| www.pleasantbee.com/75TNF9/W3N1D7/ |  35.186.217.63 | 302 Found | 235 B |
URL User Request GET HTTP/2www.pleasantbee.com/75TNF9/W3N1D7/ IP35.186.217.63:443
CertificateIssuerStarfield Technologies, Inc. Subjectcmv8ftrk.com Fingerprint08:93:36:9F:E1:4E:1E:B0:C6:80:6D:96:5F:8F:72:C7:58:A0:41:BA ValidityThu, 02 May 2024 14:26:09 GMT - Sat, 09 Nov 2024 16:02:06 GMT
File typeHTML document, ASCII text Hash1aa455eae154d19aa8c7d8dc1865b27e 90c2e68d279427abe22232bc5bd2ec302b6835ae 9ea8a645d188519f64c1e54b1953bd5d320e44a05d55ecd296e34ec33cc6e1d5
GET /75TNF9/W3N1D7/ HTTP/1.1
Host: www.pleasantbee.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Fri, 10 May 2024 04:08:36 GMT
content-type: text/html; charset=utf-8
content-length: 235
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.attractivebee.com/cmp/4CSDX1/27W1G/?__rpt=0&__po=506&__ptid=4e6ab00e666941488df698ee06cab5b5&__rpa=0&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9
set-cookie: uniqueClick_W3N1D7=a53e3534-d6ae-453a-baab-9deb31a2c5f3:1715314116; Path=/; Expires=Fri, 10 May 2024 05:08:36 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: d014111a-3ca3-4255-a98a-0a48a4155e7c
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.attractivebee.com/cmp/4CSDX1/27W1G/?__rpt=0&__po=506&__ptid=4e6ab00e666941488df698ee06cab5b5&__rpa=0&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9 | 35.186.217.63 | 302 Found | 152 B |
URL User Request GET HTTP/2www.attractivebee.com/cmp/4CSDX1/27W1G/?__rpt=0&__po=506&__ptid=4e6ab00e666941488df698ee06cab5b5&__rpa=0&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9 IP35.186.217.63:443
CertificateIssuerStarfield Technologies, Inc. Subjectcmv8ftrk.com Fingerprint08:93:36:9F:E1:4E:1E:B0:C6:80:6D:96:5F:8F:72:C7:58:A0:41:BA ValidityThu, 02 May 2024 14:26:09 GMT - Sat, 09 Nov 2024 16:02:06 GMT
File typeHTML document, ASCII text Hashaa8772b58e80fddc4d395ba1e80863d8 fa5173dcd8ef0dcbec8caa1559feda311f4fe726 3d8299710048a4db7a53cda51cc96823f419e97c5caa2eac3d2e93fdbb567e1a
GET /cmp/4CSDX1/27W1G/?__rpt=0&__po=506&__ptid=4e6ab00e666941488df698ee06cab5b5&__rpa=0&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9 HTTP/1.1
Host: www.attractivebee.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Fri, 10 May 2024 04:08:36 GMT
content-type: text/html; charset=utf-8
content-length: 152
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://zone.love-tracking.com/aff_c?offer_id=12318&aff_id=1206&aff_sub=136&aff_sub2=8b99ab6e673c405eb7b85e999689051d
set-cookie: uniqueClick_27W1G=e9db32be-58a9-4d16-9479-4994ec2519b8:1715314116; Path=/; Expires=Fri, 10 May 2024 05:08:36 GMT; Secure; SameSite=None
transaction_id=8b99ab6e673c405eb7b85e999689051d; Path=/; Expires=Thu, 08 Aug 2024 04:08:36 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 5e884b1f-e8d6-4472-9b18-e16c6feafa15
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/storage/106aa5c1-5468-4287-8a86-c391885f7e8e/icon-cart.jpg?v=3a0f73889ce874f24dd328de53334e750b2dbe83 |  104.21.53.191 | 200 OK | 1.2 kB |
URL GET HTTP/3shouldbyou.click/storage/106aa5c1-5468-4287-8a86-c391885f7e8e/icon-cart.jpg?v=3a0f73889ce874f24dd328de53334e750b2dbe83 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeJPEG image data, progressive, precision 8, 100x100, components 3 Hash50c1e3b00e078e14ddd887fb84e0cb9d 3a0f73889ce874f24dd328de53334e750b2dbe83 032291ce14b39569f2d7101c63ea52377108f20a17b2c70cfd19f6f063a1ec3c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/106aa5c1-5468-4287-8a86-c391885f7e8e/icon-cart.jpg?v=3a0f73889ce874f24dd328de53334e750b2dbe83 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: image/jpeg
content-length: 1164
cache-control: max-age=43200
etag: 3a0f73889ce874f24dd328de53334e750b2dbe83
last-modified: Tue, 19 Mar 2024 13:44:40 GMT
