CPSC9_ZZ&ex-hargs=v%3D1.0%3Bc%3D1900396350101%3Bp%3DF88C4649-8329-B1B7-ECD9-998AC98D3FB1&cb=43980388.17658056 HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /spp.pl?a=10000&.yp=10091564&ec=CPSC9_ZZ HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0&ct_cookie_present=false&ocp_id=G4WDZdPRK_PLqMwPhvuK-AY&random=372128220&sscte=1&crd=IgEBQAE&pscrd=CLb8-ZuDpZbmvgEiEwiTy8iuoZ-DAxXzJYoDHYa9Am8 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /iu3?pid=afb12f81-e4ec-483e-8e95-2fc48324fe1c&event=CPSC9_ZZ&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ad-id=AzAhUUzAekNmhGRTL-ZlpmQ\|t
Source: global traffic	HTTP traffic detected: GET /iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3fb1%26type%3D55%26m%3D1&ex-fch=416613&ex-src=https://www.americanexpress.com/CPSC9_ZZ&ex-hargs=v%3D1.0%3Bc%3D1900396350101%3Bp%3DF88C4649-8329-B1B7-ECD9-998AC98D3FB1&cb=43980388.17658056&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ad-id=AzAhUUzAekNmhGRTL-ZlpmQ\|t
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/693288085/?label=pvz1CIG7weEBEJX5ysoC&guid=ON&script=0&ct_cookie_present=false&ocp_id=G4WDZfGAMr2NvPIP7IuIqAo&random=993643150&sscte=1&crd=IgEBOAFAAQ&pscrd=CMSCn57ZpoqSIiITCLH6zq6hn4MDFb0GTwgd7AUCpQ HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2613808224364&event=pagevisit&[line_items][0][product_id]=%271%27&ed[line_items][0][product_name]=CPSC9_ZZ&noscript=1 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /spp.pl?a=10000&.yp=10091564&ec=CPSC9_ZZ HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBBuFg2UCEDG6JjAEPfuUyeJsci68a30FEgEBAQHWhGWNZdw80iMA_eMAAA&S=AQAAAjVuk2NeKjIpDHOWrBTuAKo
Source: global traffic	HTTP traffic detected: GET /tr?id=1087025278065923&ev=PageView&cd[product]=ZZ&cd[page_description]=CPSC9_ZZ&dl=https://www.americanexpress.com/&dpo=LDU&dpoco=0&dpost=0&noscript=1 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0&ct_cookie_present=false&random=372128220&sscte=1&crd=IgEBQAE&pscrd=CLb8-ZuDpZbmvgEiEwiTy8iuoZ-DAxXzJYoDHYa9Am8&is_vtc=1&ocp_id=G4WDZdPRK_PLqMwPhvuK-AY&cid=CAQSKQAvHhf_wFPOKBzyBunCPKYElhmeHiFu5dJ8f1sPop7OqbdHCZKlNDWW&random=3098574211 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/693288085/?label=pvz1CIG7weEBEJX5ysoC&guid=ON&script=0&ct_cookie_present=false&random=993643150&sscte=1&crd=IgEBOAFAAQ&pscrd=CMSCn57ZpoqSIiITCLH6zq6hn4MDFb0GTwgd7AUCpQ&is_vtc=1&ocp_id=G4WDZfGAMr2NvPIP7IuIqAo&cid=CAQSKQAvHhf_hRG6assoF_YnoVOlkIIUQ2iD20QSermR_gFe-2sJWR7ieVtU&random=1361788883 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /rp.gif?id=t2_vjf6aeeo&event=Lead&integration=noscript HTTP/1.1Host: alb.reddit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2613808224364&event=pagevisit&[line_items][0][product_id]=%271%27&ed[line_items][0][product_name]=CPSC9_ZZ&noscript=1 HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZ6UUw4M2F2WVdDSkxZREY0R1drUit5ZUtFK1hEOStUZmQxZHVxaGpaTGJnNnZveGVZRHd0SUhjRTd4WktCZW5uNFRzTkdSRE5VOC8vNnBlS25FNWNXcUJzdGhXSlIra1I2MXA2Z05HZlN1UT0mWGkyeVZlTnlvOThxL2MvdCtFVGkra3QzbmFRPQ=="
Source: global traffic	HTTP traffic detected: GET /iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3fb1%26type%3D55%26m%3D1&ex-fch=416613&ex-src=https://www.americanexpress.com/CPSC9_ZZ&ex-hargs=v%3D1.0%3Bc%3D1900396350101%3Bp%3DF88C4649-8329-B1B7-ECD9-998AC98D3FB1&cb=43980388.17658056&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ad-id=AzAhUUzAekNmhGRTL-ZlpmQ; ad-privacy=0
Source: global traffic	HTTP traffic detected: GET /iu3?pid=afb12f81-e4ec-483e-8e95-2fc48324fe1c&event=CPSC9_ZZ&dcc=t HTTP/1.1Host: s.amazon-adsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ad-id=AzAhUUzAekNmhGRTL-ZlpmQ; ad-privacy=0
Source: global traffic	HTTP traffic detected: GET /tr?id=1087025278065923&ev=PageView&cd[product]=ZZ&cd[page_description]=CPSC9_ZZ&dl=https://www.americanexpress.com/&dpo=LDU&dpoco=0&dpost=0&noscript=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62977564728830?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A21%3A46%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&pageName=US%7CAMEX%7CHome%7CHomepage&g=https%3A%2F%2Fwww.americanexpress.com%2F%3Finav%3Dnavlogo&c.&cm.&ssf=1&.cm&omn.&lob=acquisition&.omn&visitorCheck=VisitorAPI%20Present&gvs=1&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CHome&c3=en&c4=US&v8=NavLogo&c10=prospect&c19=US%7CAMEX&v22=D%3Dgctrac&c24=US%7CAMEX%7CHome&v27=US&c30=US%7CAMEX%7CHome&c31=US%7CAMEX&c38=US%7CAMEX%7CHome&v45=prospect&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=Launch-OneCMS%3Av1.0-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-CSVisID%3Afalse-A0-msuite%3Atrue-PD%3A2023-11-01&c56=OneCMS&v60=1263&v61=landscape&v74=US%7CAMEX%7CHome%7CHomepage&c75=Launch&v75=04500034833736687162518089606440343901&v82=0.6667220326653946_1703118106730&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20euLocale%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqviz
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tWSi72TSxJzsjMS%2FdOrVSyUjLQMzMzMzcyMjA2MjMzNbY0MYs3NDcwNjS0MDQwMzc2UKoFAJesBHI0AAAA&ct=2&r=732369 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwvydawJDbZy9HWNsPLIz021s%2FPMLShKLS7OzM%2Bzy0gtytctLdZNzdPNKNAF85JLEnUTc3J0C3ISSzLyczJTEivB4oaGhqZGBkbGuonFBUDlmXmpOZnpmUk5qbp5%2BbpBmckZ8f5paalFAGSN5zBvAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=346725 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0&ct_cookie_present=false&random=372128220&sscte=1&crd=IgEBQAE&pscrd=CLb8-ZuDpZbmvgEiEwiTy8iuoZ-DAxXzJYoDHYa9Am8&is_vtc=1&ocp_id=G4WDZdPRK_PLqMwPhvuK-AY&cid=CAQSKQAvHhf_wFPOKBzyBunCPKYElhmeHiFu5dJ8f1sPop7OqbdHCZKlNDWW&random=3098574211 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/693288085/?label=pvz1CIG7weEBEJX5ysoC&guid=ON&script=0&ct_cookie_present=false&random=993643150&sscte=1&crd=IgEBOAFAAQ&pscrd=CMSCn57ZpoqSIiITCLH6zq6hn4MDFb0GTwgd7AUCpQ&is_vtc=1&ocp_id=G4WDZfGAMr2NvPIP7IuIqAo&cid=CAQSKQAvHhf_hRG6assoF_YnoVOlkIIUQ2iD20QSermR_gFe-2sJWR7ieVtU&random=1361788883 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /rp.gif?id=t2_vjf6aeeo&event=Lead&integration=noscript HTTP/1.1Host: alb.reddit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66124805314961?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A21%3A46%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&pageName=US%7CAMEX%7CHome%7CHomepage&g=https%3A%2F%2Fwww.americanexpress.com%2F%3Finav%3Dnavlogo&c.&cm.&ssf=1&.cm&omn.&lob=acquisition&.omn&.c&cc=USD&c4=US&v4=US%3AAMEX%3AHome&v5=US%3AAMEX%3AHome%3E%3EImpression%3Ehero-us-en-hp-hero-cta-all-platholidayhero-11152023-aspen-ineligible-no-Rich_Offer&c21=US%3AAMEX%3AHome&c22=US%3AAMEX%3AHome%3E%3EImpression%3Ehero-us-en-hp-hero-cta-all-platholidayhero-11152023-aspen-ineligible-no-Rich_Offer&v27=US&c49=Launch-OneCMS%3Av1.0-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-CSVisID%3Afalse-A0-msuite%3Atrue-PD%3A2023-11-01&c75=Launch&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CR
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62977564728830?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A21%3A46%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&pageName=US%7CAMEX%7CHome%7CHomepage&g=https%3A%2F%2Fwww.americanexpress.com%2F%3Finav%3Dnavlogo&c.&cm.&ssf=1&.cm&omn.&lob=acquisition&.omn&visitorCheck=VisitorAPI%20Present&gvs=1&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CHome&c3=en&c4=US&v8=NavLogo&c10=prospect&c19=US%7CAMEX&v22=D%3Dgctrac&c24=US%7CAMEX%7CHome&v27=US&c30=US%7CAMEX%7CHome&c31=US%7CAMEX&c38=US%7CAMEX%7CHome&v45=prospect&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=Launch-OneCMS%3Av1.0-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-CSVisID%3Afalse-A0-msuite%3Atrue-PD%3A2023-11-01&c56=OneCMS&v60=1263&v61=landscape&v74=US%7CAMEX%7CHome%7CHomepage&c75=Launch&v75=04500034833736687162518089606440343901&v82=0.6667220326653946_1703118106730&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20euLocale%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66124805314961?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A21%3A46%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&pageName=US%7CAMEX%7CHome%7CHomepage&g=https%3A%2F%2Fwww.americanexpress.com%2F%3Finav%3Dnavlogo&c.&cm.&ssf=1&.cm&omn.&lob=acquisition&.omn&.c&cc=USD&c4=US&v4=US%3AAMEX%3AHome&v5=US%3AAMEX%3AHome%3E%3EImpression%3Ehero-us-en-hp-hero-cta-all-platholidayhero-11152023-aspen-ineligible-no-Rich_Offer&c21=US%3AAMEX%3AHome&c22=US%3AAMEX%3AHome%3E%3EImpression%3Ehero-us-en-hp-hero-cta-all-platholidayhero-11152023-aspen-ineligible-no-Rich_Offer&v27=US&c49=Launch-OneCMS%3Av1.0-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-CSVisID%3Afalse-A0-msuite%3Atrue-PD%3A2023-11-01&c75=Launch&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703125297s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.0.0; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U; dtLatC=443; dtSa=-; _cs_cvars=%7B%224%22%3
Source: global traffic	HTTP traffic detected: GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/26/uxa.js HTTP/1.1Host: ct.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://online.americanexpress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cc.js?&sid=ee490b8fb9a4d570&tid=LOGIN-92894ccf-5ab7-4c17-ac9c-70221aa451ab&namespace=inauth HTTP/1.1Host: www.cdn-path.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageview?pid=3776&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118124&pn=2&dw=1280&dh=1576&ww=1280&wh=907&sw=1280&sh=1024&dr=&url=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3F__%2F%3Frequest_type%3Dun_Register%26Face%3Den_US&uc=1&la=en-US&cvars=%7B%224%22%3A%5B%22PageID%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%226%22%3A%5B%22pageName2%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%227%22%3A%5B%22businessUnit%22%2C%22AMEX%22%5D%2C%228%22%3A%5B%22PageIdentifier%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%7D&v=13.59.1&pvt=n&ex=&r=644679 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OywqCQBRAf%2BUyKwUZR3xBrqRFgdkmw0WGTHqnBidH1Ogh%2FnsGcXYHDpyJHAfs4yu2I1mRVH%2BkUtz2KQMjl22tnwPsM3AYZREsIvAieAWeCXHXKczxksjR9t2QugEYyTZLdxYo2SBssGq0Cetbr%2B9oO05I2Q84cMF7%2BU%2BIRYREVZe85eo9ymooxUOpZWQqSNejWGawLsjqdJ7J%2FAWA4irlqwAAAA%3D%3D&ct=2&r=627998 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.1&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=0&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118126556 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://online.americanexpress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /v2/recording?rt=5&rst=1703118125443&let=1703118125557&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2 HTTP/1.1Host: k-aus1.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.1&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=0&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118126556 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s62282580909487?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A7%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_register%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A101&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJv
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=n+aseSwH7oPhhnB&MD=Xo26N4r4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tag/js/gpt.js HTTP/1.1Host: www.googletagservices.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s62282580909487?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A7%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_register%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A101&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U; dtSa=-;
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=786401 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=528574 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=765347 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=680500 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s68705179196015?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A7%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_register%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A101&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8i
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8nUO83RRslIyMDE1MDAwNrEwNjY3NjOzMDc0MzI1tDCwsDQzMDMxAcoYWxoYKtUCAGeTvhIyAAAA&ct=2&r=288219 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s67221878960207?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A8%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=US%7CAMEX%7CHome%7CHomepage&ppvtotal=34&ppvinitial=34&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&events=event140&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=us%7Coneamex%7Cser%7Cen-us%7Caccount&c3=en&c4=US&c6=D%3Dv6&c10=customer&c12=D%3Dv12&v13=fc93af90474c4e40396a31775804d4d2&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7Cen-us&v27=US&c30=US%7Coneamex%7Cser%7Cen-us%7Caccount&c31=US&c34=fc93af90474c4e40396a31775804d4d2&c38=US%7Coneamex%7Cser%7Cen-us%7Caccount&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c43=New%20Visitor&c44=D%3Dv44&v45=customer&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c50=non-authenticated&c56=oneamex%3Adesktop&v60=1280&v61=landscape&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c75=Launch&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b79048
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s68705179196015?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A7%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_register%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A101&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O
Source: global traffic	HTTP traffic detected: GET /pagead/managed/js/gpt/m202312060101/pubads_impl.js HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENRAvg6ELZKnWQGYM3clQugn8M7tT6Ke3elRImP0fTBTVZh_rA-YSnxIQ
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s67221878960207?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A8%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=US%7CAMEX%7CHome%7CHomepage&ppvtotal=34&ppvinitial=34&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&events=event140&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=us%7Coneamex%7Cser%7Cen-us%7Caccount&c3=en&c4=US&c6=D%3Dv6&c10=customer&c12=D%3Dv12&v13=fc93af90474c4e40396a31775804d4d2&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7Cen-us&v27=US&c30=US%7Coneamex%7Cser%7Cen-us%7Caccount&c31=US&c34=fc93af90474c4e40396a31775804d4d2&c38=US%7Coneamex%7Cser%7Cen-us%7Caccount&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c43=New%20Visitor&c44=D%3Dv44&v45=customer&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c50=non-authenticated&c56=oneamex%3Adesktop&v60=1280&v61=landscape&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c75=Launch&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s68455515375641?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A9%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&cm.&ssf=1&.cm&omn.&identifier=one-identity-login&element=Login&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=one-identity-login&v5=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&c6=D%3Dv6&c10=customer&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=one-identity-login&c22=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&v27=US&c34=fc93af90474c4e40396a31775804d4d2&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62786180563312?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A9%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&cm.&ssf=1&.cm&omn.&identifier=axp-marketing-offer&element=PZN%3A%2030725&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=axp-marketing-offer&v5=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3EPZN%3A%2030725&c6=D%3Dv6&c10=customer&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=axp-marketing-offer&c22=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3EPZN%3A%2030725&v27=US&c34=fc93af90474c4e40396a31775804d4d2&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDP
Source: global traffic	HTTP traffic detected: GET /gampad/ads?pvsid=3461322832040366&correlator=2961258012058674&eid=44782499%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&iu_parts=3413884%2Caxp_elilo&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&sfv=1-0-40&sc=1&cookie_enabled=1&cdm=www.americanexpress.com&abxe=1&dt=1703118132506&lmt=1703118132&adxs=685&adys=91&biw=1263&bih=907&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=qkc1lxbynkz7&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&nhd=1&url=https%3A%2F%2Fwww.americanexpress.com%2Fmarketing-placements%2Fmap%2Fus%2Fen%2Fad.html&ref=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&top=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&vis=1&psz=300x0&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=643297094.1703118133&ga_sid=1703118133&ga_hid=122872813&ga_fc=false&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zNDEzODg0L2F4cF9lbGlsbyIsW11dXV0sbnVsbCwzXQ..&dlt=1703118126023&idt=6243&adks=168098479&frm=23 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Ad-Auction-Fetch: ?1Origin: https://www.americanexpress.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENRAvg6ELZKnWQGYM3clQugn8M7tT6Ke3elRImP0fTBTVZh_rA-YSnxIQ
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8o10dnRJzc1XslJysc3PzcutTE5MAfFrAVNGGXkcAAAA&ct=2&r=336319 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html?n=1 HTTP/1.1Host: 8527c960aa27fb15093fad69b99a5dc9.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s68455515375641?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A9%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&cm.&ssf=1&.cm&omn.&identifier=one-identity-login&element=Login&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=one-identity-login&v5=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&c6=D%3Dv6&c10=customer&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=one-identity-login&c22=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&v27=US&c34=fc93af90474c4e40396a31775804d4d2&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O7TBHBA404C7EHOMDF
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62786180563312?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A9%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Fdashboard%253Finav%253Dmenu_myacct_acctsum%2526appv5%253Dfalse&c.&cm.&ssf=1&.cm&omn.&identifier=axp-marketing-offer&element=PZN%3A%2030725&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=axp-marketing-offer&v5=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3EPZN%3A%2030725&c6=D%3Dv6&c10=customer&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=axp-marketing-offer&c22=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3EPZN%3A%2030725&v27=US&c34=fc93af90474c4e40396a31775804d4d2&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=1
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://www.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /cc.js?&sid=ee490b8fb9a4d570&tid=LOGIN-a3bc1b4e-d1f6-4c54-9f36-f94888cc73da&namespace=inauth HTTP/1.1Host: www.cdn-path.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _cc-x=ODVmZTc5NTEtZjMwNi00M2NjLWFkMTYtM2FhYzI2ZGM0YjMwOjE3MDMxMTgxMjQ4NjI
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s65738047716558?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A28%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_activation%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&ppvpage=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&ppvtotal=68&ppvinitial=68&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&v41=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A111&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118150643 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.americanexpress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118150651 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.americanexpress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.17.0/s65738047716558?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A28%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&ns=1americanexpress&fpCookieDomainPeriods=2&pageName=US%7CAMEX%7CSer%7COCE%7CCardInput&g=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3Frequest_type%3Dun_activation%26face%3Den_us%23%2F&c.&cm.&ssf=1&.cm&omn.&pagename=CardInput&hierarchy=US%7CAMEX%7CSer%7COCE&language=en&newpagename=yes&ReqId=9435&PageId=21093&rwd=rwd&visitorCheck=VisitorAPI%20Present&itagexists=yes&ppvpage=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&ppvtotal=68&ppvinitial=68&etwidth=1263&etheight=907&etratio=0.7181314330958036&etorientation=landscape&.omn&.c&cc=USD&server=online.americanexpress.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7CAMEX%7CSer%7COCE&c4=US&v22=D%3Dgctrac&v41=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c46=DLS%20Navigation&c48=D%3Dgctrac&c49=ENS-Ser%20r28.0.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3ANA-Mbox%3ANA-CSVisID%3Anull-msuite%3Atrue-esuite%3Atrue-IHC%3Afalse-A111&v65=D%3Domnmycademo&c75=npn&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20ensMarket%3A%20en%7C%20hier%3A%20US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7
Source: global traffic	HTTP traffic detected: GET /v2/recording?let=1703118125557&pid=3776&pn=2&ri=1&rst=1703118125443&rt=5&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&v=13.59.1&ct=2 HTTP/1.1Host: k-aus1.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118150651 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118150643 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=04656155214181370602502457914621337045
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65471353362194?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=US%7CAMEX%7CSer%7COCE%7CCardInput&ppvtotal=62&ppvinitial=62&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&events=event140&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=us%7Coneamex%7Cser%7Cen-us%7Caccount&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7Cen-us&v27=US&c30=US%7Coneamex%7Cser%7Cen-us%7Caccount&c31=US&c38=US%7Coneamex%7Cser%7Cen-us%7Caccount&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c50=non-authenticated&c56=oneamex%3Adesktop&v60=1280&v61=landscape&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c75=Launch&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxF
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65471353362194?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=US%7CAMEX%7CSer%7COCE%7CCardInput&ppvtotal=62&ppvinitial=62&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=www.americanexpress.com&events=event140&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=us%7Coneamex%7Cser%7Cen-us%7Caccount&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7Cen-us&v27=US&c30=US%7Coneamex%7Cser%7Cen-us%7Caccount&c31=US&c38=US%7Coneamex%7Cser%7Cen-us%7Caccount&v41=US%7CAMEX%7CSer%7COCE%7CCardInput&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c50=non-authenticated&c56=oneamex%3Adesktop&v60=1280&v61=landscape&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&c75=Launch&v75=04500034833736687162518089606440343901&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&v142=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s6877400374824?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&cm.&ssf=1&.cm&omn.&identifier=one-identity-login&element=Login&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=one-identity-login&v5=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=one-identity-login&c22=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s61969357330276?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&cm.&ssf=1&.cm&omn.&identifier=axp-marketing-offer&element=pzn_ineligible&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=axp-marketing-offer&v5=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3Epzn_ineligible&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=axp-marketing-offer&c22=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3Epzn_ineligible&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s6877400374824?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&cm.&ssf=1&.cm&omn.&identifier=one-identity-login&element=Login&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=one-identity-login&v5=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=one-identity-login&c22=us%3E%3Eone-identity-login%3E%3Eimpression%3E%3ELogin&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U; dtSa=-; _cs_cvars=%7B%224%22%3A%5B%22PageID
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s61969357330276?AQB=1&ndh=1&pf=1&t=21%2F11%2F2023%201%3A22%3A31%204%20-60&mid=04500034833736687162518089606440343901&aamlh=7&ce=UTF-8&pageName=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&g=https%3A%2F%2Fwww.americanexpress.com%2Fen-us%2Faccount%2Flogin%3FDestPage%3Dhttps%253A%252F%252Fglobal.americanexpress.com%252Factivity%253Finav%253Dmenu_myacct_viewstmt&c.&cm.&ssf=1&.cm&omn.&identifier=axp-marketing-offer&element=pzn_ineligible&lob=ser&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=axp-marketing-offer&v5=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3Epzn_ineligible&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=axp-marketing-offer&c22=us%3E%3Eaxp-marketing-offer%3E%3Eimpression%3E%3Epzn_ineligible&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.4-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-Mbox%3ANA-A1-msuite%3Atrue-PD%3A2023-11-01&c56=oneamex%3Adesktop&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7Cen-us%7Caccount%7Clogin&v75=04500034833736687162518089606440343901&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_ecid=MCMID%7C04500034833736687162518089606440343901; axplocale=en-US; _cs_c=1; rxVisitor=170311809883408O7TBHBA404C7EHOMDFA0I24A9L778U; dtSa=-; _c
Source: global traffic	HTTP traffic detected: GET /pageview?pid=3776&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118153&pn=3&dw=1280&dh=1456&ww=1280&wh=907&sw=1280&sh=1024&dr=&url=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fgce%2Fus%2Faction%2Fhome%3F__%2F%3Frequest_type%3Dun_Activation%26Face%3Den_US&uc=1&la=en-US&cvars=%7B%224%22%3A%5B%22PageID%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%2C%226%22%3A%5B%22pageName2%22%2C%22US%7CAMEX%7CSer%7COCE%7CCardInput%22%5D%2C%227%22%3A%5B%22businessUnit%22%2C%22AMEX%22%5D%2C%228%22%3A%5B%22PageIdentifier%22%2C%22US%7CAMEX%7CHome%7CHomepage%22%5D%7D&cvarp=%7B%226%22%3A%5B%22pageName2%22%2C%22US%7CAMEX%7CSer%7COCE%7CCardInput%22%5D%7D&v=13.59.1&pvt=n&ex=&r=855405 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=570825 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=987587 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=504431 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=928230 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dvar?v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OTWvCQBRF%2F8pjVgqSvHEmk0RXQUGLTTd%2BLYzImLzo4DQJSUpbxf%2FeKcjdncvh3gfbdtQmF6p6NmFpfTfWaj%2FwEAZ7UxX1dwcfG%2BDo4RQcUHIKP0oOIWkaS3s6r0zvByL0hILBarlJ30dgzY1gQfmtHsLs2taf5HMeevgfWOtSt%2BalsBFLZ7u3uVtGGSCikJEQoVAqCrkaBzzCKFaopHSNiJE7oTRki5OutP3tTd6dyi9rnf%2FIWNNS6d5TkbHJ4fhkzz%2FOwOC43AAAAA%3D%3D&ct=2&r=232881 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://online.americanexpress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/recording?rt=5&rst=1703118155464&let=1703118156474&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2 HTTP/1.1Host: k-aus1.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_538.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var hostName=window.location.hostname;var randNum=oneTagApi.randNum;oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10091564&ec=CPSC9_ZZ");oneTagApi.pixelTag("https://s.amazon-adsystem.com/iu3?pid=afb12f81-e4ec-483e-8e95-2fc48324fe1c&event=CPSC9_ZZ");oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0")}catch(err){}},744,623447,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=623447",err)}catch(err2){}}})(); equals www.yahoo.com (Yahoo)
Source: chromecache_492.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;oneTagApi.insertIframeForTags();window.addEventListener("hashchange",loadKeplerTags);function loadKeplerTags(){try{if(window.location.href.indexOf("thankyou")>-1){if(typeof window.appconfig!=="undefined"&&window.appconfig.indexOf("Basic")>-1){if(itag_cardtype!=="undefined"&&itag_cardtype.split(":").length>2&&itag_cardtype.split(":")[1].toLowerCase()==="smallbusiness"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg01_zz;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord=1;num=1?");function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]=ZZ&cd[page_description]=BMGM01_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3);oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=bmg01_zzvz")}}}}catch(e){}}}catch(e){}},744,663275,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=663275",err)}catch(err2){}}})(); equals www.facebook.com (Facebook)
Source: chromecache_492.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;oneTagApi.insertIframeForTags();window.addEventListener("hashchange",loadKeplerTags);function loadKeplerTags(){try{if(window.location.href.indexOf("thankyou")>-1){if(typeof window.appconfig!=="undefined"&&window.appconfig.indexOf("Basic")>-1){if(itag_cardtype!=="undefined"&&itag_cardtype.split(":").length>2&&itag_cardtype.split(":")[1].toLowerCase()==="smallbusiness"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg01_zz;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord=1;num=1?");function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]=ZZ&cd[page_description]=BMGM01_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3);oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=bmg01_zzvz")}}}}catch(e){}}}catch(e){}},744,663275,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=663275",err)}catch(err2){}}})(); equals www.yahoo.com (Yahoo)
Source: chromecache_518.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;oneTagApi.insertIframeForTags();window.addEventListener("hashchange",loadKeplerTags);function loadKeplerTags(){try{if(window.location.href.indexOf("thankyou")>-1){if(typeof window.appconfig!=="undefined"&&window.appconfig.indexOf("Basic")>-1){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg00_zz;u3="+window.location.href+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord="+randNum+"?");if(itag_cardtype!=="undefined"&&itag_cardtype.split(":").length>2){function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]="+parent.itag_cardtype.split(":")[1]+"&cd[page_description]=BMGM00_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3)}else{function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]=YY&cd[page_description]=BMGM00_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3)}oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=bmg00_zzvz")}}}catch(e){}}}catch(e){}},744,620948,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=620948",err)}catch(err2){}}})(); equals www.facebook.com (Facebook)
Source: chromecache_518.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;oneTagApi.insertIframeForTags();window.addEventListener("hashchange",loadKeplerTags);function loadKeplerTags(){try{if(window.location.href.indexOf("thankyou")>-1){if(typeof window.appconfig!=="undefined"&&window.appconfig.indexOf("Basic")>-1){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg00_zz;u3="+window.location.href+";dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord="+randNum+"?");if(itag_cardtype!=="undefined"&&itag_cardtype.split(":").length>2){function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]="+parent.itag_cardtype.split(":")[1]+"&cd[page_description]=BMGM00_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3)}else{function tagFunc(){(new Image).src="https://www.facebook.com/tr?id=1087025278065923&ev=Lead&cd[product]=YY&cd[page_description]=BMGM00_ZZ&noscript=1"}setTimeout(function(){oneTagApi.insertScriptIframe(tagFunc)},1e3)}oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=bmg00_zzvz")}}}catch(e){}}}catch(e){}},744,620948,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=620948",err)}catch(err2){}}})(); equals www.yahoo.com (Yahoo)
Source: chromecache_292.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageLoad(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;oneTagApi.pixelTag("https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3fb1%26type%3D55%26m%3D1&ex-fch=416613&ex-src=https://www.americanexpress.com/CPSC9_ZZ&ex-hargs=v%3D1.0%3Bc%3D1900396350101%3Bp%3DF88C4649-8329-B1B7-ECD9-998AC98D3FB1&cb="+randNum);oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/693288085/?label=pvz1CIG7weEBEJX5ysoC&guid=ON&script=0");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=pagevisit&[line_items][0][product_id]='1'&ed[line_items][0][product_name]=CPSC9_ZZ&noscript=1");oneTagApi.facebookiOS("1087025278065923","PageView","ZZ","CPSC9_ZZ","LDU",0,0);oneTagApi.pixelTag("https://www.facebook.com/tr?id=1087025278065923&ev=PageView&cd[product]=ZZ&cd[page_description]=CPSC9_ZZ&dl=https://www.americanexpress.com/&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://jadserve.postrelease.com/conversion?ntv_pixel_id=33f8904872f94ee5972f6da334164241&ntv_pixel_value=[optional_float]&ord="+randNum);oneTagApi.pixelTag("https://alb.reddit.com/rp.gif?id=t2_vjf6aeeo&event=Lead&integration=noscript");if(oneTagApi.hostName("qwww",0)\|\|oneTagApi.ensEnv==="2"){}}catch(e){}},744,622361,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=622361",err)}catch(err2){}}})(); equals www.facebook.com (Facebook)
Source: chromecache_537.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{if(oneTagApi.ensMarket==="en-US"&&window.location.href.indexOf("/offers")>-1){if(window.location.href.indexOf("/offers/eligible")>-1){oneTagApi.pixelTag("https://www.facebook.com/tr?id=1852373738331209&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1")}if(typeof oneTagApi.digitalData!="undefined"&&typeof oneTagApi.digitalData.events!=="undefined"&&oneTagApi.digitalData.events.length>0\|\|oneTagApi.digitalData.events[0].detail!=="undefined"){oneTagApi.pixelTag("https://www.facebook.com/tr?id=172080566779590&ev=PageView&cd[product]="+oneTagApi.digitalData.events[0].detail+"&cd[page_description]=COFF_04&dpo=LDU&dpoco=0&dpost=0&noscript=1")}}}catch(err){}},18341,553800,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=18341 id=553800",err)}catch(err2){}}})(); equals www.facebook.com (Facebook)
Source: chromecache_466.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{if(oneTagApi.ensMarket==="en-US"&&window.location.href.indexOf("/offers")>-1){var randNum=oneTagApi.randNum;if(window.location.href.indexOf("/offers/eligible")>-1){oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/11165032399/?label=uRNeCNef5akYEM-_88sp&guid=ON&script=0");oneTagApi.pixelTag("https://www.facebook.com/tr?id=1852373738331209&ev=PageView&cd[page_description]=BOFF_02&dpo=LDU&dpoco=0&dpost=0&guid=ON&script=0")}if(typeof oneTagApi.offerType!="undefined"&&oneTagApi.offerType!=null&&oneTagApi.offerType!=""&&oneTagApi.offerType==="offer_cta_COUPONLESS_label"){var activeCardType="";if(typeof oneTagApi.digitalData.products!=="undefined"&&oneTagApi.digitalData.products.length===1&&typeof oneTagApi.digitalData.products[0].lineOfBusiness!=="undefined"){if(oneTagApi.digitalData.products[0].lineOfBusiness.toUpperCase()==="CONSUMER")activeCardType="C";else if(oneTagApi.digitalData.products[0].lineOfBusiness.toUpperCase()==="COMPANY_CARD")activeCardType="O"}else if(typeof oneTagApi.digitalData.products!=="undefined"&&oneTagApi.digitalData.products.length>1){for(i=0;i<oneTagApi.digitalData.products.length;i++){if(typeof oneTagApi.digitalData.products[i].selected!=="undefined"&&oneTagApi.digitalData.products[i].selected===true){if(typeof oneTagApi.digitalData.products[i].lineOfBusiness!=="undefined"&&oneTagApi.digitalData.products[i].lineOfBusiness.toUpperCase()==="CONSUMER"){activeCardType="C";break}else if(typeof oneTagApi.digitalData.products[i].lineOfBusiness!=="undefined"&&oneTagApi.digitalData.products[i].lineOfBusiness.toUpperCase()==="COMPANY_CARD"){activeCardType="O";break}}}}if(window.location.href.indexOf("/offers/eligible")>-1&&activeCardType==="O"){if(typeof oneTagApi.digitalData!="undefined"&&typeof oneTagApi.digitalData.events!=="undefined"&&oneTagApi.digitalData.events.length>0\|\|oneTagApi.digitalData.events[0].detail!=="undefined"){oneTagApi.pixelTag("https://www.facebook.com/tr?id=1852373738331209&ev=Lead&cd[product]="+oneTagApi.digitalData.events[0].detail+"&cd[page_description]=OPEN01_ZG&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=OPN01_zgvz");oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=opn01_zg;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord=1;num=1?")}}if(typeof oneTagApi.digitalData!="undefined"&&typeof oneTagApi.digitalData.events!=="undefined"&&oneTagApi.digitalData.events.length>0){if(activeCardType==="C"){oneTagApi.pixelTag("https://www.facebook.com/tr?id=172080566779590&ev=Lead&cd[product]="+oneTagApi.digitalData.events[0].detail+"&cd[page_description]=COFF_01&dpo=LDU&dpoco=0&dpost=0&noscript=1")}}}}}catch(err){}},18341,552997,[])}catch(err){try{window._axpOneTagTagging._hand
Source: chromecache_466.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{if(oneTagApi.ensMarket==="en-US"&&window.location.href.indexOf("/offers")>-1){var randNum=oneTagApi.randNum;if(window.location.href.indexOf("/offers/eligible")>-1){oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/11165032399/?label=uRNeCNef5akYEM-_88sp&guid=ON&script=0");oneTagApi.pixelTag("https://www.facebook.com/tr?id=1852373738331209&ev=PageView&cd[page_description]=BOFF_02&dpo=LDU&dpoco=0&dpost=0&guid=ON&script=0")}if(typeof oneTagApi.offerType!="undefined"&&oneTagApi.offerType!=null&&oneTagApi.offerType!=""&&oneTagApi.offerType==="offer_cta_COUPONLESS_label"){var activeCardType="";if(typeof oneTagApi.digitalData.products!=="undefined"&&oneTagApi.digitalData.products.length===1&&typeof oneTagApi.digitalData.products[0].lineOfBusiness!=="undefined"){if(oneTagApi.digitalData.products[0].lineOfBusiness.toUpperCase()==="CONSUMER")activeCardType="C";else if(oneTagApi.digitalData.products[0].lineOfBusiness.toUpperCase()==="COMPANY_CARD")activeCardType="O"}else if(typeof oneTagApi.digitalData.products!=="undefined"&&oneTagApi.digitalData.products.length>1){for(i=0;i<oneTagApi.digitalData.products.length;i++){if(typeof oneTagApi.digitalData.products[i].selected!=="undefined"&&oneTagApi.digitalData.products[i].selected===true){if(typeof oneTagApi.digitalData.products[i].lineOfBusiness!=="undefined"&&oneTagApi.digitalData.products[i].lineOfBusiness.toUpperCase()==="CONSUMER"){activeCardType="C";break}else if(typeof oneTagApi.digitalData.products[i].lineOfBusiness!=="undefined"&&oneTagApi.digitalData.products[i].lineOfBusiness.toUpperCase()==="COMPANY_CARD"){activeCardType="O";break}}}}if(window.location.href.indexOf("/offers/eligible")>-1&&activeCardType==="O"){if(typeof oneTagApi.digitalData!="undefined"&&typeof oneTagApi.digitalData.events!=="undefined"&&oneTagApi.digitalData.events.length>0\|\|oneTagApi.digitalData.events[0].detail!=="undefined"){oneTagApi.pixelTag("https://www.facebook.com/tr?id=1852373738331209&ev=Lead&cd[product]="+oneTagApi.digitalData.events[0].detail+"&cd[page_description]=OPEN01_ZG&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10084318&ec=OPN01_zgvz");oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=opn01_zg;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord=1;num=1?")}}if(typeof oneTagApi.digitalData!="undefined"&&typeof oneTagApi.digitalData.events!=="undefined"&&oneTagApi.digitalData.events.length>0){if(activeCardType==="C"){oneTagApi.pixelTag("https://www.facebook.com/tr?id=172080566779590&ev=Lead&cd[product]="+oneTagApi.digitalData.events[0].detail+"&cd[page_description]=COFF_01&dpo=LDU&dpoco=0&dpost=0&noscript=1")}}}}}catch(err){}},18341,552997,[])}catch(err){try{window._axpOneTagTagging._hand
Source: chromecache_565.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://secure.adnxs.com/px?id=1074652&seg=17009710&redir=https%3A%2F%2Fpixel.mediaiqdigital.com%2Fpixel%3Fu3%3D%26u4%3D%26pixel_id%3D1074652%26uid%3D%24%7BUID%7D&t=2cb="+oneTagApi.randNum)}catch(e){}},744,583235,[])}catch(err){try{window._axpOneTagTagging._handleError("script type=tag groupId=744 id=583235",err)}catch(err2){}}})(); equals www.facebook.com (Facebook)
Source: chromecache_345.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;if(oneTagApi.pathname.indexOf("/en-us/account/login")>-1){if(decodeURIComponent(window.location.search).indexOf("global.americanexpress.com/offers/group/Cd-QYfCjcP93Hy-DOI9ONw==&v2&intlink=us-GABM-SS_Summer_2021_Offer_Hub_v2")>-1){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=amex-0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord="+randNum+"?");oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/362245837/?label=sN86CMrXpcMCEM3d3awB&guid=ON&script=0");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&noscript=1&dpo=LDU&dpoco=0&dpost=0");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=pagevisit&noscript=1");oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10154309")}}if(oneTagApi.pageName.toLowerCase()==="login"){if(decodeURIComponent(window.location.search).indexOf("global.americanexpress.com/offers/group/VZ4fEDnJIh2e-CH9PDgkyg==&v2")>-1){if(decodeURIComponent(window.location.href).split("intlink=")[1]!==undefined&&decodeURIComponent(window.location.href).split("intlink=")[1]==="us-GABM-MYCA_Enroll"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=sscus0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randNum+"");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&cd[page_description]=MYCALogInButton&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://insight.adsrvr.org/track/pxl/?adv=82s26dk&ct=0:yiyl2aj&fmt=3");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=Checkout&noscript=1")}else{oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=shops000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randNum+"?");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&cd[page_description]=SS2Enrollment&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/764355495/?label=uFYZCObKitQBEKfHvOwC&guid=ON&script=0&npa=1");oneTagApi.pixelTag("https://insight.adsrvr.org/track/pxl/?adv=82s26dk&ct=0:he04dbe&fmt=3");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=Signup&noscript=1")}}else if(decodeURIComponent(window.location.search).indexOf("/offers/63lCxLrIN-cAMFChT743nA==&v2")>-1){if(decodeURIComponent(window.location.href).split("intlink=")[1]!==undefined&&decodeURIComponent(window.location.href).split("intlink=")[1]==="us-GABM-MYCA_Enroll"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=shops009;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randN
Source: chromecache_345.2.dr	String found in binary or memory: (function(){try{window._axpOneTagTagging._runTagAfterPageParse(function(){var oneTagApi=window["oneTagApi"];var oneTagOptions=oneTagApi.oneTagOptions;try{var randNum=oneTagApi.randNum;if(oneTagApi.pathname.indexOf("/en-us/account/login")>-1){if(decodeURIComponent(window.location.search).indexOf("global.americanexpress.com/offers/group/Cd-QYfCjcP93Hy-DOI9ONw==&v2&intlink=us-GABM-SS_Summer_2021_Offer_Hub_v2")>-1){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=amex-0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord="+randNum+"?");oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/362245837/?label=sN86CMrXpcMCEM3d3awB&guid=ON&script=0");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&noscript=1&dpo=LDU&dpoco=0&dpost=0");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=pagevisit&noscript=1");oneTagApi.pixelTag("https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10154309")}}if(oneTagApi.pageName.toLowerCase()==="login"){if(decodeURIComponent(window.location.search).indexOf("global.americanexpress.com/offers/group/VZ4fEDnJIh2e-CH9PDgkyg==&v2")>-1){if(decodeURIComponent(window.location.href).split("intlink=")[1]!==undefined&&decodeURIComponent(window.location.href).split("intlink=")[1]==="us-GABM-MYCA_Enroll"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=sscus0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randNum+"");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&cd[page_description]=MYCALogInButton&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://insight.adsrvr.org/track/pxl/?adv=82s26dk&ct=0:yiyl2aj&fmt=3");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=Checkout&noscript=1")}else{oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=shops000;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randNum+"?");oneTagApi.pixelTag("https://www.facebook.com/tr?id=333619020577900&ev=PageView&cd[page_description]=SS2Enrollment&dpo=LDU&dpoco=0&dpost=0&noscript=1");oneTagApi.pixelTag("https://www.googleadservices.com/pagead/conversion/764355495/?label=uFYZCObKitQBEKfHvOwC&guid=ON&script=0&npa=1");oneTagApi.pixelTag("https://insight.adsrvr.org/track/pxl/?adv=82s26dk&ct=0:he04dbe&fmt=3");oneTagApi.pixelTag("https://ct.pinterest.com/v3/?tid=2613808224364&event=Signup&noscript=1")}}else if(decodeURIComponent(window.location.search).indexOf("/offers/63lCxLrIN-cAMFChT743nA==&v2")>-1){if(decodeURIComponent(window.location.href).split("intlink=")[1]!==undefined&&decodeURIComponent(window.location.href).split("intlink=")[1]==="us-GABM-MYCA_Enroll"){oneTagApi.pixelTag("https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=shops009;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord="+randN