cf-cache-status: HIT
age: 42
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uqlLXRa%2FvFS0Eqcnn9rUyA%2BOy5scoVRy5oNPJ4xKzXfMo1Uac0mE7whbjW9crh3jFjh5lTT0h3cWPEmJvhsibaEwEeu3pkEovjdue3fBDt8KVp9AEwD62MPv7hXgxgk0r4Cc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b42b510b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdn.jsdelivr.net/npm/swiper@10/swiper-bundle.min.js | 104.18.186.31 | 200 OK | 42 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/swiper@10/swiper-bundle.min.js IP104.18.186.31:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65277) Hash254f4cb7566a60c212786f9dd2d2596b 5f3b14b0ecd6172cf897c64fadec73460d6eeec2 d3422c182871135666da685419bbed480a08f51fead9546fb95965a6e47450a3
GET /npm/swiper@10/swiper-bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 41713
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 10.3.1
x-jsd-version-type: version
etag: W/"22ec6-XzsUsOzWFyz4l8ZPrexzRg1u7sI"
content-encoding: br
x-served-by: cache-fra-etou8220129-FRA, cache-lga21946-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5423
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaWwIbZ0djLulLU7bAyGcNKD6wY75ImCTczee644mElqrcRIh7dKcqXoisiItnHJVNrFkHTc%2BC44GKVO0ZWmCp6DWU5emrAEsUINyNWZ%2BZzg6IsypAU%2BUwD%2Fa10lu9EaCXk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711b43b2b5687-OSL
X-Firefox-Spdy: h2
|
|
| cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js | 104.18.186.31 | 200 OK | 25 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js IP104.18.186.31:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65299) Hash6baf57f25796c332144ed58a2a0cd9ee f7fd0f3dc84b2cf93bf81e832505a673f354e0a3 82f64f62bb03c1bc1824b0f9c9e05f70dba33e146818e63cdf5c306c8cf3dedd
GET /npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 25109
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 5.3.2
x-jsd-version-type: version
etag: W/"13b17-9/0PPchLLPk7+B6DJQWmc/NU4KM"
content-encoding: br
x-served-by: cache-fra-etou8220085-FRA, cache-lga21968-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 312588
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2cii8IPio0JpeJgyJDirFkUFm5Dl%2B82iqPa0mw9WLDZdS1PdSoLQy1%2FRHDvL8IQHWVT0fTK3y%2Bn1j6ikNRGiZpLFROiS1MWZI47ddSLDRJapCf6EIblcy5ltcEvRpF%2BJvJE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711b48df5b4fa-OSL
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js | 104.17.25.14 | 200 OK | 27 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash2c872dbe60f4ba70fb85356113d8b35e ee48592d1fff952fcf06ce0b666ed4785493afdc fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 27446
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "64ed75bb-6b36"
last-modified: Tue, 29 Aug 2023 04:36:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 175390
expires: Wed, 30 Apr 2025 04:08:37 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=miaX1jg%2FX9No3GklAccjRgF%2F5r%2BgKDJgZMWndICZptH00Z%2BEKuoTaWyPaCOM%2Fm2D0oGKjbkKaz8x6bK3QfnXar17YEsC9QjxkqU9ht5Ad3WsQss63Gl7cOHGbNXGrVzFxjAyFc2%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b489cd0b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css | 104.17.25.14 | 200 OK | 19 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (52276) Hash5222e06b77a1692fa2520a219840e6be 8b4236206a8b86af3761a244277663046d7ff7ee 0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css; charset=utf-8
content-length: 18778
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "64cac444-495a"
last-modified: Wed, 02 Aug 2023 21:01:56 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 122357