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Dec 2023 00:21:45 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 42Connection: close

Source: chromecache_405.2.dr	String found in binary or memory: http://angular-ui.github.com/
Source: chromecache_446.2.dr, chromecache_377.2.dr, chromecache_343.2.dr, chromecache_420.2.dr	String found in binary or memory: http://angularjs.org
Source: chromecache_549.2.dr	String found in binary or memory: http://blog.igorescobar.com
Source: chromecache_510.2.dr	String found in binary or memory: http://code.google.com/p/episodes/
Source: chromecache_420.2.dr	String found in binary or memory: http://errors.angularjs.org/1.4.7/
Source: chromecache_578.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_496.2.dr	String found in binary or memory: http://github.com/angular-translate/angular-translate
Source: chromecache_509.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_510.2.dr, chromecache_363.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_591.2.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_325.2.dr	String found in binary or memory: http://www.census.gov
Source: chromecache_325.2.dr	String found in binary or memory: http://www.census.gov/geo/www/gazetteer/gazetteer2010.html
Source: chromecache_405.2.dr	String found in binary or memory: http://www.opensource.org/licenses/MIT
Source: chromecache_549.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_454.2.dr, chromecache_406.2.dr	String found in binary or memory: http://www.vietcomic.comVNI-Thufap2
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://accounts-dev.americanexpress.com/en-us/banking/personal/savings/register
Source: chromecache_501.2.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=189445;type=dines0;cat=amex-000;dc_lat=;dc_rdid=;tag_for
Source: chromecache_501.2.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=189445;type=dines0;cat=amex-00;dc_lat=;dc_rdid=;tag_for_
Source: chromecache_345.2.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=amex-0;dc_lat=;dc_rdid=;tag_for_c
Source: chromecache_518.2.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg00_zz;u3=
Source: chromecache_492.2.dr	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg01_zz;dc_lat=;dc_rdid=;tag_for_c
Source: chromecache_577.2.dr	String found in binary or memory: https://aeopprodvip.acxiom.com/services/v2clickStream
Source: chromecache_322.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
Source: chromecache_322.2.dr	String found in binary or memory: https://americanexpress.com/en-us/referral?id=201279&intlink=US-MGM-Inav&inav=footer_refer_f
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/card.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/card1.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/data.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail1.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail2.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail3.php
Source: chromecache_322.2.dr	String found in binary or memory: https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/personal.php
Source: chromecache_448.2.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/EX01cd838bfde94471b401c17d31e9c9d
Source: chromecache_399.2.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RC2fe7cb53f58440dab389607b3959dfb
Source: chromecache_383.2.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RCba6f9cee3abe426fa326391960ab44a
Source: chromecache_455.2.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RCcdce0ecea7264d3f84bc54527bbc8c7
Source: chromecache_381.2.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/launch-bd8521c0d687.js
Source: chromecache_463.2.dr	String found in binary or memory: https://bdaas-staging-dev.americanexpress.com/api/servicing/v2/prefetch
Source: chromecache_463.2.dr	String found in binary or memory: https://bdaas-staging-qa.americanexpress.com/api/servicing/v2/prefetch
Source: chromecache_463.2.dr	String found in binary or memory: https://bdaas.americanexpress.com/api/servicing/v2/prefetch
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://card-member-1-dev.americanexpress.com
Source: chromecache_326.2.dr	String found in binary or memory: https://cdaas-dev.americanexpress.com/akamai/one/axp-script-supplier/6.0.0/script-supplier.js
Source: chromecache_576.2.dr, chromecache_320.2.dr, chromecache_504.2.dr	String found in binary or memory: https://cdaas-dev.americanexpress.com/one/axp-script-supplier/5.1.5/script-supplier.js
Source: chromecache_463.2.dr	String found in binary or memory: https://cdaas-test.americanexpress.com/cdaas/myca/flash-flood/lib/flash-flood.html
Source: chromecache_463.2.dr	String found in binary or memory: https://cdaas.americanexpress.com/cdaas/myca/flash-flood/lib/flash-flood.html
Source: chromecache_322.2.dr	String found in binary or memory: https://cdaas.americanexpress.com/myca/oce/latest/content/css/oce-min.css
Source: chromecache_322.2.dr	String found in binary or memory: https://cdaas.americanexpress.com/myca/oce/latest/content/images/common/cid-double.png
Source: chromecache_322.2.dr	String found in binary or memory: https://cdaas.americanexpress.com/myca/oce/latest/content/images/common/cm15-double-card.png
Source: chromecache_322.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://commercial-recon.americanexpress.com/en-us/business/commercial/reconciliation/registration
Source: chromecache_292.2.dr	String found in binary or memory: https://ct.pinterest.com/v3/?tid=2613808224364&event=pagevisit&
Source: chromecache_365.2.dr	String found in binary or memory: https://dynatracepsg.americanexpress.com/bf/8264482b-dee3-4f6d-be79-c4d3fee1d8c7
Source: chromecache_365.2.dr	String found in binary or memory: https://dynatracepsg.americanexpress.com:443/jstag/managed/ruxitagent_A27NVfhjqrux_10261230220152234
Source: chromecache_569.2.dr	String found in binary or memory: https://github.com/facebook/regenerator/blob/main/LICENSE
Source: chromecache_555.2.dr	String found in binary or memory: https://github.com/google/safevalues/issues
Source: chromecache_541.2.dr, chromecache_509.2.dr	String found in binary or memory: https://github.com/hgoebl/mobile-detect.js
Source: chromecache_541.2.dr	String found in binary or memory: https://github.com/hodgef)
Source: chromecache_541.2.dr	String found in binary or memory: https://github.com/hodgef/simple-keyboard
Source: chromecache_311.2.dr, chromecache_334.2.dr, chromecache_541.2.dr, chromecache_435.2.dr, chromecache_513.2.dr, chromecache_318.2.dr, chromecache_509.2.dr, chromecache_519.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_549.2.dr	String found in binary or memory: https://github.com/umdjs/umd/blob/master/jqueryPluginCommonjs.js
Source: chromecache_311.2.dr, chromecache_541.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_311.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.21.0/LICENSE
Source: chromecache_541.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.30.0/LICENSE
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://global.americanexpress.com/card-benefits/view-all/business-centurion
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://global.americanexpress.com/card-benefits/view-all/centurion
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://global.americanexpress.com/card-benefits/view-all/corporate-centurion
Source: chromecache_322.2.dr	String found in binary or memory: https://global.americanexpress.com/dashboard
Source: chromecache_322.2.dr	String found in binary or memory: https://global.americanexpress.com/login/en-US?DestPage=https%3A%2F%2Ffreecreditscore.americanexpres
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/category/cardarts/card-fil
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/category/cardarts/gold-car
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/category/cardarts/green-ca
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/category/cardarts/platinum
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/open/category/cardarts/del
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/open/category/cardarts/gol
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/Acquisition/US_en/AppContent/OneSite/open/category/cardarts/pla
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://icm.aexp-static.com/Internet/gimo/us/
Source: chromecache_322.2.dr	String found in binary or memory: https://icm.aexp-static.com/content/dam/chat/prod/lechat/css/chatFrame.css?70
Source: chromecache_568.2.dr	String found in binary or memory: https://icm.aexp-static.com/content/dam/chat/prod/lechat/img/chat-icon-close.svg)
Source: chromecache_568.2.dr	String found in binary or memory: https://icm.aexp-static.com/content/dam/chat/prod/lechat/img/chat-icon-min.svg)
Source: chromecache_568.2.dr	String found in binary or memory: https://icm.aexp-static.com/content/dam/chat/prod/lechat/img/grab.cur)
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://inter-pdgemapp.aexp.com/Internet/gimo/us/
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://itunes.apple.com/us/app/amex-mobile/id362348516?mt=8&uo=4&at=10lRm8&ct=DEWebVariant1OCEAppTe
Source: chromecache_418.2.dr	String found in binary or memory: https://iwmapapi.americanexpress.com/beacon
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US
Source: chromecache_327.2.dr	String found in binary or memory: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US
Source: chromecache_322.2.dr	String found in binary or memory: https://online.americanexpress.com/myca/oce
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=AUTOPYTHK2&prodCode=AUTOPY
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=BCASC1THK2&prodCode=BCASC1
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=CPAGTHK2&prodCode=CPAG
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=CPAPTHK2&prodCode=CPAP
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=CPPPTHK2&prodCode=CPPP
Source: chromecache_602.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=ECLPTHK2&prodCode=ECLP
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=ICAPTHK2&prodCode=ICAP
Source: chromecache_602.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=OIL1THK2&prodCode=OIL1
Source: chromecache_400.2.dr	String found in binary or memory: https://online.americanexpress.com/offerservice/offerconversion.do?pageId=PPRLESSTHK2&prodCode=PPRLE
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://origin-pqgemapp.americanexpress.com/Internet/gimo/us/
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://origin-slgemapp.americanexpress.com/Internet/gimo/us/
Source: chromecache_444.2.dr, chromecache_356.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/bg/%
Source: chromecache_363.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&bin=7&v=
Source: chromecache_363.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&name=invalid_geo&context=10
Source: chromecache_363.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=extra&rnd=
Source: chromecache_356.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224
Source: chromecache_444.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225
Source: chromecache_307.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/ping
Source: chromecache_499.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?
Source: chromecache_356.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224
Source: chromecache_444.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.americanexpress.android.acctsvcs.us&referrer=utm_s
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://qicm.aexp-static.com
Source: chromecache_576.2.dr, chromecache_320.2.dr, chromecache_504.2.dr	String found in binary or memory: https://qwww.aexp-static.com/cdaas/one/axp-script-supplier/5.1.5/script-supplier.js
Source: chromecache_326.2.dr	String found in binary or memory: https://qwww.aexp-static.com/cdaas/one/axp-script-supplier/6.0.0/script-supplier.js
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://qwww.americanexpress.com
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://qwww.americanexpress.com/en-us/banking/personal/savings/register
Source: chromecache_334.2.dr, chromecache_397.2.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_322.2.dr, chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://rewards.americanexpress.com/myca/loyalty/us/rewards/redirect/secureredirect?request_type=aut
Source: chromecache_538.2.dr	String found in binary or memory: https://s.amazon-adsystem.com/iu3?pid=afb12f81-e4ec-483e-8e95-2fc48324fe1c&event=CPSC9_ZZ
Source: chromecache_292.2.dr	String found in binary or memory: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3
Source: chromecache_307.2.dr, chromecache_555.2.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/pagead/js/car.js
Source: chromecache_538.2.dr	String found in binary or memory: https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10091564&ec=CPSC9_ZZ
Source: chromecache_322.2.dr	String found in binary or memory: https://sso.americanexpress.com/SPS/auth/push?ssolang=en_US&ssobrand=CONCORD&TARGET=https%3A
Source: chromecache_327.2.dr	String found in binary or memory: https://sso.americanexpress.com/SPS/logon
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://sso.americanexpress.com/SPS/logon?spsversion=v2&ssolang=en_US&ssobrand=SSOAPP&TYPE=33554432&
Source: chromecache_322.2.dr	String found in binary or memory: https://static.wixstatic.com/media/369c26_b396f2977e5a40839e2fc77a6f9aac2b~mv2.gif
Source: chromecache_444.2.dr	String found in binary or memory: https://tpc.googlesyndication.com
Source: chromecache_322.2.dr	String found in binary or memory: https://tpc.googlesyndication.com/simgad/9541835932495510364
Source: chromecache_444.2.dr	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Source: chromecache_569.2.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/consent/ext/record/
Source: chromecache_569.2.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/consent/management/
Source: chromecache_569.2.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/v1/geo_location/check
Source: chromecache_284.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/ensighten/gatekeeper/gtkp_aa.js
Source: chromecache_476.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/gct/1.0.0/gct_intl.js?gct=gctintlver
Source: chromecache_477.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/ngamu/1.0.0/ngamu.js?ngamu=ngamu
Source: chromecache_416.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/omniture/launch/1.4.4/dcb19cbd6cbf/b4385da1798a/74e098123
Source: chromecache_424.2.dr, chromecache_456.2.dr, chromecache_523.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/omniture/launch/1.4.4/launch-b363d6c28b7c.min.js
Source: chromecache_550.2.dr, chromecache_505.2.dr, chromecache_344.2.dr, chromecache_482.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/dxt-vendor-shared-scripts/contentsquare/1.0.16/contentsquare.js
Source: chromecache_469.2.dr, chromecache_447.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/dxt-vendor-shared-scripts/dynatrace/1.0.1/dynatrace.js
Source: chromecache_319.2.dr, chromecache_493.2.dr, chromecache_451.2.dr, chromecache_558.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one-tag/tagging/entrypoints/v1.6.0/entrypoint-15983.js
Source: chromecache_524.2.dr, chromecache_330.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/axp-chat-bootstrap/1.4.5/chatTaggingBootStrap.js
Source: chromecache_576.2.dr, chromecache_320.2.dr, chromecache_504.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/axp-script-supplier/5.1.5/script-supplier.js
Source: chromecache_326.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/axp-script-supplier/6.0.0/script-supplier.js
Source: chromecache_572.2.dr, chromecache_586.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/dxt-script-supplier-helper/1.0.6/dxt-script-supplier-helper.js
Source: chromecache_589.2.dr, chromecache_548.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/global-campaign-sdk/1.2.5/global-campaign-sdk.js
Source: chromecache_375.2.dr, chromecache_458.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/one-identity-session/1.35.0/timeout.js
Source: chromecache_402.2.dr, chromecache_280.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/one-stream-data-handler/0.1.2/oneStream.js
Source: chromecache_570.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/qualtrics/1.34.0/
Source: chromecache_603.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/qualtrics/1.71.0/
Source: chromecache_595.2.dr, chromecache_546.2.dr, chromecache_385.2.dr, chromecache_536.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/qualtrics/1.71.0/qualtricsIntercept.js
Source: chromecache_322.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/styles/dls.min.css
Source: chromecache_328.2.dr, chromecache_584.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/trackit/1.9.2/trackit.js
Source: chromecache_295.2.dr, chromecache_419.2.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/user-consent-management/ucm/v1.10.8/UCM.js
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.aexp-static.com/online/myca/shared/summary/cardasset/images/NUS000000019_480x304_STRAIGH
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.aexp-static.com/online/myca/shared/summary/cardasset/images/NUS000000322_480x304_STRAIGH
Source: chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/akam/13/pixel_5fd10acd?a=dD05ODRiYTUzN2Y0YzYwNDc1MTNlYmQwNGEzZDg1OTB
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/be/fr/legal/politique-cookie.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/be/nl/legal/cookiebeleid.html?showoverlay=false
Source: chromecache_334.2.dr	String found in binary or memory: https://www.americanexpress.com/content/dam/amex/en-us/homepage/banners/pzn_generic_offer_banner.jpg
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/content/dam/amex/us/company/Privacy/California_Privacy_Notice.pdf
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/cz-cz/spolecnost/pravni/centrum-ochrany-osobnich-udaju/o-souborech-c
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/da-dk/selskab/legal/privatlivspolitik/angaende-cookies?showoverlay=f
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/de-at/firma/legal/datenschutz-center/cookie-informationen?showoverla
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/en-ca/company/legal/privacy-centre/about-cookies/?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/en-ca/company/legal/privacy-centre/privacy-statement/?showoverlay=fa
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/login?DestPage=https%3A%2F%2Fglobal.americanexpress.co
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/password/recover?inav=menu_myacct_forgot_user_id
Source: chromecache_322.2.dr, chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/at-work/
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/banking/personal/savings/register
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/benefits/creditsecure/?inav=menu_myacct_creditsecure
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/business/blueprint/account/api/bounce/login-with-amex?refid=am
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/business/merchant/dashboard
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/business/merchant/registration
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/business/payments/vendor-pay/?intlink=us-ser-2222ENF2
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/credit-cards/credit-intel/?inav=footer_financial_ed
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/en-us/credit-cards/credit-intel/?inav=menu_cards_pc_credit_intel_cre
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/es/legal/informacion-sobre-los-cookies.html?showoverlay=false
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/favicon.ico
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/fi/legal/yksityisyys/cookies/index.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/fr-ca/societes/legale/centre-de-confidentialite/a-propos-des-cookies
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/fr-ca/societes/legale/centre-de-confidentialite/declaration-de-confi
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/fr/legal/about-cookies.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/germany/legal/about_cookies.shtml?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/hu-hu/ceg/jogi/adatvedelem/a-sutikrol/index.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/icc/cookies.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/italy/legal/about_cookies.shtml?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/nl/about-cookies.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/no/legal/personvern/cookies/index.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/pl-pl/firma/prawny/centrum-prywatnosci/o-ciasteczkach/?showoverlay=f
Source: chromecache_401.2.dr, chromecache_587.2.dr	String found in binary or memory: https://www.americanexpress.com/register
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/se/legal/sekretess/cookies/index.html?showoverlay=false
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/uk/legal/about-cookies.shtml?showoverlay=false
Source: chromecache_312.2.dr, chromecache_327.2.dr	String found in binary or memory: https://www.americanexpress.com/us/content/fraud-protection-center/home.html?linknav=us-homepage-sec
Source: chromecache_401.2.dr, chromecache_587.2.dr	String found in binary or memory: https://www.americanexpress.com/us/content/legal-disclosures/online-privacy-statement.html
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/us/content/mobile?extlink=web-us-mobile-Variant1-OCEAppTest&intlink=
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/?inav=menu_cards_pc_viewallcards
Source: chromecache_334.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/?intlink=us-en-hp-pznofferbanner-personal-personalca
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/category/cash-back/?inav=menu_cards_pc_cashbackcards
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/category/no-annual-fee/?inav=menu_cards_pc_noannual_
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/category/travel-rewards/?inav=menu_cards_pc_travelre
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/features-benefits/free-credit-score/score-goals/?ina
Source: chromecache_601.2.dr, chromecache_431.2.dr, chromecache_471.2.dr, chromecache_433.2.dr	String found in binary or memory: https://www.americanexpress.com/us/credit-cards/gcpadvantage/offer/?eep=36014&channel=oce&intlink=us
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/merchant/accept-the-card.html?inav=footer_accept_amex
Source: chromecache_569.2.dr	String found in binary or memory: https://www.americanexpress.com/us/privacy-center/
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/rewards/membership-rewards/usepoints/?inav=us_menu_rewards_benefi
Source: chromecache_322.2.dr	String found in binary or memory: https://www.americanexpress.com/us/security-center/?inav=menu_myacct_security_center
Source: chromecache_322.2.dr	String found in binary or memory: https://www.bluebird.com/?solid=iNavMyAccountbb&inav=menu_myacct_bluebird&intlink=us-amex-pr
Source: chromecache_322.2.dr	String found in binary or memory: https://www.bluebird.com/prepaidaccount?intlink=us-amex-prepaid-bluebird-inav_menu_myacct&SOLID=
Source: chromecache_296.2.dr, chromecache_365.2.dr, chromecache_427.2.dr	String found in binary or memory: https://www.dynatrace.com/company/trust-center/customers/reports/
Source: chromecache_444.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_444.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/aframe
Source: chromecache_466.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/11165032399/?label=uRNeCNef5akYEM-_88sp&guid=ON&s
Source: chromecache_538.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&scr
Source: chromecache_345.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/362245837/?label=sN86CMrXpcMCEM3d3awB&guid=ON&scr
Source: chromecache_292.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/693288085/?label=pvz1CIG7weEBEJX5ysoC&guid=ON&scr
Source: chromecache_462.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&scri
Source: chromecache_363.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/managed/js/activeview/
Source: chromecache_401.2.dr, chromecache_587.2.dr	String found in binary or memory: https://www.schwab.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50409
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50372
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50382
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50381
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50398
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 50381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 50393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50410
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50428
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50422
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50433
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:50193 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_3804_1421453776