expires: Wed, 30 Apr 2025 04:08:37 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2FlAOPxPJaQjC6KnskonfplxoKSZBwDNjMh9m157M6Zx5gyNKeGfWqLPbmPl0KEOiiXWSPXkycf58OXPNuY5B0azP1qaRbQAfWXf9TXVJpUm%2BYxxENqyS4V7o01%2BjuaA63exUykK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b489d00b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 | 104.17.25.14 | 200 OK | 150 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 150020, version 772.1280 Size150 kB (150020 bytes) Hashd5e647388e2415268b700d3df2e30a0d 97f0942c6627ddd89fb62170e5cac9a2cbd6c98c 886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 150020
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "64cac444-24a04"
last-modified: Wed, 02 Aug 2023 21:01:56 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 811669
expires: Wed, 30 Apr 2025 04:08:38 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ivqs0GexFRVnmJoHhO6Ye%2Bku5xhABQfocLXocb%2FsBL7DBWvJ8SiUuxoQhY0ERd5rrHxK77DdbHagpK175O30eE%2BOxQqBcskfiCe20WyXwVHvKjdN1AikJonrEx5ad3zWvFvuv0IE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b66b060b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 | 104.17.25.14 | 200 OK | 110 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 109808, version 772.1280 Size110 kB (109808 bytes) Hash005c9aa92b564b73b7582cc4f1fa49cb 373361ed756b1fe68ce2f5968d467826b6973bb5 faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1
GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 109808
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "64cac444-1acf0"
last-modified: Wed, 02 Aug 2023 21:01:56 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 200975
expires: Wed, 30 Apr 2025 04:08:38 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LqEbowSeL2bItU7%2BzgRkouTZYUevziovxvyJutz0hPcB0qW7jhObWkRDsT%2FjMz1bJQa2fVmjmmwDM%2F094SfNjCibIOKlEWCxmLbKHtxDCTZgboKk5HnAk7NzaEITEMfyGTL8E0eX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b69ecc1c06-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 | 104.17.25.14 | 200 OK | 110 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 109808, version 772.1280 Size110 kB (109808 bytes) Hash005c9aa92b564b73b7582cc4f1fa49cb 373361ed756b1fe68ce2f5968d467826b6973bb5 faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1
GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-brands-400.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 109808
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "64cac444-1acf0"
last-modified: Wed, 02 Aug 2023 21:01:56 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 200975
expires: Wed, 30 Apr 2025 04:08:38 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BSVkWPyBBs09urhUL7U1v1j40af5MbYgzHVy4%2Fu%2FybiKrwffjjSVpjgmOvDl9rGNBfGMc93BieUhHrzUr8JB6i53w9nwL4CurSd0%2Bg45M7jnSVnc4aaMMZRsB5ELl2h0ReAClFYV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b6ced61c06-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/10a894fc-307d-4319-ae80-9847fd17126b/rating-star.png?v=4a1a445d05ba1bef74dd6d77a21ed2b5333d1272 | 104.21.53.191 | 200 OK | 345 B |
URL GET HTTP/3shouldbyou.click/storage/10a894fc-307d-4319-ae80-9847fd17126b/rating-star.png?v=4a1a445d05ba1bef74dd6d77a21ed2b5333d1272 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typePNG image data, 17 x 16, 8-bit colormap, non-interlaced Hashb690c33f62872fbde7dac5e01cf0707f 4a1a445d05ba1bef74dd6d77a21ed2b5333d1272 bee23f6d6b5ad51ceb0889d8b690ff040cace786344dc83c313d8cdc2df5fb13
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/10a894fc-307d-4319-ae80-9847fd17126b/rating-star.png?v=4a1a445d05ba1bef74dd6d77a21ed2b5333d1272 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/png
content-length: 345
cache-control: max-age=43200
etag: 4a1a445d05ba1bef74dd6d77a21ed2b5333d1272
last-modified: Wed, 27 Apr 2022 14:03:30 GMT
cf-cache-status: HIT
age: 43
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2hqV0Y3SOT2jRpbv7jgLEF5tZSPFVlaME%2BK0kb6zxsJk2iHjLLbr5I9WR3fWdg1yK3H8aZGzDn7Hnkh242%2F4bvnWeFIdpESEMKXt9uE8Q8REeadFfHx2pKG1k6AFTqf0zToq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b6fc7a0b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/86e1a59f-f13c-4f42-a385-ddfbdb98969c/cards.png?v=241c879ccff27bf3c189986e785baffded53e598 | 104.21.53.191 | 200 OK | 75 kB |
URL GET HTTP/3shouldbyou.click/storage/86e1a59f-f13c-4f42-a385-ddfbdb98969c/cards.png?v=241c879ccff27bf3c189986e785baffded53e598 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typePNG image data, 246 x 49, 8-bit colormap, non-interlaced Hash4b81b906ad5f61b438c66f160eb788dc 4e210afc6567ea11cbdc353a41c91e9a69446689 173967c86528aa9467f313de1d193740f7dac70cdc23728e836846c659630b36
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/86e1a59f-f13c-4f42-a385-ddfbdb98969c/cards.png?v=241c879ccff27bf3c189986e785baffded53e598 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/png
cache-control: max-age=43200
etag: 241c879ccff27bf3c189986e785baffded53e598
last-modified: Tue, 14 Jun 2022 07:18:46 GMT
cf-cache-status: HIT
age: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k5mmlH6I5EO%2BFVKbcVivBG279%2FWN6Q%2FQzme9p0Qp3DTPVaCRqSRDu39snMcDvFDTQhol76aLHuSI1QzZCVB%2FPpIernyx9I%2F39tegBLqRpX5Ap7Qy0xRay%2B3LdtM8wIbmSQEB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b6fc790b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 | 104.17.25.14 | 200 OK | 150 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 IP104.17.25.14:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 150020, version 772.1280 Size150 kB (150020 bytes) Hashd5e647388e2415268b700d3df2e30a0d 97f0942c6627ddd89fb62170e5cac9a2cbd6c98c 886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 150020
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "64cac444-24a04"
last-modified: Wed, 02 Aug 2023 21:01:56 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 811669
expires: Wed, 30 Apr 2025 04:08:38 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9UyKqIa6EcC%2BJpTZGpEBc4ZKx1nwaTtwP2vZZEUjeZjRB%2BdI%2FJAYYFlynKj3cWNwU%2FL1MimBLIp8p6qaVaISR1o5%2FDlJuF9%2FzBpyuOGxC%2FN5eNZAgXmD0ZkXGhY9qtuqBJ2OBN8T"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881711b7cf2b1c06-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= | 104.21.53.191 | 200 OK | 16 kB |
URL User Request GET HTTP/2shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= IP104.21.53.191:443
CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (641) Hash1b9bf2296c46c9819c39baf943d17349 dc2a9bfb2b7ca83fb0e585bd99e30963990258f9 bca2a552f7ae0b01f4380880732ec115ee3b7d0b758cc3c8a6fb8e8b19786328
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
x-frame-options: SAMEORIGIN
set-cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; expires=Sat, 25 May 2024 04:08:37 GMT; Max-Age=1296000; path=/; secure
SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D; expires=Sat, 25 May 2024 04:08:37 GMT; Max-Age=1296000; path=/; httponly
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=41wtcngDhHb0hL%2B9SB6LNq%2FLHxMF2o9iwiyfoS1mEQJ6R5ZGoCL7uaTb3nnRcQObvFffVuiCLYPY1Qcfa7GcrurJqGTB8K1qPdBFKfL3eCzIbkWeP0GPabK9zUaD6zokCvX7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711aeb8cdb515-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css | 104.18.186.31 | 200 OK | 38 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css IP104.18.186.31:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeUnicode text, UTF-8 text, with very long lines (65342) Hashcd822b7fd22c8a95a68470c795adea69 1f139981b9b47a766efa0a61bb78ada351f16c4b 3017df4a76db5f01c2b99b603d88b03106df13bcfe18e67b7c13c2341d3a67df
GET /npm/bootstrap@5.3.2/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shouldbyou.click
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 5.3.2