Jump to behavior

Source: classification engine

Classification label: mal64.phis.win@27/328@210/44

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2024,i,12957562014909011986,829188280163330352,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2024,i,12957562014909011986,829188280163330352,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	100%	Avira URL Cloud	phishing
https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	16%	Virustotal		Browse
https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Link
spdc-global.pbp.gysm.yahoodns.net	0%	Virustotal	Browse
c.bf.contentsquare.net	NaN%	Virustotal	Browse
browndoguniversity.com	3%	Virustotal	Browse
k.bf.contentsquare.net	NaN%	Virustotal	Browse
srm.bf.contentsquare.net	0%	Virustotal	Browse
q-aus1.contentsquare.net	0%	Virustotal	Browse
prod.pinterest.global.map.fastly.net	0%	Virustotal	Browse
americanexpress.com.ssl.d2.sc.omtrdc.net	0%	Virustotal	Browse
reddit.map.fastly.net	0%	Virustotal	Browse
ct.contentsquare.net	0%	Virustotal	Browse
c.contentsquare.net	0%	Virustotal	Browse
k-aus1.contentsquare.net	0%	Virustotal	Browse
www.cdn-path.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.broofa.com	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
https://srm.bf.contentsquare.net/exist	0%	Avira URL Cloud	safe
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/26/uxa.js	0%	Avira URL Cloud	safe
http://www.vietcomic.comVNI-Thufap2	0%	Avira URL Cloud	safe
http://blog.igorescobar.com	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://blog.igorescobar.com	0%	Virustotal		Browse
https://srm.bf.contentsquare.net/exist	0%	Virustotal		Browse
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=504431	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118155464&let=1703118156474&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=786401	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	0%	Avira URL Cloud	safe
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OywqCQBRAf%2BUyKwUZR3xBrqRFgdkmw0WGTHqnBidH1Ogh%2FnsGcXYHDpyJHAfs4yu2I1mRVH%2BkUtz2KQMjl22tnwPsM3AYZREsIvAieAWeCXHXKczxksjR9t2QugEYyTZLdxYo2SBssGq0Cetbr%2B9oO05I2Q84cMF7%2BU%2BIRYREVZe85eo9ymooxUOpZWQqSNejWGawLsjqdJ7J%2FAWA4irlqwAAAA%3D%3D&ct=2&r=627998	0%	Avira URL Cloud	safe
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/pcc.js	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118107003&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=4&ct=0	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	1%	Virustotal		Browse
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail3.php	0%	Avira URL Cloud	safe
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/wr.js	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=987587	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2o8cjPTQUTBYnpqQDpNhkOFQAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=404778	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118125443&let=1703118125557&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=528574	0%	Avira URL Cloud	safe
https://www.cdn-path.com/cc.js?&sid=ee490b8fb9a4d570&tid=LOGIN-92894ccf-5ab7-4c17-ac9c-70221aa451ab&namespace=inauth	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118106994&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=3&ct=0	0%	Avira URL Cloud	safe
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail3.php	0%	Virustotal		Browse
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/data.php	0%	Avira URL Cloud	safe
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tWSi72TSxJzsjMS%2FdOrVSyUjLQMzMzMzcyMjA2MjMzNbY0MYs3NDcwNjS0MDQwMzc2UKoFAJesBHI0AAAA&ct=2&r=732369	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118125443&let=1703118125557&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=2&ct=0	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118107572&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=5&ct=0	0%	Avira URL Cloud	safe
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail2.php	0%	Avira URL Cloud	safe
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/data.php	0%	Virustotal		Browse
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwvydawJDbZy9HWNsPLIz021s%2FPMLShKLS7OzM%2Bzy0gtytctLdZNzdPNKNAF85JLEnUTc3J0C3ISSzLyczJTEivB4oaGhqZGBkbGuonFBUDlmXmpOZnpmUk5qbp5%2BbpBmckZ8f5paalFAGSN5zBvAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=346725	0%	Avira URL Cloud	safe
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/uxa.js	0%	Avira URL Cloud	safe
https://c.contentsquare.net/api-errors?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ct=0	0%	Avira URL Cloud	safe
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail2.php	0%	Virustotal		Browse
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2o8cjPTQUTBYnpqQAddx1wGwAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=084362	0%	Avira URL Cloud	safe
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8o10dnRJzc1XslJysc3PzcutTE5MAfFrAVNGGXkcAAAA&ct=2&r=336319	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118111682&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=7&ct=0	0%	Avira URL Cloud	safe
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8nUO83RRslIyMDE1MDAwNrEwNjY3NjOzMDc0MzI1tDCwsDQzMDMxAcoYWxoYKtUCAGeTvhIyAAAA&ct=2&r=288219	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=765347	0%	Avira URL Cloud	safe
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OTWvCQBRF%2F8pjVgqSvHEmk0RXQUGLTTd%2BLYzImLzo4DQJSUpbxf%2FeKcjdncvh3gfbdtQmF6p6NmFpfTfWaj%2FwEAZ7UxX1dwcfG%2BDo4RQcUHIKP0oOIWkaS3s6r0zvByL0hILBarlJ30dgzY1gQfmtHsLs2taf5HMeevgfWOtSt%2BalsBFLZ7u3uVtGGSCikJEQoVAqCrkaBzzCKFaopHSNiJE7oTRki5OutP3tTd6dyi9rnf%2FIWNNS6d5TkbHJ4fhkzz%2FOwOC43AAAAA%3D%3D&ct=2&r=232881	0%	Avira URL Cloud	safe
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/ptc.js	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118104059&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=680500	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=928230	0%	Avira URL Cloud	safe
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118104059&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=2&ct=0	0%	Avira URL Cloud	safe
https://c.contentsquare.net/v2/events?v=13.59.1&pn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118103&pid=3776&sr=34&mdh=2644&str=205&di=2844&dc=16625&fl=16641&ct=0	0%	Avira URL Cloud	safe
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=570825	0%	Avira URL Cloud	safe
https://c.contentsquare.net/v2/events?v=13.59.1&pn=2&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118124&pid=3776&str=844&di=6279&dc=6864&fl=6865&sr=58&mdh=1576&ct=0	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d2pz9khpjpljz2.cloudfront.net	18.64.174.63	true	false		high
www.googletagservices.com	142.250.189.130	true	false		high
adservice.google.com	142.251.35.226	true	false		high
browndoguniversity.com	199.204.248.118	true	false	3%, Virustotal, Browse	unknown
spdc-global.pbp.gysm.yahoodns.net	76.13.32.146	true	false	0%, Virustotal, Browse	unknown
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	44.205.152.91	true	false		high
cdnjs.cloudflare.com	104.17.25.14	true	false		high
www.google.com	142.250.217.228	true	false		high
d5b3uu8blbxud.cloudfront.net	99.84.252.78	true	false		high
star-mini.c10r.facebook.com	157.240.14.35	true	false		high
c.bf.contentsquare.net	54.84.87.164	true	false	NaN%, Virustotal, Browse	unknown
pagead-googlehosted.l.google.com	172.217.15.193	true	false		high
accounts.google.com	172.217.15.205	true	false		high
securepubads46.g.doubleclick.net	142.250.189.130	true	false		high
ad.doubleclick.net	142.250.64.230	true	false		high
aeopprodvip.acxiom.com	198.160.127.57	true	false		high
s.amazon-adsystem.com	52.46.151.131	true	false		high
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	34.212.247.228	true	false		high
k.bf.contentsquare.net	34.233.187.243	true	false	NaN%, Virustotal, Browse	unknown
q-aus1.contentsquare.net	34.192.149.136	true	false	0%, Virustotal, Browse	unknown
srm.bf.contentsquare.net	44.199.136.121	true	false	0%, Virustotal, Browse	unknown
prod.pinterest.global.map.fastly.net	151.101.0.84	true	false	0%, Virustotal, Browse	unknown
googleads.g.doubleclick.net	142.250.217.162	true	false		high
reddit.map.fastly.net	151.101.1.140	true	false	0%, Virustotal, Browse	unknown
d1cq301dpr7fww.cloudfront.net	13.35.116.31	true	false		high
stun.cdn-net.com	35.174.126.198	true	false		high
clients.l.google.com	142.250.189.142	true	false		high
americanexpress.com.ssl.d2.sc.omtrdc.net	63.140.38.163	true	false	0%, Virustotal, Browse	unknown
ib.anycast.adnxs.com	68.67.160.24	true	false		high
d1xbuscas8tetl.cloudfront.net	18.64.174.32	true	false		high
pixel.mediaiqdigital.com	107.21.13.4	true	false		high
alb.reddit.com	unknown	unknown	false		high
securepubads.g.doubleclick.net	unknown	unknown	false		high
siteintercept.qualtrics.com	unknown	unknown	false		high
secure.adnxs.com	unknown	unknown	false		high
cdaas.americanexpress.com	unknown	unknown	false		high
nexus.ensighten.com	unknown	unknown	false		high
origin-navigation-latest.americanexpress.com	unknown	unknown	false		high
jadserve.postrelease.com	unknown	unknown	false		high
clients2.google.com	unknown	unknown	false		high
bdaas-payments.americanexpress.com	unknown	unknown	false		high
global.americanexpress.com	unknown	unknown	false		high
aexp.demdex.net	unknown	unknown	false		high
assets.adobedtm.com	unknown	unknown	false		high
www.americanexpress.com	unknown	unknown	false		high
dynatracepsg.americanexpress.com	unknown	unknown	false		high
iwmapapi.americanexpress.com	unknown	unknown	false		high
ct.contentsquare.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
apigateway.americanexpress.com	unknown	unknown	false		high
c.contentsquare.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
sp.analytics.yahoo.com	unknown	unknown	false		high
gct.americanexpress.com	unknown	unknown	false		high
w3-reporting-nel.reddit.com	unknown	unknown	false		high
ds-aksb-a.akamaihd.net	unknown	unknown	false		high
ajax.aspnetcdn.com	unknown	unknown	false		high
ct.pinterest.com	unknown	unknown	false		high
omns.americanexpress.com	unknown	unknown	false		high
k-aus1.contentsquare.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
functions.americanexpress.com	unknown	unknown	false		high
pt.ispot.tv	unknown	unknown	false		high
one-release.americanexpress.com	unknown	unknown	false		high
online.americanexpress.com	unknown	unknown	false		high
icm.aexp-static.com	unknown	unknown	false		high
dpm.demdex.net	unknown	unknown	false		high
bdaas.americanexpress.com	unknown	unknown	false		high
www.cdn-path.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
aug.americanexpress.com	unknown	unknown	false		high
pirecommendation.americanexpress.com	unknown	unknown	false		high
www.facebook.com	unknown	unknown	false		high
static.wixstatic.com	unknown	unknown	false		high
one-functions-staging.americanexpress.com	unknown	unknown	false		high
functions.aexp.com	unknown	unknown	false		high
apigw.americanexpress.com	unknown	unknown	false		high
iwmap.americanexpress.com	unknown	unknown	false		high
one-xp.americanexpress.com	unknown	unknown	false		high
lptag.liveperson.net	unknown	unknown	false		high
www.aexp-static.com	unknown	unknown	false		high
one.americanexpress.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://srm.bf.contentsquare.net/exist	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0&ct_cookie_present=false&ocp_id=G4WDZdPRK_PLqMwPhvuK-AY&random=372128220&sscte=1&crd=IgEBQAE&pscrd=CLb8-ZuDpZbmvgEiEwiTy8iuoZ-DAxXzJYoDHYa9Am8	false		high
https://ad.doubleclick.net/ddm/activity/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1?	false		high
https://alb.reddit.com/rp.gif?id=t2_vjf6aeeo&event=Lead&integration=noscript	false		high
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/26/uxa.js	false	Avira URL Cloud: safe	unknown
https://w3-reporting-nel.reddit.com/reports	false		high
about:blank	false	Avira URL Cloud: safe	low
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw	false		high
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118155464&let=1703118156474&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=504431	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=786401	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OywqCQBRAf%2BUyKwUZR3xBrqRFgdkmw0WGTHqnBidH1Ogh%2FnsGcXYHDpyJHAfs4yu2I1mRVH%2BkUtz2KQMjl22tnwPsM3AYZREsIvAieAWeCXHXKczxksjR9t2QugEYyTZLdxYo2SBssGq0Cetbr%2B9oO05I2Q84cMF7%2BU%2BIRYREVZe85eo9ymooxUOpZWQqSNejWGawLsjqdJ7J%2FAWA4irlqwAAAA%3D%3D&ct=2&r=627998	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=0&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118126556	false		high
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/pcc.js	false	Avira URL Cloud: safe	unknown
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118107003&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=4&ct=0	false	Avira URL Cloud: safe	unknown
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/wr.js	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=987587	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942	false		high
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2o8cjPTQUTBYnpqQDpNhkOFQAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=404778	false	Avira URL Cloud: safe	unknown
https://pixel.mediaiqdigital.com/pixel?u3=&u4=&pixel_id=1074652&uid=19604228964754290	false		high
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118125443&let=1703118125557&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAOavuYsfAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=528574	false	Avira URL Cloud: safe	unknown
https://www.cdn-path.com/cc.js?&sid=ee490b8fb9a4d570&tid=LOGIN-92894ccf-5ab7-4c17-ac9c-70221aa451ab&namespace=inauth	false	Avira URL Cloud: safe	unknown
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118106994&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=3&ct=0	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tWSi72TSxJzsjMS%2FdOrVSyUjLQMzMzMzcyMjA2MjMzNbY0MYs3NDcwNjS0MDQwMzc2UKoFAJesBHI0AAAA&ct=2&r=732369	false	Avira URL Cloud: safe	unknown
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118125443&let=1703118125557&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=2&ct=0	false	Avira URL Cloud: safe	unknown
https://www.cdn-path.com/s2?t=AZur9OXDlerQprAMfNo79BHm&x=1&sid=ee490b8fb9a4d570&tid=LOGIN-a3bc1b4e-d1f6-4c54-9f36-f94888cc73da	false		unknown
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118107572&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=5&ct=0	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwvydawJDbZy9HWNsPLIz021s%2FPMLShKLS7OzM%2Bzy0gtytctLdZNzdPNKNAF85JLEnUTc3J0C3ISSzLyczJTEivB4oaGhqZGBkbGuonFBUDlmXmpOZnpmUk5qbp5%2BbpBmckZ8f5paalFAGSN5zBvAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=346725	false	Avira URL Cloud: safe	unknown
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/uxa.js	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/api-errors?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ct=0	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAA3NMTw%2FwqwkNrnH0dY2o8cjPTQUTBYnpqQAddx1wGwAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=084362	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js	false		high
https://www.google.com/pagead/1p-conversion/357551154/?label=C_zyCMS94r8DELKYv6oB&guid=ON&script=0&ct_cookie_present=false&random=372128220&sscte=1&crd=IgEBQAE&pscrd=CLb8-ZuDpZbmvgEiEwiTy8iuoZ-DAxXzJYoDHYa9Am8&is_vtc=1&ocp_id=G4WDZdPRK_PLqMwPhvuK-AY&cid=CAQSKQAvHhf_wFPOKBzyBunCPKYElhmeHiFu5dJ8f1sPop7OqbdHCZKlNDWW&random=3098574211	false		high
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118111682&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=7&ct=0	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8o10dnRJzc1XslJysc3PzcutTE5MAfFrAVNGGXkcAAAA&ct=2&r=336319	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAA6tW8nUO83RRslIyMDE1MDAwNrEwNjY3NjOzMDc0MzI1tDCwsDQzMDMxAcoYWxoYKtUCAGeTvhIyAAAA&ct=2&r=288219	false	Avira URL Cloud: safe	unknown
https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10091564&ec=CPSC9_ZZ	false		high
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAw3JsQEAMAgCsJewIOL%2Fj9msgRoAFXJoZ8qvK8galv5wUQdQxsKsJgAAAA%3D%3D&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=765347	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js	false		high
https://c.contentsquare.net/dvar?v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&dv=H4sIAAAAAAAAAy2OTWvCQBRF%2F8pjVgqSvHEmk0RXQUGLTTd%2BLYzImLzo4DQJSUpbxf%2FeKcjdncvh3gfbdtQmF6p6NmFpfTfWaj%2FwEAZ7UxX1dwcfG%2BDo4RQcUHIKP0oOIWkaS3s6r0zvByL0hILBarlJ30dgzY1gQfmtHsLs2taf5HMeevgfWOtSt%2BalsBFLZ7u3uVtGGSCikJEQoVAqCrkaBzzCKFaopHSNiJE7oTRki5OutP3tTd6dyi9rnf%2FIWNNS6d5TkbHJ4fhkzz%2FOwOC43AAAAA%3D%3D&ct=2&r=232881	false	Avira URL Cloud: safe	unknown
https://ct.contentsquare.net/ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/ptc.js	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.0.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=04500034833736687162518089606440343901&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&ts=1703118150643	false		high
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118104059&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=1&ct=2	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=2&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=680500	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwXBCQEAIAgDwEo8MjUOA%2BwfwTuWedGZ42cebgh3q0rTVscAI4VGfvtbip0oAAAA&ct=2&isETR=false&isCustomHashId=true&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=928230	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	false		high
https://adservice.google.com/ddm/fls/z/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1	false		high
https://k-aus1.contentsquare.net/v2/recording?rt=5&rst=1703118103064&let=1703118104059&v=13.59.1&pid=3776&pn=1&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&ri=2&ct=0	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/aframe	false		high
https://c.contentsquare.net/v2/events?v=13.59.1&pn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118103&pid=3776&sr=34&mdh=2644&str=205&di=2844&dc=16625&fl=16641&ct=0	false	Avira URL Cloud: safe	unknown
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1074652%26seg%3D17009710%26redir%3Dhttps%253A%252F%252Fpixel.mediaiqdigital.com%252Fpixel%253Fu3%253D%2526u4%253D%2526pixel_id%253D1074652%2526uid%253D%2524%257BUID%257D%26t%3D2cb%3D43980388.17658056	false		high
https://c.contentsquare.net/pageEvent?value=H4sIAAAAAAAAAwsNrnH0dY2oCU4tqvF3dq1xTixK8cwrKC0BAN5QNCAZAAAA&ct=2&isETR=false&isCustomHashId=false&v=13.59.1&pid=3776&pn=3&sn=1&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&r=570825	false	Avira URL Cloud: safe	unknown
https://c.contentsquare.net/v2/events?v=13.59.1&pn=2&uu=00de58ab-fdc5-abdd-8e56-0169d12b5a95&sn=1&hd=1703118124&pid=3776&str=844&di=6279&dc=6864&fl=6865&sr=58&mdh=1576&ct=0	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/1p-user-list/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&random=2030149056&crd=&is_vtc=1&cid=CAQSGwAvHhf_wrQeCHIPZfD03ihwRlnUO3iKqfYp9g&random=1991465498	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/zloirock/core-js/blob/v3.30.0/LICENSE	chromecache_541.2.dr	false		high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RCba6f9cee3abe426fa326391960ab44a	chromecache_383.2.dr	false		high
http://www.broofa.com	chromecache_591.2.dr	false	URL Reputation: safe	unknown
http://www.vietcomic.comVNI-Thufap2	chromecache_454.2.dr, chromecache_406.2.dr	false	Avira URL Cloud: safe	unknown
https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg00_zz;u3=	chromecache_518.2.dr	false		high
http://blog.igorescobar.com	chromecache_549.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js	chromecache_311.2.dr, chromecache_541.2.dr	false		high
https://www.google.com	chromecache_444.2.dr	false		high
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	chromecache_334.2.dr, chromecache_397.2.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.census.gov/geo/www/gazetteer/gazetteer2010.html	chromecache_325.2.dr	false		high
https://github.com/hodgef)	chromecache_541.2.dr	false		high
https://www.bluebird.com/?solid=iNavMyAccountbb&inav=menu_myacct_bluebird&intlink=us-amex-pr	chromecache_322.2.dr	false		high
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail3.php	chromecache_322.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ad.doubleclick.net/ddm/activity/src=189445;type=dines0;cat=amex-000;dc_lat=;dc_rdid=;tag_for	chromecache_501.2.dr	false		high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RCcdce0ecea7264d3f84bc54527bbc8c7	chromecache_455.2.dr	false		high
https://github.com/umdjs/umd/blob/master/jqueryPluginCommonjs.js	chromecache_549.2.dr	false		high
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/data.php	chromecache_322.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ct.pinterest.com/v3/?tid=2613808224364&event=pagevisit&	chromecache_292.2.dr	false		high
https://github.com/hodgef/simple-keyboard	chromecache_541.2.dr	false		high
https://securepubads.g.doubleclick.net/pagead/js/car.js	chromecache_307.2.dr, chromecache_555.2.dr	false		high
https://ariwa.in/ammmexddssssxxshhshhwwwweewwwee/mail2.php	chromecache_322.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aeopprodvip.acxiom.com/services/v2clickStream	chromecache_577.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_549.2.dr	false		high
http://www.opensource.org/licenses/MIT	chromecache_405.2.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_311.2.dr, chromecache_334.2.dr, chromecache_541.2.dr, chromecache_435.2.dr, chromecache_513.2.dr, chromecache_318.2.dr, chromecache_509.2.dr, chromecache_519.2.dr	false		high
https://github.com/zloirock/core-js/blob/v3.21.0/LICENSE	chromecache_311.2.dr	false		high
https://ad.doubleclick.net/ddm/activity/src=189445;type=shops0;cat=amex-0;dc_lat=;dc_rdid=;tag_for_c	chromecache_345.2.dr	false		high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/launch-bd8521c0d687.js	chromecache_381.2.dr	false		high
https://github.com/facebook/regenerator/blob/main/LICENSE	chromecache_569.2.dr	false		high
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Df88c4649-8329-b1b7-ecd9-998ac98d3	chromecache_292.2.dr	false		high
http://angular-ui.github.com/	chromecache_405.2.dr	false		high
http://errors.angularjs.org/1.4.7/	chromecache_420.2.dr	false		high
https://www.dynatrace.com/company/trust-center/customers/reports/	chromecache_296.2.dr, chromecache_365.2.dr, chromecache_427.2.dr	false		high
http://code.google.com/p/episodes/	chromecache_510.2.dr	false		high
https://github.com/google/safevalues/issues	chromecache_555.2.dr	false		high
https://www.schwab.com	chromecache_401.2.dr, chromecache_587.2.dr	false		high
https://www.bluebird.com/prepaidaccount?intlink=us-amex-prepaid-bluebird-inav_menu_myacct&SOLID=	chromecache_322.2.dr	false		high
http://angularjs.org	chromecache_446.2.dr, chromecache_377.2.dr, chromecache_343.2.dr, chromecache_420.2.dr	false		high
http://www.census.gov	chromecache_325.2.dr	false		high
https://github.com/hgoebl/mobile-detect.js	chromecache_541.2.dr, chromecache_509.2.dr	false		high
https://ad.doubleclick.net/ddm/activity/src=8538740;type=rab;cat=bmg01_zz;dc_lat=;dc_rdid=;tag_for_c	chromecache_492.2.dr	false		high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/EX01cd838bfde94471b401c17d31e9c9d	chromecache_448.2.dr	false		high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/7f8fc2f4e43c/RC2fe7cb53f58440dab389607b3959dfb	chromecache_399.2.dr	false		high
http://jedwatson.github.io/classnames	chromecache_509.2.dr	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_510.2.dr, chromecache_363.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.212.247.228	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
151.101.0.84	prod.pinterest.global.map.fastly.net	United States	54113	FASTLYUS	false
18.64.174.63	d2pz9khpjpljz2.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
99.84.252.109	unknown	United States	16509	AMAZON-02US	false
68.67.160.24	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
52.46.128.147	unknown	United States	16509	AMAZON-02US	false
157.240.14.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
34.233.187.243	k.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
151.101.193.140	unknown	United States	54113	FASTLYUS	false
172.217.15.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.217.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
54.236.148.39	unknown	United States	14618	AMAZON-AESUS	false
13.35.116.63	unknown	United States	16509	AMAZON-02US	false
142.250.189.130	www.googletagservices.com	United States	15169	GOOGLEUS	false
192.178.50.68	unknown	United States	15169	GOOGLEUS	false
107.21.13.4	pixel.mediaiqdigital.com	United States	14618	AMAZON-AESUS	false
142.250.217.228	www.google.com	United States	15169	GOOGLEUS	false
44.205.152.91	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
18.64.174.32	d1xbuscas8tetl.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
76.13.32.146	spdc-global.pbp.gysm.yahoodns.net	United States	26101	YAHOO-3US	false
142.250.217.196	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.35.226	adservice.google.com	United States	15169	GOOGLEUS	false
198.160.127.57	aeopprodvip.acxiom.com	United States	15026	ACXIOMUS	false
13.35.116.31	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
35.174.126.198	stun.cdn-net.com	United States	14618	AMAZON-AESUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.189.142	clients.l.google.com	United States	15169	GOOGLEUS	false
192.178.50.36	unknown	United States	15169	GOOGLEUS	false
63.140.38.201	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
3.210.170.220	unknown	United States	14618	AMAZON-AESUS	false
63.140.38.163	americanexpress.com.ssl.d2.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
172.217.15.193	pagead-googlehosted.l.google.com	United States	15169	GOOGLEUS	false
54.84.87.164	c.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
99.84.252.78	d5b3uu8blbxud.cloudfront.net	United States	16509	AMAZON-02US	false
34.239.210.132	unknown	United States	14618	AMAZON-AESUS	false
34.192.149.136	q-aus1.contentsquare.net	United States	14618	AMAZON-AESUS	false
44.199.136.121	srm.bf.contentsquare.net	United States	14618	AMAZON-AESUS	false
151.101.1.140	reddit.map.fastly.net	United States	54113	FASTLYUS	false
199.204.248.118	browndoguniversity.com	United States	17054	AS17054US	false
142.250.64.230	ad.doubleclick.net	United States	15169	GOOGLEUS	false
52.46.151.131	s.amazon-adsystem.com	United States	16509	AMAZON-02US	false
151.101.129.140	unknown	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1365347
Start date and time:	2023-12-21 01:20:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@27/328@210/44
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html#skipToContent Browse: https://www.americanexpress.com/?inav=NavLogo Browse: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Register&Face=en_US#/&inav=menu_myacct_create_online_account Browse: https://global.americanexpress.com/dashboard?inav=menu_myacct_acctsum Browse: https://online.americanexpress.com/myca/gce/us/action/home?request_type=un_Activation&Face=en_US#/&inav=menu_myacct_confirm_card Browse: https://global.americanexpress.com/activity?inav=menu_myacct_viewstmt