x-jsd-version-type: version
etag: W/"38df4-HxOZgbm0enZu+gphu3ito1HxbEs"
x-served-by: cache-fra-etou8220083-FRA, cache-lga21981-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 312714
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qHXWMB%2BZ%2FNCTHPQtnDtjkeWUzXpuDDxfrwtxIdIEkZTs33xlJPkmX9krAlo94CMARQNR6RiYDsRfQDjHnKHcAkP4E0pfBIZzgLdNoG4nh4sNZcrn3aGID0uSUFOJkBiDqQk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711b47df3b4fa-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/storage/b72a9f4a-44ea-4fcd-a46a-ef0e4da99e6a/check-mark.webp?v=94c19cf9c0de329b3485634d18cca22636f59468 | 104.21.53.191 | 200 OK | 18 kB |
URL GET HTTP/3shouldbyou.click/storage/b72a9f4a-44ea-4fcd-a46a-ef0e4da99e6a/check-mark.webp?v=94c19cf9c0de329b3485634d18cca22636f59468 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeRIFF (little-endian) data, Web/P image Hashbcf281cd57357a7c8047730896d02ba2 6cab5132e9b458da6547a33c074227db2b1fbaed 414f4268b22c9267068b8747c927dd59bae9ea0bd7464820c8a4bd33e7a38330
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/b72a9f4a-44ea-4fcd-a46a-ef0e4da99e6a/check-mark.webp?v=94c19cf9c0de329b3485634d18cca22636f59468 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: image/webp
cache-control: max-age=43200
etag: 94c19cf9c0de329b3485634d18cca22636f59468
last-modified: Thu, 04 Apr 2024 07:05:37 GMT
cf-cache-status: HIT
age: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCHWGslN9iHWkt82vHqPCRN17ZyIPCXb0fLrE%2FA0TWZvrlERRNyKqX0qBxcVmL8dg2ZjS%2Fw5sW6XkqsfzfVvW%2BHNMWRJTeXJjzyFtnzi0Bg9lBUJ4fQcQk5FxffPf3ayNdgb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b43b570b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/c82202d3-8a77-49bd-8ff2-980c84ab8547/styles.css?v=9529b5247169664a4d465b9c40e33454d040d82f | 104.21.53.191 | 200 OK | 611 B |
URL GET HTTP/3shouldbyou.click/storage/c82202d3-8a77-49bd-8ff2-980c84ab8547/styles.css?v=9529b5247169664a4d465b9c40e33454d040d82f IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeASCII text, with very long lines (685), with no line terminators Hash2f04033a6c77dda6558ac2323e9b5f48 5304fd524ba65930232f87a1d0e2534a7dc3ac1e 25d324ce1f55b79ece538b2b38fa8c1008ef587085f4452c43330b320c883bf6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/c82202d3-8a77-49bd-8ff2-980c84ab8547/styles.css?v=9529b5247169664a4d465b9c40e33454d040d82f HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css
cache-control: max-age=43200
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nw5IXem6iaWorvxMqHR4sEjtBjgSrMwy524V5CZLKsHo4aNrEvp3p5D%2F40l7yW5hW37uDKuKovXFdXZoqxP7Nf9PL%2Fc215Ct9IT24QKvFzhZ%2B%2FMua7o17Kze6wl5MiEG%2B9pc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b42b4f0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| unpkg.com/aos@2.3.1/dist/aos.js | 104.17.249.203 | 200 OK | 14 kB |
URL GET HTTP/2unpkg.com/aos@2.3.1/dist/aos.js IP104.17.249.203:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
File typeJavaScript source, ASCII text, with very long lines (14239), with no line terminators Hash70b4897108480dbe11c443c2ab7679c9 70dbfd38a0f1fc3b1a7d9fadab58786484c34f17 f268612ba59ead1b24353bb77d66783bcc435aff1c22be5f93c40bac3869968e
GET /aos@2.3.1/dist/aos.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Thu, 17 May 2018 22:11:13 GMT
etag: "379f-cNv9OKDx/DsafZ+tq1h4ZITDTxc"
via: 1.1 fly.io
fly-request-id: 01HWR4V0DAS96HY7329QE7KJFZ-arn
cf-cache-status: HIT
age: 811779
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881711b47e74568b-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/intl-tel-input@17.0.19/build/js/intlTelInput.min.js | 104.17.249.203 | 200 OK | 30 kB |