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.35, 34.104.35.123, 139.71.113.91, 23.39.130.47, 23.34.193.29, 152.199.4.33, 142.250.217.193, 172.217.15.202, 192.178.50.74, 192.178.50.42, 142.250.64.138, 142.250.217.202, 142.250.64.170, 142.250.217.170, 142.250.64.202, 142.251.35.234, 142.250.217.234, 142.250.189.138, 142.250.189.129, 139.71.16.29, 23.194.244.191, 148.173.96.182, 72.21.81.240, 192.229.211.108, 23.202.72.137, 139.71.9.95, 23.194.243.215, 23.204.76.235, 139.71.49.215, 139.71.89.13, 139.71.16.158, 104.17.209.240, 104.17.208.240, 192.178.50.66, 151.101.66.132, 151.101.2.132, 151.101.194.132, 151.101.130.132, 139.71.16.236, 23.61.51.53, 139.71.16.11, 139.71.117.83, 139.71.16.41, 18.205.39.5, 54.87.153.184, 44.198.255.139, 54.165.111.121, 18.211.93.14, 18.232.255.36, 23.219.155.47, 23.219.155.13, 139.71.18.132, 172.217.3.74, 172.217.2.202, 23.34.207.2, 208.89.12.153, 139.71.2.183, 139.71.9.48, 148.173.88.88, 142.250.189.131, 142.250.64.225, 172.217.2.194, 142.250.64.130, 192.178.50.65, 142.250.
Excluded domains from analysis (whitelisted): e14893.x.akamaiedge.net, j.sni.global.fastly.net, slscr.update.microsoft.com, functions.americanexpress.com.akadns.net, one-release.americanexpress.com.akadns.net, cn-assets.adobedtm.com.edgekey.net, clientservices.googleapis.com, 8527c960aa27fb15093fad69b99a5dc9.safeframe.googlesyndication.com, ds-aksb-a.akamaihd.net.edgesuite.net, ocsp.digicert.com, www.aexp-static.com.edgekey.net, update.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, www.americanexpress.com.edgekey.net, aug.americanexpress.com.akadns.net, one-xp.americanexpress.com.edgekey.net, pagead2.googlesyndication.com, www.pinterest.com.edgekey.net, one-functions-staging.americanexpress.com.akadns.net, a1910.dscq.akamai.net, edgedl.me.gvt1.com, global1.americanexpress.com.akadns.net, cdaas.americanexpress.com.akadns.net, bdaas-payments.americanexpress.com.akadns.net, online1.americanexpress.com.akadns.net, gctv4.americanexpress.com.akadns.net, www.googleadservices.com, global.americane
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 198 x 72, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12084
Entropy (8bit):	7.979685875409505
Encrypted:	false
SSDEEP:	192:k0j5W7Y6eNnpxLyVOgwZ4KbKwH3DMRassYeJvCNG/M2Nqv8CTlsKx0YDWTq2:k0lWs6MSOgwhbhzM4sCiGEcq0zUDD2
MD5:	E1967D2D8EFB0FAD0AEF8AC0FAC299CD
SHA1:	B0BC770CF8532836A49C416EA15DE3C2A6A29DC5
SHA-256:	0C7792ECF7825AAC0A4E26E7BFAB2568F71E52DE4E42732C80CBC87DCE14FEF4
SHA-512:	095A7BF63B96BDD30B86C0DA61BB0C7FBB3E1CCE132A1AAC255A7CE4BBBEFD2A2D9924A4B3540F397C08B3C13B77EBA8DCFF8462C0B88A2A72FF7EAEA5AAB344
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......H.......z.....PLTE..............................................................................................................................................................................................................{...................................................................\|.\|.v.v.y.....m...........................2/0TSTA@?LJKono......bab+()965{{\|]\]xwyXWX=;;ttuPPO&#"kjlgfg ..GEE.........qqr......~~...m\UGjeT..~xq[..l4-.xmGPH1..`mcC..Y..[..S.tL.rl\|mS[S\|.~^i]y.{YdYjykv.xftgs.tGLF.................e..bob...o.p........m..q.zO.......`V9...............\|.....................k.q.................y......t.j.y.o..q.r..j....k..............v...........n..N.o4n[v..Eyga.{._K.N5q......tRNS.......................ro....orNT..w...+.IDATh.}{y\...f..{..Ng.3$)$...Z[..=........}!....(.B ......lbm....*u...]D..B.......g....%zf>s>.6!\|..yx..}...~..K/.....`.=...../...........M

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 21, 2023 01:22:04.412434101 CET	192.168.2.4	1.1.1.1	c25e	(Port unreachable)	Destination Unreachable
Dec 21, 2023 01:22:09.910768986 CET	192.168.2.4	1.1.1.1	c26a	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:13 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:13 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-AkNErsy38uvKQDbV5L99uw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 21 Dec 2023 00:21:13 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6197 X-Daystart: 58873 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-21 00:21:13 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 39 37 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 38 38 37 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6197" elapsed_seconds="58873"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-21 00:21:13 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-21 00:21:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:13 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2023-12-21 00:21:13 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-21 00:21:13 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 21 Dec 2023 00:21:13 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-QgVhgJ2bgC8fZZHp0od-IQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-21 00:21:13 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-21 00:21:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:14 UTC	715	OUT	GET /americanexpress-com.connect-online.page/amexs.html HTTP/1.1 Host: browndoguniversity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:14 UTC	294	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:22:05 GMT Server: Apache/2.4.52 (cPanel) OpenSSL/1.1.1m mod_bwlimited/1.4 Last-Modified: Tue, 19 Dec 2023 17:01:49 GMT ETag: "36c0764-eaab8-60cdfd28044f8" Accept-Ranges: bytes Content-Length: 961208 Connection: close Content-Type: text/html
2023-12-21 00:21:14 UTC	7898	IN	Data Raw: 0d 0a 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 20 20 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 0d 0a 3c 74 69 74 6c 65 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 3e 4c 6f 67 20 49 6e 20 74 6f 20 4d 79 20 41 63 63 6f 75 6e 74 20 7c 20 41 6d 65 72 69 63 61 6e 20 45 78 70 72 65 73 73 20 55 53 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 Data Ascii: <!DOCTYPE html> <html lang="en-US"> <head> <title data-react-helmet="true">Log In to My Account \| American Express US</title><meta data-react-helmet="true" http-equiv="X-UA-Compatible" content="IE=edge"/><meta data
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 79 70 65 29 3a 6e 6f 74 28 2e 62 74 6e 2d 62 6c 6f 63 6b 29 3a 3a 61 66 74 65 72 2c 2e 67 72 61 6e 75 6c 61 72 2d 62 61 6e 6e 65 72 2d 62 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29 3a 6e 6f 74 28 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 29 3a 6e 6f 74 28 2e 62 74 6e 2d 62 6c 6f 63 6b 29 3a 3a 61 66 74 65 72 2c 2e 67 72 61 6e 75 6c 61 72 2d 62 61 6e 6e 65 72 2d 62 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29 3a 3a 61 66 74 65 72 2c 2e 67 72 61 6e 75 6c 61 72 2d 62 61 6e 6e 65 72 2d 62 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 63 38 63 39 63 Data Ascii: ype):not(.btn-block)::after,.granular-banner-button:disabled:not(:first-of-type):not(:last-of-type):not(.btn-block)::after,.granular-banner-button:disabled:last-of-type:not(:first-of-type)::after,.granular-banner-button:disabled::after{border-color:#c8c9c
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 45 67 62 73 7b 2d 6d 73 2d 66 6c 65 78 3a 6e 6f 6e 65 3b 66 6c 65 78 3a 6e 6f 6e 65 7d 2e 61 78 70 2d 72 6f 6f 74 5f 5f 64 6c 73 5f 5f 61 6c 65 72 74 44 69 73 6d 69 73 73 69 62 6c 65 5f 5f 5f 32 30 37 58 32 3e 2e 61 78 70 2d 72 6f 6f 74 5f 5f 64 6c 73 5f 5f 61 6c 65 72 74 49 63 6f 6e 5f 5f 5f 5a 45 67 62 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 39 33 37 35 72 65 6d 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 30 3b 6f 72 64 65 72 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 2e 36 32 35 72 65 6d 7d 2e 61 78 70 2d 72 6f 6f 74 5f 5f 64 6c 73 5f 5f 61 6c 65 72 74 44 69 73 6d 69 73 73 69 62 6c 65 5f 5f 5f 32 30 37 58 32 3e 2e 61 78 70 2d 72 6f 6f 74 5f 5f 64 6c 73 5f 5f 61 6c 65 72 74 43 6c 6f 73 Data Ascii: Egbs{-ms-flex:none;flex:none}.axp-root__dls__alertDismissible___207X2>.axp-root__dls__alertIcon___ZEgbs{font-size:1.75rem;margin-top:.9375rem;-ms-flex-order:0;order:0;padding-right:.625rem}.axp-root__dls__alertDismissible___207X2>.axp-root__dls__alertClos
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 51 77 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 ee a8 bb 22 7d 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 32 61 74 77 35 20 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 64 6c 73 49 63 6f 6e 53 65 61 72 63 68 5f 5f 5f 33 61 43 51 77 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 69 63 6f 6e 48 6f 76 65 72 5f 5f 5f 32 35 31 52 33 3a 68 6f 76 65 72 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 ee a8 bc 22 7d 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 32 61 74 77 35 20 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 69 63 6f 6e 48 6f 76 65 72 5f 5f 5f 32 35 31 52 33 3a 68 6f 76 65 72 Data Ascii: Qw::before{content:""}.axp-search-box__dls__module___2atw5 .axp-search-box__dls__dlsIconSearch___3aCQw.axp-search-box__dls__iconHover___251R3:hover::before{content:""}.axp-search-box__dls__module___2atw5 .axp-search-box__dls__iconHover___251R3:hover
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 2e 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 3b 63 6f 6c 6f 72 3a 23 35 33 35 36 35 61 7d 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 32 61 74 77 35 20 66 69 65 6c 64 73 65 74 3e 69 6e 70 75 74 3a 6e 6f 74 28 3a 6c 61 73 74 2d 63 68 69 6c 64 29 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 72 65 6d 7d 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 32 61 74 77 35 20 2e 61 78 70 2d 73 65 61 72 63 68 2d 62 6f 78 5f 5f 64 6c 73 5f 5f 61 6c 65 72 74 46 6f 72 6d 5f 5f 5f 75 4e 52 4c 51 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 37 Data Ascii: .5rem;font-size:.875rem;color:#53565a}.axp-search-box__dls__module___2atw5 fieldset>input:not(:last-child){margin-bottom:1.25rem}.axp-search-box__dls__module___2atw5 .axp-search-box__dls__alertForm___uNRLQ{display:block;font-size:.9375rem;line-height:1.37
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 72 74 53 75 62 6d 65 6e 75 49 74 65 6d 5f 5f 5f 32 41 72 54 68 3e 61 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 38 70 78 7d 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 5f 33 32 38 71 64 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 73 6f 63 69 61 6c 4c 69 6e 6b 73 5f 5f 5f 67 41 41 48 72 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 36 70 78 7d 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 5f 33 32 38 71 64 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 66 6f 6f 74 65 72 5f 5f 73 6f 63 69 61 6c 4c 69 6e 6b 73 5f 5f 5f 67 41 41 48 72 3a 65 6d 70 74 79 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 70 78 7d 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 66 Data Ascii: rtSubmenuItem___2ArTh>a{padding-left:48px}.axp-footer__footer__footer___328qd .axp-footer__footer__socialLinks___gAAHr{padding-bottom:26px}.axp-footer__footer__footer___328qd .axp-footer__footer__socialLinks___gAAHr:empty{padding-bottom:0px}.axp-footer__f
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 77 5f 5f 5f 33 48 33 78 71 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2d 31 30 70 78 7d 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 38 30 70 78 29 7b 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 77 5f 5f 5f 33 48 33 78 71 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2d 31 30 70 78 7d 7d 2e 61 78 70 2d 66 6f 6f Data Ascii: er__dls-module__module___1_EeR .axp-footer__dls-module__row___3H3xq{margin-left:-10px;margin-right:-10px}}@media(min-width: 1280px){.axp-footer__dls-module__module___1_EeR .axp-footer__dls-module__row___3H3xq{margin-left:-10px;margin-right:-10px}}.axp-foo
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6c 69 73 74 5f 5f 5f 33 4b 53 78 57 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6c 69 73 74 4c 69 6e 6b 73 5f 5f 5f 44 73 57 4f 5a 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 78 70 2d 66 6f 6f 74 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 66 6f Data Ascii: ooter__dls-module__module___1_EeR .axp-footer__dls-module__list___3KSxW{padding:0}.axp-footer__dls-module__module___1_EeR .axp-footer__dls-module__listLinks___DsWOZ{list-style:none;line-height:1.15;padding:0}.axp-footer__dls-module__module___1_EeR .axp-fo
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 65 3e 3c 73 74 79 6c 65 20 63 6c 61 73 73 3d 22 73 73 72 2d 63 73 73 22 3e 64 69 76 2e 61 78 70 2d 69 64 65 6e 74 69 74 79 2d 6c 6f 67 69 6e 2d 70 61 67 65 5f 5f 4f 74 70 42 75 74 74 6f 6e 5f 5f 6f 74 70 52 61 64 69 6f 5f 5f 5f 32 55 63 50 64 2e 61 78 70 2d 69 64 65 6e 74 69 74 79 2d 6c 6f 67 69 6e 2d 70 61 67 65 5f 5f 4f 74 70 42 75 74 74 6f 6e 5f 5f 6f 74 70 52 61 64 69 6f 5f 5f 5f 32 55 63 50 64 20 6c 61 62 65 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 33 37 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 0d 0a 2e 61 78 70 2d 69 64 65 6e 74 69 74 79 2d 6c 6f 67 69 6e 2d 70 61 67 65 5f 5f 43 6f 6d 6d 6f 6e 53 74 79 6c 65 73 5f 5f 6c 61 72 67 65 5f 5f 5f 32 36 58 30 4a 20 2e 61 78 70 2d 69 64 65 6e 74 69 74 79 2d 6c 6f 67 69 6e 2d 70 61 67 Data Ascii: e><style class="ssr-css">div.axp-identity-login-page__OtpButton__otpRadio___2UcPd.axp-identity-login-page__OtpButton__otpRadio___2UcPd label{font-size:.9375rem;font-weight:500}.axp-identity-login-page__CommonStyles__large___26X0J .axp-identity-login-pag
2023-12-21 00:21:15 UTC	8000	IN	Data Raw: 6e 53 6d 5f 5f 5f 33 4e 6a 65 7a 3a 3a 62 65 66 6f 72 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 7d 2e 61 78 70 2d 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 69 63 6f 6e 48 6f 76 65 72 5f 5f 5f 33 6a 74 49 30 3a 68 6f 76 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 61 78 70 2d 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 64 75 6c 65 5f 5f 5f 31 5f 45 65 52 20 2e 61 78 70 2d 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 5f 5f 64 6c 73 2d 6d 6f 64 75 6c 65 5f 5f 64 6c 73 49 63 6f 6e 53 65 61 72 63 68 5f 5f 5f 33 4b 70 Data Ascii: nSm___3Njez::before{font-size:1.375rem}.axp-global-header__dls-module__module___1_EeR .axp-global-header__dls-module__iconHover___3jtI0:hover{cursor:pointer}.axp-global-header__dls-module__module___1_EeR .axp-global-header__dls-module__dlsIconSearch___3Kp