URL GET HTTP/2unpkg.com/intl-tel-input@17.0.19/build/js/intlTelInput.min.js IP104.17.249.203:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /intl-tel-input@17.0.19/build/js/intlTelInput.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "734f-tveChQZOzfKDCBYG03tkPAXVi2E"
via: 1.1 fly.io
fly-request-id: 01HWR0VJ93FPXY2VASKRWW3M98-arn
cf-cache-status: HIT
age: 815956
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881711b48e80568b-OSL
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/favicon.ico | 104.21.53.191 | 403 Forbidden | 16 kB |
URL GET HTTP/3shouldbyou.click/favicon.ico IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeHTML document, ASCII text, with very long lines (16415), with no line terminators Hash6f312c11ddfd402491c720909ecd5f5e 461aa280cabe823ee7984fab349129f1cd2c23cf 709bae74fcfc8f5a39d0208551b40ac11019f3433564a2784a7c51ee38fd7be7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 10 May 2024 04:08:38 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: VKpByP4OttEm1QhIc5SgSfXbaT61Fwk94ZS5a0DNY9eJcz6i8zza4OWQ44Im6s1r9T8qed2GaTabO1xC8Yl6a3Ig4bMF2d1GPe2Kz+OCCZUpX5Y3XFRja6SffklSc7vwfuMh304G6RQzVlmRAybTzQ==$RM+VM/W13DyJKjDUZwq/gw==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wiG%2F8oXmqVraqEzzfBhQCgYKiynbcb%2B8z0EPd5x0l92y83%2FCvOgKg8GZVppGe%2BOSW8Ixims0HRfWGld8dXGsXGeVxtDzZqYkxmA8hDU7m3f%2FwtPM1q6U2dPuQ95AxM4vnNdv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b7ecec0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/91a328b2-08eb-40b3-99d3-4c1317e68bcb/summary-icon1.webp?v=4c907c74ef62718903431012314e6f69a698d959 | 104.21.53.191 | 200 OK | 4.2 kB |
URL GET HTTP/3shouldbyou.click/storage/91a328b2-08eb-40b3-99d3-4c1317e68bcb/summary-icon1.webp?v=4c907c74ef62718903431012314e6f69a698d959 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeSVG Scalable Vector Graphics image Hash55bad0e88c8d1aae85b552d72edfde1d bc9ce4b3923cdefc7b9d506d86611ba2b018ea7b 2e5573ed58bfc67ceac2ca5c753a3c3cd2ae4c1bf36c84f8364995903e3fa0c1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/91a328b2-08eb-40b3-99d3-4c1317e68bcb/summary-icon1.webp?v=4c907c74ef62718903431012314e6f69a698d959 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/svg+xml
cache-control: max-age=43200
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xgdfhImhoqlIqFIhDCWTTH8kHTvyd6zEYl9j0Ymx49i8ajA7QXcEZfTcan51d4zZ1fKyq8HcSDeHawb8GIJvfHOg2uGT19m6htK10NK6qjskqZEpm58PZcQmwCOA6V0vHBid"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b6fc7d0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| zone.love-tracking.com/aff_c?offer_id=12318&aff_id=1206&aff_sub=136&aff_sub2=8b99ab6e673c405eb7b85e999689051d | 104.21.67.176 | 302 Found | 49 kB |
URL User Request GET HTTP/2zone.love-tracking.com/aff_c?offer_id=12318&aff_id=1206&aff_sub=136&aff_sub2=8b99ab6e673c405eb7b85e999689051d IP104.21.67.176:443
CertificateIssuerLet's Encrypt Subjectlove-tracking.com Fingerprint45:95:1B:AE:0F:7F:47:9C:E9:A3:AC:79:76:5E:C0:9D:1A:90:0E:39 ValidityFri, 22 Mar 2024 13:35:27 GMT - Thu, 20 Jun 2024 13:35:26 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /aff_c?offer_id=12318&aff_id=1206&aff_sub=136&aff_sub2=8b99ab6e673c405eb7b85e999689051d HTTP/1.1
Host: zone.love-tracking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 10 May 2024 04:08:36 GMT
content-type: text/html; charset=iso-8859-1
location: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
cache-control: no-cache, no-store, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI CUR OUR NOR INT"
pragma: no-cache
set-cookie: enc_aff_session_12318=ENC03a227bfe6ca7a5df66311d9444121cecc84baadaa2ba255fb625056c4398d9ccdd4d5ec6e03b6d6ef4678a2b59477f258384b5033c5cf10599085550510333f0c3efe3d95946c0a95b1f02edfb07c2ed27759cb4ebcdbcf0054e239447cef68456b336fe346b2b5f217132f13e72dd89ec395179c51bc48d5cde2c5778903c44338b22831beb2d0582030f64b31c2dc9589b975c5e65555afd7463745d0d1263c0b296a9e; expires=Mon, 10 Jun 2024 04:08:36 GMT; path=/; SameSite=None; Secure
ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI5Ni4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IFg4Nl82NDsgUnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYWNjZXB0X2xhbmd1YWdlIjoiZW4tVVMsZW47cT0wLjUiLCJjb25uZWN0aW9uX3NwZWVkIjoiYnJvYWRiYW5kIn0=; expires=Sun, 04 Apr 2027 14:48:36 GMT; path=/; SameSite=None; Secure
tracking_id: 1022571a13c5d23d80027d60f09c33
x-robots-tag: noindex, nofollow
access-control-allow-origin: *
x-request-id: 9e15a76a2fc1cf23eb0d547186dbf46a
access-control-allow-headers: Tune-SDK-Version
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3LT1HSTZOdvbebq2A6A0zw6rxoOAkVpcLdNfHyzI%2FK2baD1s%2F%2B%2BahZsEJqVcz8pxRTggprQaLuHJeTy%2FpMYLThSd%2F7dk8YsmTeSKOkiQvefiSukVytTsoVs5IJiVuzNVeDkSp5pdwcR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711ae1b6956cc-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| unpkg.com/intl-tel-input@17.0.19/build/css/intlTelInput.min.css | 104.17.249.203 | 200 OK | 19 kB |
URL GET HTTP/2unpkg.com/intl-tel-input@17.0.19/build/css/intlTelInput.min.css IP104.17.249.203:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
File typeASCII text, with very long lines (19157), with no line terminators Hash6b7fb2ee130535419a67afb198f41c2b ffb8a25633c4ddeab81d1b1742ac2fd0b442a4c6 c6956e8710cf477f7014440385ae16ee4b8cc7ecfd02fddd4d2f0c6c7fd15845
GET /intl-tel-input@17.0.19/build/css/intlTelInput.min.css HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "4ad5-/7iiVjPE3eq4HRsXQqwv0LRCpMY"
via: 1.1 fly.io
fly-request-id: 01HWRA920WHCVCRQDVBJXWJRZ8-arn
cf-cache-status: HIT
age: 806077
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881711b45e68568b-OSL
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/storage/c19cddc1-63c7-4a83-84bf-cbfe746a9691/global-styles.css?v=de661d7eeaf3c3c8c95f21cc7a4cc811e346e789 | 104.21.53.191 | 200 OK | 1.7 kB |
URL GET HTTP/3shouldbyou.click/storage/c19cddc1-63c7-4a83-84bf-cbfe746a9691/global-styles.css?v=de661d7eeaf3c3c8c95f21cc7a4cc811e346e789 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeASCII text, with very long lines (1794), with no line terminators Hash71f25357316f81d64bb04ab7ffb6422f 1ced28e6a9173c35624908ad52c2f7077ab7114a 89b2bf2221bfe706a2780c78a30a0ed1943cfda274d8189b4f8b3df5d81d2b9a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/c19cddc1-63c7-4a83-84bf-cbfe746a9691/global-styles.css?v=de661d7eeaf3c3c8c95f21cc7a4cc811e346e789 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css
cache-control: max-age=43200
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RA0kBdZ2YK2qhi52T%2BQkJDlB3apcq1i2DLR84Z%2Fz4bbKbYQK4f1EYRvCkZnOYbj8uGNSJzXY385ISj35cmjkHtx01%2BdV8LT%2F6nMU8S6OrvaDrXXTUXA6iZONYQHXWhMa8Pij"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b41b4a0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cdn.jsdelivr.net/npm/js-cookie@beta/dist/js.cookie.min.js | 104.18.186.31 | 200 OK | 1.5 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/js-cookie@beta/dist/js.cookie.min.js IP104.18.186.31:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1546), with no line terminators Hash0ce65d25b3ddb57ebd921dc8788728fb 6db9a82f863954d11411a8646a97effc5bfddb94 7ef97a965d3e5c48d1702bc40e3022057b6d6e07d81f51c48e8382e4e9ed513a
GET /npm/js-cookie@beta/dist/js.cookie.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 3.0.0-beta.4
x-jsd-version-type: version
etag: W/"5de-umxYiZHe1aDZ+J/AVp+cMSpsIxY"
x-served-by: cache-fra-eddf8230107-FRA, cache-lga21970-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 10010