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:16 UTC	570	OUT	GET /ajax/libs/jquery.mask/1.14.10/jquery.mask.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://browndoguniversity.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:17 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:21:16 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03ec3-4e98" Last-Modified: Mon, 04 May 2020 16:11:47 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 112913 Expires: Tue, 10 Dec 2024 00:21:16 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=neghnp5yzs4jGvTeUTdLbEdzgYJTMtN%2F9zH4%2F3dcXED3LZoBjVbW85CRqcTfT3gA4Lqpy54n431Z5B0UVQG73zwhHOFr%2F0ZnWPp5WlQyb2FqSGHccvn0s5clivGVymHlpTrAGz4l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 838bf6cd0c4d8dd9-MIA alt-svc: h3=":443"; ma=86400
2023-12-21 00:21:17 UTC	411	IN	Data Raw: 34 65 39 38 0d 0a 2f 2a 2a 0a 20 2a 20 6a 71 75 65 72 79 2e 6d 61 73 6b 2e 6a 73 0a 20 2a 20 40 76 65 72 73 69 6f 6e 3a 20 76 31 2e 31 34 2e 31 30 0a 20 2a 20 40 61 75 74 68 6f 72 3a 20 49 67 6f 72 20 45 73 63 6f 62 61 72 0a 20 2a 0a 20 2a 20 43 72 65 61 74 65 64 20 62 79 20 49 67 6f 72 20 45 73 63 6f 62 61 72 20 6f 6e 20 32 30 31 32 2d 30 33 2d 31 30 2e 20 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 61 6e 79 20 62 75 67 20 61 74 20 68 74 74 70 3a 2f 2f 62 6c 6f 67 2e 69 67 6f 72 65 73 63 6f 62 61 72 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 32 20 49 67 6f 72 20 45 73 63 6f 62 61 72 20 68 74 74 70 3a 2f 2f 62 6c 6f 67 2e 69 67 6f 72 65 73 63 6f 62 61 72 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 54 68 65 20 4d 49 54 20 4c 69 Data Ascii: 4e98/** * jquery.mask.js * @version: v1.14.10 * @author: Igor Escobar * * Created by Igor Escobar on 2012-03-10. Please report any bug at http://blog.igorescobar.com * * Copyright (c) 2012 Igor Escobar http://blog.igorescobar.com * * The MIT Li
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 74 77 61 72 65 20 61 6e 64 20 61 73 73 6f 63 69 61 74 65 64 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 0a 20 2a 20 66 69 6c 65 73 20 28 74 68 65 20 22 53 6f 66 74 77 61 72 65 22 29 2c 20 74 6f 20 64 65 61 6c 20 69 6e 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 77 69 74 68 6f 75 74 0a 20 2a 20 72 65 73 74 72 69 63 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 69 74 68 6f 75 74 20 6c 69 6d 69 74 61 74 69 6f 6e 20 74 68 65 20 72 69 67 68 74 73 20 74 6f 20 75 73 65 2c 0a 20 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 6d 65 72 67 65 2c 20 70 75 62 6c 69 73 68 2c 20 64 69 73 74 72 69 62 75 74 65 2c 20 73 75 62 6c 69 63 65 6e 73 65 2c 20 61 6e 64 2f 6f 72 20 73 65 6c 6c 0a 20 2a 20 63 6f 70 69 65 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2c 20 61 Data Ascii: tware and associated documentation * files (the "Software"), to deal in the Software without * restriction, including without limitation the rights to use, * copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, a
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 72 79 29 3b 0a 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 20 3d 3d 3d 20 27 6f 62 6a 65 63 74 27 29 20 7b 0a 20 20 20 20 20 20 20 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 20 3d 20 66 61 63 74 6f 72 79 28 72 65 71 75 69 72 65 28 27 6a 71 75 65 72 79 27 29 29 3b 0a 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 66 61 63 74 6f 72 79 28 6a 51 75 65 72 79 20 7c 7c 20 5a 65 70 74 6f 29 3b 0a 20 20 20 20 7d 0a 0a 7d 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 0a 20 20 20 20 76 61 72 20 4d 61 73 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 6c 2c 20 6d 61 73 6b 2c 20 6f 70 74 69 6f 6e 73 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 76 61 72 20 70 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e Data Ascii: ry); } else if (typeof exports === 'object') { module.exports = factory(require('jquery')); } else { factory(jQuery \|\| Zepto); }}(function ($) { var Mask = function (el, mask, options) { var p = { in
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 63 74 72 6c 2e 73 65 74 53 65 6c 65 63 74 69 6f 6e 52 61 6e 67 65 28 70 6f 73 2c 20 70 6f 73 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 20 2f 2f 20 49 45 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 61 6e 67 65 20 3d 20 63 74 72 6c 2e 63 72 65 61 74 65 54 65 78 74 52 61 6e 67 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 61 6e 67 65 2e 63 6f 6c 6c 61 70 73 65 28 74 72 75 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 61 6e 67 65 2e 6d 6f 76 65 45 6e 64 28 27 63 68 61 72 61 63 74 65 72 27 2c 20 70 6f 73 29 3b 0a 20 20 20 20 20 20 Data Ascii: ctrl.setSelectionRange(pos, pos); } else { // IE range = ctrl.createTextRange(); range.collapse(true); range.moveEnd('character', pos);
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 65 72 79 20 69 6d 70 6f 72 74 61 6e 74 20 74 68 61 74 20 74 68 69 73 20 63 61 6c 6c 62 61 63 6b 20 72 65 6d 61 69 6e 73 20 69 6e 20 74 68 69 73 20 70 6f 73 69 74 69 6f 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 6f 74 68 65 72 77 68 69 73 65 20 6f 6c 64 56 61 6c 75 65 20 69 74 27 73 20 67 6f 69 6e 67 20 74 6f 20 77 6f 72 6b 20 62 75 67 67 79 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 6f 6e 28 27 62 6c 75 72 2e 6d 61 73 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 6c 64 56 61 6c 75 65 20 3d 20 70 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 73 65 6c 65 63 74 20 61 6c Data Ascii: ery important that this callback remains in this position // otherwhise oldValue it's going to work buggy .on('blur.mask', function() { oldValue = p.val(); }) // select al
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 52 65 63 75 72 73 69 76 65 20 3d 20 7b 64 69 67 69 74 3a 20 6d 61 73 6b 2e 63 68 61 72 41 74 28 69 29 2c 20 70 61 74 74 65 72 6e 3a 20 70 61 74 74 65 72 6e 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 73 6b 43 68 75 6e 6b 73 2e 70 75 73 68 28 21 6f 70 74 69 6f 6e 61 6c 20 26 26 20 21 72 65 63 75 72 73 69 76 65 20 3f 20 70 61 74 74 65 72 6e 20 3a 20 28 70 61 74 74 65 72 6e 20 2b 20 27 3f 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d Data Ascii: oRecursive = {digit: mask.charAt(i), pattern: pattern}; } else { maskChunks.push(!optional && !recursive ? pattern : (pattern + '?')); } }
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 63 75 6c 61 74 65 43 61 72 65 74 50 6f 73 69 74 69 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 63 61 72 65 74 50 6f 73 2c 20 6e 65 77 56 61 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6e 65 77 56 61 6c 4c 20 3d 20 6e 65 77 56 61 6c 2e 6c 65 6e 67 74 68 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 56 61 6c 75 65 20 20 3d 20 65 6c 2e 64 61 74 61 28 27 6d 61 73 6b 2d 70 72 65 76 69 75 73 2d 76 61 6c 75 65 27 29 20 7c 7c 20 27 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 56 61 6c 75 65 4c 20 3d 20 6f 56 61 6c 75 65 2e 6c 65 6e 67 74 68 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 65 64 67 Data Ascii: }, calculateCaretPosition: function(caretPos, newVal) { var newValL = newVal.length, oValue = el.data('mask-previus-value') \|\| '', oValueL = oValue.length; // edg
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 70 2e 73 65 74 43 61 72 65 74 28 70 2e 63 61 6c 63 75 6c 61 74 65 43 61 72 65 74 50 6f 73 69 74 69 6f 6e 28 63 61 72 65 74 50 6f 73 2c 20 6e 65 77 56 61 6c 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 31 30 2c 20 63 61 72 65 74 50 6f 73 2c 20 6e 65 77 56 61 6c 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 76 61 6c 28 6e 65 77 56 61 6c 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 73 65 74 43 61 72 65 74 28 63 61 72 65 74 50 6f 73 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 70 2e 63 61 6c 6c 62 61 63 6b 73 28 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 Data Ascii: p.setCaret(p.calculateCaretPosition(caretPos, newVal)); }, 10, caretPos, newVal); p.val(newVal); p.setCaret(caretPos); return p.callbacks(e); }
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 76 61 6c 44 69 67 69 74 20 3d 20 76 61 6c 75 65 2e 63 68 61 72 41 74 28 76 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 6c 61 74 69 6f 6e 20 3d 20 6a 4d 61 73 6b 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 5b 6d 61 73 6b 44 69 67 69 74 5d 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 72 61 6e 73 6c 61 74 69 6f 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 76 61 6c 44 69 67 69 74 2e 6d 61 74 63 68 28 74 72 61 6e 73 6c 61 74 69 6f 6e 2e 70 61 74 74 65 72 6e 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 75 66 5b 61 64 64 4d 65 74 68 6f 64 5d 28 76 61 Data Ascii: valDigit = value.charAt(v), translation = jMask.translation[maskDigit]; if (translation) { if (valDigit.match(translation.pattern)) { buf[addMethod](va
2023-12-21 00:21:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 74 72 61 6e 73 6c 61 74 69 6f 6e 2e 66 61 6c 6c 62 61 63 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 75 66 5b 61 64 64 4d 65 74 68 6f 64 5d 28 74 72 61 6e 73 6c 61 74 69 6f 6e 2e 66 61 6c 6c 62 61 63 6b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 20 2b 3d 20 6f 66 66 73 65 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 20 2d 3d 20 6f 66 66 73 65 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 69 6e 76 61 6c 69 Data Ascii: } else if (translation.fallback) { buf[addMethod](translation.fallback); m += offset; v -= offset; } else { p.invali

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-21 00:21:18 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (dce/26AC) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=64533 Date: Thu, 21 Dec 2023 00:21:18 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:18 UTC	639	OUT	GET /media/369c26_b396f2977e5a40839e2fc77a6f9aac2b~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://browndoguniversity.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:18 UTC	763	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 46309 Connection: close Server: openresty/1.21.4.1 Date: Tue, 19 Dec 2023 21:53:45 GMT Expires: Tue, 19 Dec 2023 22:53:45 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Sat, 13 Aug 2022 13:49:12 GMT ETag: "cb93719526bfbcc31f4cd6a067904c0d" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-f89dc7b48-m4z7p Via: 1.1 google, 1.1 fb086f315a09c6603ff2f1e41c8e76fa.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: MIA3-C2 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 4_FfzMoGb3wwVUgqxJ_fPUS8QF-AimzBWncCSU2nhnDYxuMTQFChbg== Age: 95253
2023-12-21 00:21:18 UTC	15621	IN	Data Raw: 47 49 46 38 39 61 e7 00 e7 00 f7 00 00 00 00 00 29 96 f6 2a 9b fe 2a 9b fe 2a 9b fe 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2c 9c ff 2c 9c ff 2d 9d ff 2d 9d ff 2e 9d fe 2f 9d fe 30 9e fe 30 9e fe 31 9e fe 32 9f fe 32 9f fe 33 9f fe 34 9f fe 35 a0 fe 36 a0 fe 37 a1 fe 38 a1 fe 3a a2 fe 3c a3 fd 3f a4 fd 42 a6 fd 43 a6 fd 45 a7 fd 47 a8 fd 4b a9 fd 4e ab fc 54 ae fc 59 b0 fc 5c b1 fc 5f b2 fb 64 b5 fb 69 b7 fb 6e b9 fa 72 ba fa 77 bd fa 79 be fa 7c bf fa 7e c0 f9 7f c0 f9 82 c1 f9 84 c3 f9 87 c4 f9 88 c4 f9 8a c5 f9 8c c6 f9 8f c8 f8 94 ca f8 99 cc f8 9e ce f8 a4 d0 f7 a9 d3 f7 ae d5 f7 b2 d6 f6 b4 d7 f6 b5 d8 f6 b7 d9 f6 bb da f6 c0 dc f5 c4 de f5 c6 df f5 c8 e0 f5 ca e1 f5 cd e2 f5 ce e2 f4 cf e3 f4 d1 e4 f4 d3 e5 Data Ascii: GIF89a)***+++++++++,,--./00122345678:<?BCEGKNTY\_dinrwy\|~
2023-12-21 00:21:18 UTC	369	IN	Data Raw: f1 15 d8 d7 a5 a1 96 c9 d7 45 f1 95 d1 d8 05 8c 96 c3 d8 69 f1 d5 e6 d8 c5 8e 16 b8 5d 7f 25 34 76 7d a6 e5 44 76 b5 7a a5 3b 76 49 a8 55 44 76 43 76 b5 46 76 3f a8 65 37 76 07 7a 15 47 76 3c a4 e5 08 f1 cc b9 01 58 f4 90 1d 1d a4 c5 10 fc 03 0b 02 6b a6 96 ec cc 40 11 60 21 d8 75 d4 f2 b4 eb 14 e7 2b a9 62 ce c1 ce b2 3a ec dc cc 2b 7f 10 0f ea ca 42 2c ec c4 8f 2b 80 c3 4e ff d2 c2 37 ec c4 ad 2b c8 c3 0e d2 d2 22 b9 e5 a4 af 2b 84 c3 4e cb d2 52 85 ec ec aa 2b fe dc bb ce 14 d4 e2 85 ec 88 e1 2b b3 6b 4e 16 d4 92 c3 eb 64 ce 2b af 03 ce 11 d3 12 43 da 7d 45 69 d8 71 5e 5a e8 90 1d 1a 44 4c 2b 8e 08 13 76 f0 a0 96 43 64 70 39 e7 e1 0a 1c b2 93 03 b6 40 4b 89 5d 29 22 76 6a b7 96 22 61 07 72 5b 29 a1 13 d9 52 c5 eb 18 0e 2b a3 cb 4e 1a d5 12 88 95 5d 67 Data Ascii: Ei]%4v}Dvz;vIUDvCvFv?e7vzGv<Xk@`!u+b:+B,+N7+"+NR++kNd+C}Eiq^ZDL+vCdp9@K])"vj"ar[)R+N]g
2023-12-21 00:21:18 UTC	16384	IN	Data Raw: 06 e1 42 3d ec 28 01 2c 78 e0 02 2d e1 52 87 f1 40 13 41 31 99 95 0a 9b 85 4e 96 f4 f1 3a d8 6a a7 4b 6a c8 1c eb c9 f3 51 e3 fe 61 d7 3d 5b 62 85 f1 10 81 61 fb 4c 49 1e c4 98 1d 27 14 22 a0 2a 91 a3 78 aa 50 4a 84 8a 44 10 c0 14 cf 15 20 e8 50 93 bc 01 80 e4 eb 5d 45 45 f2 85 f6 48 e1 a0 1b 1d 89 21 8c 39 9e 19 85 74 24 72 20 e8 7b a2 76 d2 90 ac 8f 3c 34 b0 67 4b 3b d2 51 f7 40 81 8c 33 ed 88 bf f0 83 03 32 04 2f a7 1a 49 58 7e 92 f0 47 a0 5e 64 62 02 aa 42 db 8c 7a 11 3b 44 14 3f 52 60 29 53 bb 44 84 01 b5 6f aa 16 f1 83 c2 f2 33 48 ac 52 24 10 cc 23 0f 10 28 ea d5 8a 14 a2 9b e3 91 69 59 29 72 06 9d 61 67 07 9d 5b ab 45 ec b0 a7 ec 30 4d ae 18 11 44 12 97 33 03 a2 e1 35 23 69 78 ea 6f 50 f6 57 8d 10 22 0c d3 ec 4d 51 0b 8b 91 3b 00 aa 37 4e 60 ec 47 Data Ascii: B=(,x-R@A1N:jKjQa=[baLI'"*xPJD P]EEH!9t$r {v<4gK;Q@32/IX~G^dbBz;D?R`)SDo3HR$#(iY)rag[E0MD35#ixoPW"MQ;7N`G
2023-12-21 00:21:18 UTC	13935	IN	Data Raw: 90 22 62 4e 91 3d fb 70 e1 8f 2a 89 44 18 ef f3 04 4e 2c c6 14 9a b3 cf 19 38 67 92 46 c0 b1 3d 52 c0 44 63 3c f1 bf ff 5c 21 10 3f fc 88 26 fa d0 cc fb 5c 81 88 8b e9 84 17 22 e4 05 3d 90 11 23 a1 18 84 fc 10 a4 85 68 3a e6 14 9c 8c 50 13 e4 80 88 4f 22 44 13 7f 18 c3 16 11 e4 05 77 1e 66 0f 2a fe 82 02 18 e0 80 87 40 2c a2 92 04 99 04 22 f4 10 07 dc 69 a8 0e 97 51 84 75 72 d4 9b 27 78 41 0b 55 50 02 8c 18 0a 84 e6 5d 86 13 a9 64 a8 46 7d 73 05 d0 69 06 10 a3 dc e8 46 e1 60 4f c8 4c a2 9a 22 dd 90 14 0e e1 1d 54 fc 41 90 29 4d d0 0f 18 c4 9f 4f d8 61 9e 31 b5 8f 19 00 2a 1f 4c b0 21 a7 f6 51 83 0a ef 34 89 e5 01 15 3b 3f 90 03 4f 7b e4 89 3c f0 f0 a8 bd 61 02 1e 7c 59 2b 71 42 75 37 6f 60 5a b5 36 f1 87 0d 8a 34 0b 7f 30 67 b8 2e b1 87 33 c0 54 9d 70 10 Data Ascii: "bN=pDN,8gF=RDc<\!?&\"=#h:PO"Dwf@,"iQur'xAUP]dF}siF`OL"TA)MOa1*L!Q4;?O{<a\|Y+qBu7o`Z640g.3Tp

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-21 00:21:18 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=64582 Date: Thu, 21 Dec 2023 00:21:18 GMT Content-Length: 55 Connection: close X-CID: 2
2023-12-21 00:21:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:19 UTC	397	OUT	GET /media/369c26_b396f2977e5a40839e2fc77a6f9aac2b~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:19 UTC	763	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 46309 Connection: close Server: openresty/1.21.4.1 Date: Tue, 19 Dec 2023 21:53:45 GMT Expires: Tue, 19 Dec 2023 22:53:45 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Sat, 13 Aug 2022 13:49:12 GMT ETag: "cb93719526bfbcc31f4cd6a067904c0d" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-f89dc7b48-m4z7p Via: 1.1 google, 1.1 33193046475e96dea23c35606f55483e.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: MIA3-C2 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: klNkr0v1pHV9AAgn46Tl7dU7unl1gzELPul5Uaoc-W7ZIjiVzzdSVw== Age: 95254
2023-12-21 00:21:19 UTC	15621	IN	Data Raw: 47 49 46 38 39 61 e7 00 e7 00 f7 00 00 00 00 00 29 96 f6 2a 9b fe 2a 9b fe 2a 9b fe 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2b 9c ff 2c 9c ff 2c 9c ff 2d 9d ff 2d 9d ff 2e 9d fe 2f 9d fe 30 9e fe 30 9e fe 31 9e fe 32 9f fe 32 9f fe 33 9f fe 34 9f fe 35 a0 fe 36 a0 fe 37 a1 fe 38 a1 fe 3a a2 fe 3c a3 fd 3f a4 fd 42 a6 fd 43 a6 fd 45 a7 fd 47 a8 fd 4b a9 fd 4e ab fc 54 ae fc 59 b0 fc 5c b1 fc 5f b2 fb 64 b5 fb 69 b7 fb 6e b9 fa 72 ba fa 77 bd fa 79 be fa 7c bf fa 7e c0 f9 7f c0 f9 82 c1 f9 84 c3 f9 87 c4 f9 88 c4 f9 8a c5 f9 8c c6 f9 8f c8 f8 94 ca f8 99 cc f8 9e ce f8 a4 d0 f7 a9 d3 f7 ae d5 f7 b2 d6 f6 b4 d7 f6 b5 d8 f6 b7 d9 f6 bb da f6 c0 dc f5 c4 de f5 c6 df f5 c8 e0 f5 ca e1 f5 cd e2 f5 ce e2 f4 cf e3 f4 d1 e4 f4 d3 e5 Data Ascii: GIF89a)***+++++++++,,--./00122345678:<?BCEGKNTY\_dinrwy\|~
2023-12-21 00:21:19 UTC	16384	IN	Data Raw: f1 15 d8 d7 a5 a1 96 c9 d7 45 f1 95 d1 d8 05 8c 96 c3 d8 69 f1 d5 e6 d8 c5 8e 16 b8 5d 7f 25 34 76 7d a6 e5 44 76 b5 7a a5 3b 76 49 a8 55 44 76 43 76 b5 46 76 3f a8 65 37 76 07 7a 15 47 76 3c a4 e5 08 f1 cc b9 01 58 f4 90 1d 1d a4 c5 10 fc 03 0b 02 6b a6 96 ec cc 40 11 60 21 d8 75 d4 f2 b4 eb 14 e7 2b a9 62 ce c1 ce b2 3a ec dc cc 2b 7f 10 0f ea ca 42 2c ec c4 8f 2b 80 c3 4e ff d2 c2 37 ec c4 ad 2b c8 c3 0e d2 d2 22 b9 e5 a4 af 2b 84 c3 4e cb d2 52 85 ec ec aa 2b fe dc bb ce 14 d4 e2 85 ec 88 e1 2b b3 6b 4e 16 d4 92 c3 eb 64 ce 2b af 03 ce 11 d3 12 43 da 7d 45 69 d8 71 5e 5a e8 90 1d 1a 44 4c 2b 8e 08 13 76 f0 a0 96 43 64 70 39 e7 e1 0a 1c b2 93 03 b6 40 4b 89 5d 29 22 76 6a b7 96 22 61 07 72 5b 29 a1 13 d9 52 c5 eb 18 0e 2b a3 cb 4e 1a d5 12 88 95 5d 67 Data Ascii: Ei]%4v}Dvz;vIUDvCvFv?e7vzGv<Xk@`!u+b:+B,+N7+"+NR++kNd+C}Eiq^ZDL+vCdp9@K])"vj"ar[)R+N]g
2023-12-21 00:21:19 UTC	14304	IN	Data Raw: 74 73 22 de b6 70 77 8d 9f ab 5b fb 87 5d 19 74 b3 42 44 76 79 d0 2d 76 76 8b d0 2d f9 75 3b b4 1c b5 96 d8 35 ae b6 e7 d9 3d 09 37 20 e2 ed ca 57 8b 56 cd 79 9d 15 7c 49 12 c7 0f 32 5b 85 88 78 be df c5 4a 21 4f ef 46 b6 55 7b 66 17 c9 5d 9e f0 a1 b4 6f 3c 52 f5 77 76 54 d8 35 89 e5 cb e9 2e d5 a5 d9 ed 31 57 2b 87 c8 7a 5d 21 53 29 22 de 0f 9e cc f5 23 da a4 48 85 68 76 ed 9a 4b 26 b0 75 b3 a8 00 2f 3b 02 68 18 5d a6 96 1d 5d 3d 25 13 72 cb 0e 1a ec 62 09 02 5e 47 7d 4a 69 c5 b2 c4 13 3b bb c0 61 3c 7c 68 ca e3 c4 c3 05 bc 58 a2 68 d9 72 c4 52 24 d1 36 f1 6c 0f 2f 3b 13 4f 11 e6 75 14 4e 44 61 3c 70 d0 cb 27 48 95 1d 2b 38 cb 28 fe a6 50 ce fd 8e 86 17 d1 01 cb 76 3d 69 05 ae c6 43 39 be 40 68 3c 62 38 c5 50 5a 61 3a f1 4c 01 89 74 a9 44 0b c5 a3 06 d2 Data Ascii: ts"pw[]tBDvy-vv-u;5=7 WVy\|I2[xJ!OFU{f]o<RwvT5.1W+z]!S)"#HhvK&u/;h]]=%rb^G}Ji;a<\|hXhrR$6l/;OuNDa<p'H+8(Pv=iC9@h<b8PZa:LtD

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=n+aseSwH7oPhhnB&MD=Xo26N4r4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-21 00:21:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 78376eca-4c04-4cdd-a8bb-ead96b2ef6a5 MS-RequestId: 8c45bafa-fd32-464a-9fac-a7d1d1a6a920 MS-CV: rtYYdBpmKkOl8SDQ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Dec 2023 00:21:30 GMT Connection: close Content-Length: 24490
2023-12-21 00:21:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-21 00:21:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:36 UTC	745	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.americanexpress.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:36 UTC	957	IN	HTTP/1.1 302 Found Date: Thu, 21 Dec 2023 00:21:36 GMT Content-Length: 0 Connection: close X-TID: NOpHkXiMSKk= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.americanexpress.com Vary: Origin Access-Control-Allow-Credentials: true Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 DCS: dcs-prod-va6-1-v053-073822bf1.edge-va6.demdex.com 0 ms set-cookie: demdex=04656155214181370602502457914621337045; Max-Age=15552000; Expires=Tue, 18 Jun 2024 00:21:36 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:36 UTC	803	OUT	GET /id/rd?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.americanexpress.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=04656155214181370602502457914621337045
2023-12-21 00:21:36 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:21:36 GMT Content-Type: application/json;charset=utf-8 Content-Length: 213 Connection: close X-TID: tB2dTSxvRbQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.americanexpress.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-va6-1-v053-00fd70b4d.edge-va6.demdex.com 3 ms set-cookie: demdex=04656155214181370602502457914621337045; Max-Age=15552000; Expires=Tue, 18 Jun 2024 00:21:36 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2023-12-21 00:21:36 UTC	213	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 34 35 30 30 30 33 34 38 33 33 37 33 36 36 38 37 31 36 32 35 31 38 30 38 39 36 30 36 34 34 30 33 34 33 39 30 31 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 5d 2c 22 73 75 62 64 6f 6d 61 69 6e 22 3a 22 61 65 78 70 22 2c 22 74 69 64 22 3a 22 74 42 32 64 54 53 78 76 52 62 51 3d 22 7d Data Ascii: {"d_mid":"04500034833736687162518089606440343901","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":7,"d_ottl":7200,"ibs":[],"subdomain":"aexp","tid":"tB2dTSxvRbQ="}

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:37 UTC	534	OUT	GET /id/rd?d_visid_ver=5.0.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=17&ts=1703118094942 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=04656155214181370602502457914621337045
2023-12-21 00:21:37 UTC	711	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:21:37 GMT Content-Type: application/json;charset=utf-8 Content-Length: 213 Connection: close X-TID: YW3wINYZQL8= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-va6-2-v053-087bdf25e.edge-va6.demdex.com 12 ms set-cookie: demdex=04656155214181370602502457914621337045; Max-Age=15552000; Expires=Tue, 18 Jun 2024 00:21:37 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2023-12-21 00:21:37 UTC	213	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 34 35 30 30 30 33 34 38 33 33 37 33 36 36 38 37 31 36 32 35 31 38 30 38 39 36 30 36 34 34 30 33 34 33 39 30 31 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 37 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 5d 2c 22 73 75 62 64 6f 6d 61 69 6e 22 3a 22 61 65 78 70 22 2c 22 74 69 64 22 3a 22 59 57 33 77 49 4e 59 5a 51 4c 38 3d 22 7d Data Ascii: {"d_mid":"04500034833736687162518089606440343901","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":7,"d_ottl":7200,"ibs":[],"subdomain":"aexp","tid":"YW3wINYZQL8="}

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:37 UTC	2304	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=04500034833736687162518089606440343901&ts=1703118096329 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.americanexpress.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703125296s%7CNONE%7CvVersion%7C5.0.0
2023-12-21 00:21:37 UTC	696	IN	HTTP/1.1 200 OK access-control-allow-origin: https://www.americanexpress.com access-control-allow-credentials: true date: Thu, 21 Dec 2023 00:21:37 GMT p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C04500034833736687162518089606440343901; Path=/; Domain=americanexpress.com; Max-Age=63072000; Expires=Sat, 20 Dec 2025 00:21:21 GMT; SameSite=None; Secure vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 48 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2023-12-21 00:21:37 UTC	48	IN	Data Raw: 7b 22 6d 69 64 22 3a 22 30 34 35 30 30 30 33 34 38 33 33 37 33 36 36 38 37 31 36 32 35 31 38 30 38 39 36 30 36 34 34 30 33 34 33 39 30 31 22 7d Data Ascii: {"mid":"04500034833736687162518089606440343901"}

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:38 UTC	619	OUT	GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/uxa.js HTTP/1.1 Host: ct.contentsquare.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.americanexpress.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:38 UTC	681	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 121463 Connection: close Date: Thu, 21 Dec 2023 00:21:39 GMT Last-Modified: Wed, 01 Nov 2023 20:20:51 GMT ETag: "8df35ad4f15e4022175d1f75f371867e" x-amz-server-side-encryption: AES256 Cache-Control: max-age=900 Content-Encoding: gzip x-amz-version-id: AmdcBU9WcGah8KGYBrkXFXkF5geC1sW2 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 465f0c0d430c4cac1a5c12139186b9d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: BQCA4OZeB6h5CCVycyEsmib4U0OF6skSrOBsblI0nABwHrL_IzOReQ== Timing-Allow-Origin: * age: 0 Access-Control-Allow-Origin: *
2023-12-21 00:21:38 UTC	15703	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7b 5f db c8 b2 28 fa ff f9 14 a0 3d 9b 25 0d c2 40 9e 6b ec 28 2c 07 9c c4 33 bc 06 43 32 19 87 e1 0a bb c1 4a 8c e4 91 da 10 06 7b 7f f6 5b 55 fd 50 4b 6a 19 98 c7 b9 e7 de bb 7e b3 82 d5 ef ae ae ae ae aa ae ae ba 0e d3 a5 ed de d9 f6 c1 fe db e0 ce 99 a4 c9 17 36 e0 dd a1 d3 7c fa f2 e5 0b df c9 78 c8 a7 99 d3 dc f4 9d 51 92 f1 38 bc 62 f0 d5 77 e0 6f 1a 0d c2 98 7d 9b a4 2c cb 1a 83 e4 ca f1 31 f5 9b fc 39 c8 d6 b2 34 5a 13 29 fc f7 90 b3 8c 37 a2 f8 22 81 3c 3e 9d b0 e9 b7 49 98 51 e2 20 fb bd 11 61 f2 ef d3 70 cc a1 55 d5 da 38 19 84 63 ec 15 7e 27 f1 38 8a d9 1a 0b 27 13 d5 17 74 ad 7e 5e b2 98 4f d3 c6 90 c9 31 ac 9d 4f 33 28 0e e3 ca 93 be a6 6c 18 f1 af 61 ca 59 6c 24 0f c2 74 28 3e 93 ab 70 84 43 0a bf ea e9 Data Ascii: {_(=%@k(,3C2J{[UPKj~6\|xQ8bwo},194Z)7"<>IQ apU8c~'8't~^O1O3(laYl$t(>pC
2023-12-21 00:21:38 UTC	44	IN	Data Raw: 4e 53 f5 d0 8d 85 95 c0 a3 3b ea f0 9c bd c1 9e 24 f5 3b e7 15 02 de ab 7d fb ba 60 57 6d 55 88 a4 b3 dd 53 57 49 20 14 84 97 0c 59 Data Ascii: NS;$;}`WmUSWI Y
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: 17 a7 65 44 d2 c9 0a d9 88 8f 5d ce ae d0 ca d4 f3 4b 79 97 2a cf 93 8f db 4b f9 02 d5 64 11 5b 6c 62 11 4c 58 b1 18 15 6c 2b 83 db fa 48 e2 17 5e 2f 93 4a f8 68 2f 96 e5 43 d1 d2 9e 20 28 47 f9 aa 1f 57 56 bd f3 90 6a fb 95 6a e7 b6 d1 ff 6c 35 f9 f7 9d f0 3c 99 f2 66 96 0e 80 da 39 14 f8 97 12 9c 3c cc 91 ae a0 2c 6d a4 2b a8 3a 60 14 07 73 64 e3 bc ae b5 03 30 34 83 28 10 5b 0c 59 93 62 f0 e6 21 bd 1e c8 43 7c 97 ea 14 7b 39 ae 45 da 03 82 d4 f2 b2 31 da b1 44 9b 62 13 fb 0b 9b 28 96 3d b0 4d 0a 8d 3b 7f 39 b8 b8 00 44 c6 09 89 0e 29 02 cf 25 fb 64 49 4f 62 cc 19 45 22 32 8f 4e 46 73 d0 52 fd 34 33 8a 34 84 c5 28 45 31 96 36 a3 b6 cc f2 5d 6b a1 49 b1 5f ea f3 55 b8 20 9d 70 11 8d b9 28 53 51 8b 60 ae 78 da 54 97 5d 8e 92 55 5a ee 38 b9 11 35 91 23 85 Data Ascii: eD]Ky*Kd[lbLXl+H^/Jh/C (GWVjjl5<f9<,m+:`sd04([Yb!C\|{9E1Db(=M;9D)%dIObE"2NFsR434(E16]kI_U p(SQ`xT]UZ85#
2023-12-21 00:21:38 UTC	4616	IN	Data Raw: cd 88 49 8c ee 25 49 53 18 e1 cd ba 00 5a 05 ed 21 9b 56 e2 96 35 c2 24 1b 16 cc 51 c4 de 84 5b a0 69 5e e4 0c c6 16 d9 fb a1 97 fe 51 d3 c3 ea 70 00 c8 f3 94 a4 f1 cc dd 5d 01 f6 89 12 e8 85 15 15 89 9b 6e 67 11 e4 28 6d 47 5d e9 be 89 9a 4a 4a ab a1 75 4c 30 3e b8 78 91 81 6c 54 06 19 40 0a bc 88 ef 46 69 35 20 93 36 99 46 1d ce 1f 97 2b 2b d2 e4 9e f2 52 d7 30 ab 2c 79 89 8b 4e 2b 60 ae c9 ec dd 34 8a 3d de 2e 2c f8 0e 16 21 3d 4f e9 b5 a3 bd 66 94 90 46 41 7e 22 a1 e6 98 98 10 c7 63 15 20 03 cf eb f3 f3 09 25 93 ca 44 59 e0 ad ac 14 08 a7 c8 f0 e6 40 8b 15 d7 ea 73 ba b2 92 02 b2 5c 8b 8d 83 94 d9 a2 f7 a7 d9 9e 32 ae e3 3c 62 7b f6 93 c9 e7 15 b7 62 d5 d9 b1 1c 30 6f a0 15 14 44 0a a0 45 eb 02 12 a5 c7 24 09 86 65 ab e2 81 ae 02 b6 34 ce e6 6c 11 c5 Data Ascii: I%ISZ!V5$Q[i^Qp]ng(mG]JJuL0>xlT@Fi5 6F++R0,yN+`4=.,!=OfFA~"c %DY@s\2<b{b0oDE$e4l
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: d9 49 9a 71 ad 50 86 8a 4e 16 cf 14 18 ab 88 5e 76 9c 33 41 e9 9b 25 f6 d7 c0 84 3b f4 30 a0 04 20 34 04 68 c6 3e 39 9f 00 4f c5 a9 be 28 ca 18 90 ae 7e 94 fa 68 69 95 0c 42 98 53 6e 6e 90 55 07 17 89 46 e2 a1 f8 04 70 e3 84 03 9f 6c 2e d1 ce 08 21 5f b9 14 47 04 df e9 34 91 58 e9 e1 32 78 f1 21 b0 c8 ca 4a 16 82 6a 8a 5f 84 46 0e bc cb 2f e8 be a1 d4 b7 20 57 7d f0 71 1d 0b 07 45 21 19 8b 51 2a 92 0d 12 de 34 06 3d cd ec 68 a7 20 17 41 70 6b ba 71 d9 b2 30 19 00 b0 e3 2f 15 16 75 29 24 3a 75 92 9e 94 a7 71 3e 03 f6 b4 8e e2 f1 ec d6 e4 76 6b 72 68 4d e7 21 54 3e a5 f1 c7 2c 82 b6 04 87 c6 99 65 ee 87 cf e1 68 47 ba 88 8e f6 06 3d 46 4b 5a b3 f1 cd e4 6f c0 23 01 56 a4 35 c5 00 5b 66 2e 66 30 23 e3 b8 35 74 c8 8e f2 6b 51 b8 af 6c b5 2b 90 f7 a1 4b a6 33 Data Ascii: IqPN^v3A%;0 4h>9O(~hiBSnnUFpl.!_G4X2x!Jj_F/ W}qE!Q*4=h Apkq0/u)$:uq>vkrhM!T>,ehG=FKZo#V5[f.f0#5tkQl+K3
2023-12-21 00:21:38 UTC	4616	IN	Data Raw: a8 10 8a 19 60 31 08 38 7a da 26 78 64 d8 85 ad fe f6 c1 db b3 8d dd 5d d4 a0 00 28 41 07 ec 8b 33 41 21 47 1d e3 68 96 cb 23 53 81 5b df 32 ef 62 e7 6c 86 36 73 08 37 28 ca df 6a 1b 5c 42 d5 40 50 5a e1 d9 1a b4 5e 81 7b 93 70 82 41 dc 89 f4 6b 1a cd f2 02 12 4e 8b d8 a2 9d 51 49 67 27 76 d3 f3 40 f2 22 8b e4 de 58 86 5f 57 95 d1 82 bf 0e 2b 03 8b e8 22 66 07 1d 3c 73 ba 5b ec 01 65 68 b8 63 ca 22 8d 7f 6d 60 1b e9 92 e4 ac d3 f8 b1 08 ed 32 b4 06 a9 31 eb c9 f8 34 ea 0c c5 55 f4 96 39 89 0f c1 35 2c a7 1d a2 1b 38 9f dd af da 3f 58 7a 82 21 04 d0 65 47 c5 02 85 75 78 f8 9a 92 03 42 bd ab 79 6c 9b 3b 7d 00 db 75 6c ce 59 7b e0 46 37 a5 0b 50 1d b7 48 13 1e e5 cc 1f 79 d6 5a 6b ba 8e 2b 5c dc d7 25 06 24 c6 94 8f ea 90 c9 05 6c eb a5 59 14 63 93 17 bf 7b Data Ascii: `18z&xd](A3A!Gh#S[2bl6s7(j\B@PZ^{pAkNQIg'v@"X_W+"f<s[ehc"m`214U95,8?Xz!eGuxByl;}ulY{F7PHyZk+\%$lYc{
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: f1 c0 03 1e 89 46 f7 ba 6f ba bd 7e 37 59 fb a7 9e 48 bc e6 41 8c e4 c8 3d f9 17 a4 92 cf d6 67 59 98 99 4a 16 36 0d 0f a1 b9 87 9e e6 7a fc 75 02 ca 38 09 bb 6b 50 00 94 c3 22 4d 33 85 34 41 1a 53 72 9b 47 50 42 f4 31 d3 81 fa be 71 4d 94 1a 22 43 45 c5 56 7a 4d 77 cc 00 6c 0b 66 a6 26 dc c2 88 36 51 17 73 0b 9a 1e f3 b6 b4 a6 e8 91 81 be 96 ce 6a 6a 3b 1f e4 6c 8b e3 e8 4c 7d ec 88 d4 ce 22 6a bb 5f 7c 05 c9 af 36 5e bd 56 c9 74 da 26 de ce 71 69 96 d6 39 de af 43 95 b9 6d bf 10 f3 de d8 9b 43 ad 55 6d e7 8d 27 fb 82 7d 70 69 4d 3d 2f dc e3 97 69 b5 59 17 e0 b3 a7 4d b6 87 46 05 e0 a3 69 b8 0b ab 76 57 93 25 1c 97 f1 a7 39 6a a7 4b 86 cd c2 ae a4 0d fd 01 05 fa 0b 05 e9 f2 aa 27 18 fd 99 b1 a5 7a 98 03 6d 41 e8 b1 79 bb c9 82 05 2d 66 46 6a ab 17 1a 9b Data Ascii: Fo~7YHA=gYJ6zu8kP"M34ASrGPB1qM"CEVzMwlf&6Qsjj;lL}"j_\|6^Vt&qi9CmCUm'}piM=/iYMFivW%9jK'zmAy-fFj
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: f5 49 7d f8 dc 92 aa c3 7b a8 b5 f3 6a c9 7b e0 7f e9 6a b6 03 7b 4d 58 40 b8 8b a6 28 ae bc e4 57 68 39 37 28 5e 1d c4 6d 76 d9 b6 3f 18 e4 51 f1 89 c1 00 b0 0a 21 0d 9c 3c 66 92 cf e8 15 07 47 ab 8c ac 2a 7e f0 51 85 d9 c9 5e a2 b1 44 3f 83 13 7d 07 2a f1 f2 ea f9 38 bd 15 27 f7 2e c8 05 ed 9b e0 be 29 be 9d c6 21 90 16 ac 0d fe b6 bc d2 4e b1 15 c5 57 43 38 23 db 43 fa 21 55 a6 34 20 94 3a c3 5e 37 b3 d7 d1 3f 7e 79 fb f6 a7 b7 2d 36 46 ca a7 fc 75 29 3e f1 61 5b 7c 7a 7a 6a 9e a0 06 e3 44 d1 60 6c 44 de 66 e4 bd 8b bc d3 c8 fb 14 79 ef 23 ef f3 5f b5 c9 5d 23 93 5c 90 65 d0 26 77 a2 7c 87 3a 3d 20 a7 ed ab 01 c6 10 9f 64 b8 fb 2c f1 fc 24 72 2d 59 21 8d d3 70 90 38 8e c3 e9 45 f0 03 07 4f f1 c0 2a 27 4b 78 cb a5 9b e3 82 e9 c3 12 51 86 a7 12 fd c8 2b Data Ascii: I}{j{j{MX@(Wh97(^mv?Q!<fG~Q^D?}8'.)!NWC8#C!U4 :^7?~y-6Fu)>a[\|zzjD`lDfy#_]#\e&w\|:= d,$r-Y!p8EO*'KxQ+
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: 2d e7 35 5a 20 4f 34 b8 60 fb 75 36 59 6d 37 34 cc 54 d6 34 13 16 2e bd ad 87 36 8c d9 09 63 fd 8e 22 a7 e2 c1 c9 8c af 0b ee 69 66 61 ee 44 d1 3f 19 96 e9 f5 3e 81 73 b2 32 95 0f 74 c6 8f a9 0e 36 97 58 3c d3 39 ab 18 43 d7 9e b8 a9 3c 71 53 e3 c4 45 cb 3f 8f 45 7d aa 9d 05 34 b8 60 ad dc bf a5 6b 66 8f 97 e2 2f 19 67 70 fc 7b c6 a9 ec 4a 13 98 90 b3 f8 dc 13 87 f9 57 d4 80 e5 ad f3 56 e7 ec 27 ef 67 7e 78 bf e9 20 57 13 f9 a9 38 b9 4b 7f 71 b9 ac 4c 7b 4a 60 6c 26 ed a3 c4 8b ce 4a e0 69 44 7b 7e 62 c5 fe 24 db f3 f2 a5 07 d5 2d f1 ea 7e 16 0c c6 1b 2f a9 d8 02 2d 18 89 db b0 63 b6 99 30 7c d8 6b 67 23 90 b3 11 18 b3 41 f0 95 30 21 f3 9b 39 46 05 e5 ee a7 02 07 01 9a 1d 9f 2f 67 82 c3 ee e7 df c8 1b 98 a7 ea 8e 46 70 0e 27 69 18 21 9a cf b9 b0 88 56 8a Data Ascii: -5Z O4`u6Ym74T4.6c"ifaD?>s2t6X<9C<qSE?E}4`kf/gp{JWV'g~x W8KqL{J`l&JiD{~b$-~/-c0\|kg#A0!9F/gFp'i!V
2023-12-21 00:21:38 UTC	12792	IN	Data Raw: 88 55 71 ba fc 8f 14 8b c8 89 c4 22 7a fe a5 04 f1 62 18 77 32 4b 89 58 b4 76 80 45 61 92 d4 22 62 c5 50 05 37 91 4f 03 c9 ca 8a 87 62 60 d7 43 15 8f 3c 26 cc 4a a9 61 74 a5 d2 ca 64 d1 96 1b fa e1 4a 65 a9 b2 42 ad 65 f8 d6 bd b2 22 d5 2d ef 9c 04 9d 9e 01 42 1a 9a 0d af a3 cb d8 af 84 f0 2f ea 29 ec c5 7d bf 32 8c fb f8 7b 27 b8 98 c0 57 0f ff e0 f7 47 f6 96 e9 d3 a3 26 26 30 7e 96 49 11 2a 70 66 e2 05 e6 5c b9 c0 7c 1d 78 af 16 7e 69 55 8c 0e 87 a3 92 20 78 f3 4c e1 7a 23 ab fa 4b 91 d3 1c 8e ec 2e 06 14 f3 37 c9 6e de cf 02 ee 97 5a 57 ed e1 b4 f6 4d 93 38 9b 6d 21 3b 9a 0b 74 76 aa b3 87 39 09 a8 b7 a2 cd 4c 20 4f 04 bb 1e 76 d2 39 2c cc 69 74 26 5d 87 9c 49 33 69 1d 68 af 8c ef 27 ff d6 7c 90 72 c7 bb 79 58 5b cd 51 04 c5 ab 1d a3 20 74 79 f9 7c 00 Data Ascii: Uq"zbw2KXvEa"bP7Ob`C<&JatdJeBe"-B/)}2{'WG&&0~I*pf\\|x~iU xLz#K.7nZWM8m!;tv9L Ov9,it&]I3ih'\|ryX[Q ty\|

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:38 UTC	2139	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=04500034833736687162518089606440343901&ts=1703118096329 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=ee798af7-438f-4706-9b02-ebd5166b5e82; bm_sz=12B650AF75C266BA4AFBAE6EA2EA3223~YAAQBvzaF+BsFV2MAQAAi66/iRaFd25igjobKqqHOuyxrQ38UukTmh1hlIZPM11b5u0Tqpq7kufrGv355f7J0uq8N8knII78k217k+bkBm+gLVMkQ8/3Jh+MZJtlRUrDyzIkBMqluPgDAL5mjCA6edRH3aJN4XPattZFUoIj+Rc9YRmP1aasHm0S6CKzJpnVougFWg3iFHSFlBjValCQZ86UyJcU4F+AM/34SUDr8j6cg9V5udtFLkttUbJ7+Sevz481gKhxIEx1JJsqn/P/IFCYjq6bHmibOHjXxvfe/X+YbCTCQOX7Jouo7og=~3224113~3293497; pznid=26821221309910448606393816975846215780%7C9; acqpznjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvZmZlcklkIjoiZGVmZTEzNDkwOGIzZWFmMjI3ZWFhNDU2ZGZmODBlNjgiLCJpYXQiOjE3MDMxMTgwOTF9.E5qwK9sSscyRu2m8G-PFAx6NeejRxQzbqGKM3U2ZWu4; TS019b486b=0152a806c18a7dd8fc14622b67b7ef13d8dbb883e6b85bd80b7904850c01df32119f4ea4ceaa900930bd58cc20e2d1a1ba796aea0a; _abck=5B321C7191E1098B5BB3F2C3C10993F6~0~YAAQBvzaFxFuFV2MAQAAMbu/iQvVUAmlT8zmqwoBqzD/o+c00ZI6sKwAckM4wP/871nGN/Jj/nW1Kg5BqNOOOnz+0FOOrL8r57Jy+KE0A4F0kqRAgjhTLMYNUcNegEzoNGe/DiD6iRo1hcugPiNPTEvdn/dL9OULgFl24IIUpswWft8eUq0CskHw2gRJeZcxq/GQxK09z46up+3cIC0ZbXT/BYC/i/JnRVFVgbFaC1bcULSYrjroAte9GuxxC4zCWA/VsIUqJhCUC8Hya0BrhxIhujOzQWOZ2CHzoxI9zsivpBR7zeRqEqQyvw3W8Y6HLhz94WGMQ7UcB9pjEdBRB0mw8iSp5TSNqvizEvBc3u2evik4U9sDztiDPW43gIJvO0E7vPtw5ZB6y5Lre1qPpj+yq68y0vKH0zxfaT5lnOxA~-1~-1~-1; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; s_sess=%20merevar8%3DNavLogo%3B; s_ecid=MCMID%7C04500034833736687162518089606440343901; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C04500034833736687162518089606440343901%7CMCAAMLH-1703722896%7C7%7CMCAAMB-1703722896%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703125296s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.0.0
2023-12-21 00:21:38 UTC	626	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 21 Dec 2023 00:21:38 GMT p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C04500034833736687162518089606440343901; Path=/; Domain=americanexpress.com; Max-Age=63072000; Expires=Sat, 20 Dec 2025 00:21:21 GMT; SameSite=None; Secure vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 48 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2023-12-21 00:21:38 UTC	48	IN	Data Raw: 7b 22 6d 69 64 22 3a 22 30 34 35 30 30 30 33 34 38 33 33 37 33 36 36 38 37 31 36 32 35 31 38 30 38 39 36 30 36 34 34 30 33 34 33 39 30 31 22 7d Data Ascii: {"mid":"04500034833736687162518089606440343901"}

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:39 UTC	619	OUT	GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/ptc.js HTTP/1.1 Host: ct.contentsquare.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.americanexpress.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:39 UTC	680	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 17052 Connection: close Date: Thu, 21 Dec 2023 00:21:40 GMT Last-Modified: Wed, 01 Nov 2023 20:20:49 GMT ETag: "b516e6f2c96dc8752f3670a5693456ab" x-amz-server-side-encryption: AES256 Cache-Control: max-age=900 Content-Encoding: gzip x-amz-version-id: qi1u5eYv6JaIc05pEfzfeoYKXSZbEewN Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 f15eb807b2bdfbab7702d75e3a4f00c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: kepLbEiYnfRb9cukj-xk9whfvjGOARA_3upDHj6OP4BBeNWvTcXodw== Timing-Allow-Origin: * age: 0 Access-Control-Allow-Origin: *
2023-12-21 00:21:39 UTC	8363	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d fb 7b da 3a d2 f0 cf cd 5f e1 b0 bb c5 34 5c 72 e9 e5 94 1c 4e 97 26 e9 49 ba b9 9d 90 a4 dd 26 d9 bc 8e 11 e0 06 6c 6a 1b 28 a7 f0 bf 7f 33 ba d8 92 2d 1b d2 a6 fb ed bb cf cb f3 b4 b1 2d 69 24 8d 46 a3 99 d1 68 54 ab 19 3b de 70 ea 3b dd 5e 68 6c ae af bf ac 6c ae 6f 6e 19 3b 7d c7 be 3f b7 fa c4 38 0c db d5 b2 71 d1 32 4e ad 90 b8 a1 71 4a dc b6 e3 76 57 56 26 8e db f6 26 d5 28 e7 ef 7d ef ce ea 1b 0d 23 23 61 36 33 be cd b7 53 c5 5a 24 0c 01 5e a0 29 18 25 f1 a2 2b 09 90 55 c7 75 42 28 a7 fd cc cb 24 d3 02 db 77 86 61 a0 29 25 52 f2 0b 56 c7 c4 0f 1c cf 45 08 df 0a 13 bf 50 37 0a 77 be d3 ee 92 ca 87 b3 8d 8d f5 ea e7 a0 50 36 0a 43 db c6 94 17 bf 74 5e df dd 6d bc ac dc 91 0d bb f2 7c dd 7a 5e b1 5e 77 5e 56 5e bd Data Ascii: }{:_4\rN&I&lj(3--i$FhT;p;^hllon;}?8q2NqJvWV&&(}##a63SZ$^)%+UuB($wa)%RVEP7wP6Ct^m\|z^^w^V^
2023-12-21 00:21:39 UTC	8689	IN	Data Raw: 1a de eb 0c 59 26 5b 4f 58 cc f5 c4 4f b0 2e ea b0 32 ed b3 36 e6 57 fb 3d b6 9d a5 d6 04 d1 fa 45 eb 02 fe 96 59 1b 28 3c 75 7d c8 6a a8 78 ca 65 c1 22 d3 d2 f6 e8 65 39 31 6d 03 e5 c6 73 1a e8 12 39 72 4e 98 cb 95 95 15 3a 25 02 0c a8 a6 6c 25 6a 6f 9f 2a b2 09 53 2c af f0 90 9b 2d 6f e4 db 44 17 f0 52 4a 86 dc 43 db 8e b2 ca 25 b7 79 a8 2f f9 1b 8e d1 93 3c 78 48 56 bc c1 6f 44 93 32 ee 9e 9c 4c 26 b5 a2 51 37 44 20 d9 ec 4c 14 61 d0 18 73 55 7b cf 1f 74 80 c7 9b 63 02 37 8f ec 0a dd a2 01 3f e2 fe bd 91 9e eb 18 b2 78 b9 86 42 a1 c5 0d a5 99 30 e0 29 8e 32 af 7b 0d 46 e5 27 dd 0f 5a a4 b7 76 89 7e d2 01 88 c3 fe 2e 17 cb 35 59 90 87 23 4b 87 71 d5 e5 b5 7d 2f 08 4e 7c 10 4e 71 05 29 58 ae e7 4e 07 de 08 97 b3 27 e9 dc 16 0f b4 24 2e 21 83 a1 cc bb dc Data Ascii: Y&[OXO.26W=EY(<u}jxe"e91ms9rN:%l%jo*S,-oDRJC%y/<xHVoD2L&Q7D LasU{tc7?xB0)2{F'Zv~.5Y#Kq}/N\|Nq)XN'$.!

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:41 UTC	619	OUT	GET /ss/3776/58f9bb16-be1c-40a4-a9f6-764647d60c8c/57/pcc.js HTTP/1.1 Host: ct.contentsquare.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.americanexpress.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:41 UTC	680	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 20602 Connection: close Date: Thu, 21 Dec 2023 00:21:42 GMT Last-Modified: Wed, 01 Nov 2023 20:20:49 GMT ETag: "b2943019507977942e3a0d2dad788cc1" x-amz-server-side-encryption: AES256 Cache-Control: max-age=900 Content-Encoding: gzip x-amz-version-id: vS_0d2fAaCJkD6pdWvfyb93YjO4pCijS Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 cd671a08a9a338e6b23ebb6b729dea8c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P4 X-Amz-Cf-Id: zcbe8Cjgm_HfeM2_uDm6P6LGcno6-5XprE-yLGsrWswFK4rjramWmA== Timing-Allow-Origin: * age: 0 Access-Control-Allow-Origin: *
2023-12-21 00:21:41 UTC	8364	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7b 57 e3 46 f2 e8 df 3f ce d9 ef 20 34 b9 46 0a b2 cd 63 26 0f 3c 0a 6b 0c cc 90 c0 c0 f0 98 49 02 2c a7 f5 b0 51 90 2d 8f 25 c3 10 ec fb d9 6f 55 75 4b 6a bd 8c 19 26 d9 7b cf cd ee 09 63 49 dd d5 dd d5 d5 d5 55 d5 55 d5 cd a6 d2 09 86 f7 23 af 77 1d 29 6b 2b 2b df d5 d7 56 d6 d6 95 8e ef d9 37 a7 cc 77 95 fd c8 69 18 ca d9 89 72 c4 22 77 10 29 47 ee c0 f1 06 bd 7f 2d fc 6b e1 ce 1b 38 c1 5d 23 29 fb c6 0f 2c e6 2b a6 52 f1 61 32 51 1e a6 ad 62 bd 13 37 8a 00 64 58 52 33 f9 14 d7 fd d7 42 0e 6a c3 1b 78 11 d4 2c 7d 1d d7 ca 7f 0c ed 91 37 8c c2 92 6a f1 97 ea f6 44 89 46 d7 f3 23 77 54 0d 22 2e 00 90 b4 ee 78 60 47 5e 30 50 34 5d 79 f8 d7 c2 ff dc b2 91 32 72 ed 60 84 a8 3c bd 1e b9 e1 75 e0 3b 00 eb 80 45 d7 8d 11 03 Data Ascii: }{WF? 4Fc&<kI,Q-%oUuKj&{cIUU#w)k++V7wir"w)G-k8]#),+Ra2Qb7dXR3Bjx,}7jDF#wT".x`G^0P4]y2r`<u;E
2023-12-21 00:21:41 UTC	12238	IN	Data Raw: ee 79 ef 12 99 20 bd 90 39 3b 7e 40 db e6 3a da 36 cb e2 b0 e3 8e 24 92 51 96 eb 24 29 a7 e3 1e 0f d8 ad d7 c3 a4 ef c6 42 37 cf 8d ce 40 56 a7 08 45 31 e0 71 f2 0c 63 e6 a3 e8 96 8c a2 1b 8f c2 15 a3 e8 e6 47 e1 8a 51 54 f7 3f e9 56 6c 66 2d e5 9e 29 af 36 0a 9d cf ad 16 66 51 9a ba 32 6e a2 48 54 8b ec 1e e5 45 18 61 2b a7 b3 85 d0 a5 41 2f 6c a2 02 da e5 ce cf 05 ca 8b f5 b9 bd 98 8b 4b 3a 1e 70 f6 69 6a 40 ff 6b d1 07 18 49 11 47 86 b2 2c fa c8 06 8f d3 59 ab 2d 48 a2 72 6c 3a e3 76 67 36 8e ae d1 e6 62 63 32 1d be 25 cb 6f 54 a3 ac 9c 2c 53 67 7a 68 c7 b3 25 d9 b7 93 4d d2 4e c9 b5 fa 0c c3 4d 37 71 09 86 b4 19 cb 96 f3 21 c5 ba 56 7e 6a b8 3c 72 f9 91 02 78 de ea 8c ed 08 85 e2 64 8b 7f bc 68 fc 1b 67 ab a5 51 18 7e 56 fe 90 84 0c 51 34 e4 42 cf 91 Data Ascii: y 9;~@:6$Q$)B7@VE1qcGQT?Vlf-)6fQ2nHTEa+A/lK:pij@kIG,Y-Hrl:vg6bc2%oT,Sgzh%MNM7q!V~j<rxdhgQ~VQ4B

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:42 UTC	743	OUT	GET /ddm/activity/src=189445;type=2015b0;cat=amexland;ord=1;num=1? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:42 UTC	767	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:42 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/ddm/activity/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:42 UTC	651	OUT	GET /tr?id=333619020577900&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1 HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:42 UTC	352	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt Alt-Svc: h3=":443"; ma=86400 Date: Thu, 21 Dec 2023 00:21:42 GMT Connection: close Content-Length: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Chrome Cache Entry: 304

Windows Analysis Report
https://browndoguniversity.com/americanexpress-com.connect-online.page/amexs.html

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:42 UTC	744	OUT	GET /px?id=1074652&seg=17009710&redir=https%3A%2F%2Fpixel.mediaiqdigital.com%2Fpixel%3Fu3%3D%26u4%3D%26pixel_id%3D1074652%26uid%3D%24%7BUID%7D&t=2cb=43980388.17658056 HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:42 UTC	1121	IN	HTTP/1.1 307 Redirection Server: nginx/1.21.3 Date: Thu, 21 Dec 2023 00:21:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1074652%26seg%3D17009710%26redir%3Dhttps%253A%252F%252Fpixel.mediaiqdigital.com%252Fpixel%253Fu3%253D%2526u4%253D%2526pixel_id%253D1074652%2526uid%253D%2524%257BUID%257D%26t%3D2cb%3D43980388.17658056 AN-X-Request-Uuid: 18f053e2-f4a2-45f5-9329-091b395da186 Set-Cookie: uuid2=19604228964754290; SameSite=None; Path=/; Max-Age=7776000; Expires=Wed, 20-Mar-2024 00:21:42 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:43 UTC	777	OUT	GET /ddm/activity/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:43 UTC	877	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Dec-2023 00:36:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:43 UTC	894	OUT	GET /pagead/viewthroughconversion/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&ocp_id=FoWDZdq2HLeKqMwPgp-JuAg&random=2030149056&sscte=1&crd=&pscrd=IhMI2pmIrKGfgwMVNwWKAx2CTwKH HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:43 UTC	950	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-user-list/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&random=2030149056&crd=&is_vtc=1&cid=CAQSGwAvHhf_wrQeCHIPZfD03ihwRlnUO3iKqfYp9g&random=1991465498 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Dec-2023 00:36:43 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-21 00:21:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:43 UTC	917	OUT	GET /pagead/viewthroughconversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:43 UTC	1048	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-conversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw&is_vtc=1&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&cid=CAQSGwAvHhf_BIsYsPSfDBnunIQ6WwhgwrmzMdmT-w&random=1344538949 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Dec-2023 00:36:43 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-21 00:21:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:43 UTC	835	OUT	GET /bounce?%2Fpx%3Fid%3D1074652%26seg%3D17009710%26redir%3Dhttps%253A%252F%252Fpixel.mediaiqdigital.com%252Fpixel%253Fu3%253D%2526u4%253D%2526pixel_id%253D1074652%2526uid%253D%2524%257BUID%257D%26t%3D2cb%3D43980388.17658056 HTTP/1.1 Host: secure.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uuid2=19604228964754290
2023-12-21 00:21:43 UTC	1217	IN	HTTP/1.1 302 Found Server: nginx/1.21.3 Date: Thu, 21 Dec 2023 00:21:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://pixel.mediaiqdigital.com/pixel?u3=&u4=&pixel_id=1074652&uid=19604228964754290 AN-X-Request-Uuid: 688fae7d-b875-492a-80cd-43b67cd600a6 Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GU(g.)H8!]tbP6j2F-XstGt!@DC($[+Qb; SameSite=None; Path=/; Max-Age=7776000; Expires=Wed, 20-Mar-2024 00:21:43 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: uuid2=19604228964754290; SameSite=None; Path=/; Max-Age=7776000; Expires=Wed, 20-Mar-2024 00:21:43 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 102.129.152.212; 102.129.152.212; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:43 UTC	964	OUT	GET /ddm/fls/z/src=189445;dc_pre=CIGXhKyhn4MDFTIUigMd0H0OMA;type=2015b0;cat=amexland;ord=1;num=1 HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2023-12-21 00:21:44 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-21 00:21:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:44 UTC	1061	OUT	GET /pagead/1p-user-list/875161762/?label=IsmvCL22-2oQotGnoQM&guid=ON&script=0&ct_cookie_present=false&random=2030149056&crd=&is_vtc=1&cid=CAQSGwAvHhf_wrQeCHIPZfD03ihwRlnUO3iKqfYp9g&random=1991465498 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2023-12-21 00:21:44 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-21 00:21:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:44 UTC	1159	OUT	GET /pagead/1p-conversion/826584552/?label=96d-CKTQ8X4Q6NuSigM&guid=ON&script=0&ct_cookie_present=false&random=815594040&sscte=1&crd=IgEBOAFAAQ&pscrd=CNbaoOPoo7vYYyITCPKviKyhn4MDFaIKTwgdbXwCiw&is_vtc=1&ocp_id=FoWDZfLMHKKVvPIP7fiJ2Ag&cid=CAQSGwAvHhf_BIsYsPSfDBnunIQ6WwhgwrmzMdmT-w&random=1344538949 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2023-12-21 00:21:44 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 21 Dec 2023 00:21:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-21 00:21:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:44 UTC	643	OUT	GET /pixel?u3=&u4=&pixel_id=1074652&uid=19604228964754290 HTTP/1.1 Host: pixel.mediaiqdigital.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.americanexpress.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:44 UTC	141	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:21:44 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2 Connection: close
2023-12-21 00:21:44 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Timestamp	Bytes transferred	Direction	Data
2023-12-21 00:21:44 UTC	467	OUT	POST /quota?ct=0 HTTP/1.1 Host: q-aus1.contentsquare.net Connection: keep-alive Content-Length: 151 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.americanexpress.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-21 00:21:44 UTC	151	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 69 6e 67 54 79 70 65 73 22 3a 5b 35 5d 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 6d 65 72 69 63 61 6e 65 78 70 72 65 73 73 2e 63 6f 6d 2f 3f 69 6e 61 76 3d 4e 61 76 4c 6f 67 6f 22 2c 22 70 72 6f 6a 65 63 74 49 64 22 3a 33 37 37 36 2c 22 75 75 22 3a 22 30 30 64 65 35 38 61 62 2d 66 64 63 35 2d 61 62 64 64 2d 38 65 35 36 2d 30 31 36 39 64 31 32 62 35 61 39 35 22 2c 22 73 6e 22 3a 31 2c 22 70 6e 22 3a 31 7d Data Ascii: {"recordingTypes":[5],"url":"https://www.americanexpress.com/?inav=NavLogo","projectId":3776,"uu":"00de58ab-fdc5-abdd-8e56-0169d12b5a95","sn":1,"pn":1}
2023-12-21 00:21:44 UTC	324	IN	HTTP/1.1 200 OK Date: Thu, 21 Dec 2023 00:21:44 GMT Content-Type: application/json Content-Length: 29 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
2023-12-21 00:21:44 UTC	29	IN	Data Raw: 7b 22 61 6c 6c 6f 77 65 64 52 65 63 6f 72 64 69 6e 67 54 79 70 65 73 22 3a 5b 35 5d 7d Data Ascii: {"allowedRecordingTypes":[5]}