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=doOMxYtcywnoQLN1%2FOcshf2B0CSzVHFPSbEPC1RkKaDX48DmvIJ5JnHvDXs5AhEv5v46pcXRqmoy3K%2BIvwy8eIDsdji%2BaMRLapGMbkcp%2BCgfr4ysccSKCPflExR0BKcc%2BeA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711b43b2f5687-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| unpkg.com/intl-tel-input@17.0.19/build/js/utils.js | 104.17.249.203 | 200 OK | 252 kB |
URL GET HTTP/2unpkg.com/intl-tel-input@17.0.19/build/js/utils.js IP104.17.249.203:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
File typeJavaScript source, ASCII text, with very long lines (1454) Size252 kB (252155 bytes) Hash9efa948e4c90fd3b85f6da8b26fea5d1 2c9916f0b09ba12e437eeda82364eb53da0508be 0efad3f5cc55af8cf3e1d0a7c74213fb285c7f242880873f7f83e1c80ca4aa48
GET /intl-tel-input@17.0.19/build/js/utils.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "3d8fb-LJkW8LCboS5Dfu2oI2TrU9oFCL4"
via: 1.1 fly.io
fly-request-id: 01HWRA92J2EZFQDC47JM4BNYZZ-arn
cf-cache-status: HIT
age: 806078
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881711b818c7568b-OSL
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/storage/a9bad42d-d8ea-4277-96f4-aa7b68921906/summary-icon2.webp?v=0edf2bb95d6807582cff785e1eca163c50bd987c | 104.21.53.191 | 200 OK | 2.6 kB |
URL GET HTTP/3shouldbyou.click/storage/a9bad42d-d8ea-4277-96f4-aa7b68921906/summary-icon2.webp?v=0edf2bb95d6807582cff785e1eca163c50bd987c IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeRIFF (little-endian) data, Web/P image Hashe4b3c4d547d29e2a9fbeb21a444675e3 0edf2bb95d6807582cff785e1eca163c50bd987c 6c0a80b24e5349fbc6d0f991bbcd7927397bad36e1164448d1ea5953193e9225
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/a9bad42d-d8ea-4277-96f4-aa7b68921906/summary-icon2.webp?v=0edf2bb95d6807582cff785e1eca163c50bd987c HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/webp
cache-control: max-age=43200
etag: 0edf2bb95d6807582cff785e1eca163c50bd987c
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GvYwK%2BEMwwuMV4JkBovHlGdJQlj2Im53t6wwWUIQatpP3aYcIL0ESENZAQ5N7ScOeTTKSfCLTvz9XsGiWGEb6nUHviyLz6PyE0UWZ8%2FRa5By0D0c8bs0VIPhOFOnIn%2BGfZNo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b6fc7e0b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/f04fd89a-fdad-4a7f-83f3-42cbac3ad8ce/summary-icon3.webp?v=663acce00dbaba22816e31c565685524edfd3f05 | 104.21.53.191 | 200 OK | 11 kB |
URL GET HTTP/3shouldbyou.click/storage/f04fd89a-fdad-4a7f-83f3-42cbac3ad8ce/summary-icon3.webp?v=663acce00dbaba22816e31c565685524edfd3f05 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typePNG image data, 68 x 68, 8-bit/color RGBA, non-interlaced Hash87a6d09add48a8c58fd9c538b7b1a00b 663acce00dbaba22816e31c565685524edfd3f05 f85705953d818e627bbbbbc7169f48e13928778d1e4297c6ae6a97608e780bbb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/f04fd89a-fdad-4a7f-83f3-42cbac3ad8ce/summary-icon3.webp?v=663acce00dbaba22816e31c565685524edfd3f05 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/png
cache-control: max-age=43200
etag: 663acce00dbaba22816e31c565685524edfd3f05
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kc%2B1VPZj34%2B8jFR0zysu3rQ5GSximhy%2FHo4N9Djd2bmvqPdBF2WnK%2ByyNCNt%2F%2B4JEeJnnUcwKC5IZN5z3Z8h4CDg7IQnFk1xp%2BtiaaZeQEjS9E%2FzM8N8tfn%2F9Rzri%2BEOkChs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b6fc800b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdn.jsdelivr.net/npm/swiper@10/swiper-bundle.min.css | 104.18.186.31 | 200 OK | 18 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/swiper@10/swiper-bundle.min.css IP104.18.186.31:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeASCII text, with very long lines (18192) Hasheb21d0f0053cd0b33a1e2107e95156d2 715460aed84071944bc26b7cb1e565f3ed107221 79a42e24b867ff52d9e4d766b96d8882c83f18e7442408a41c4b09a043dffccb
GET /npm/swiper@10/swiper-bundle.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 10.3.1
x-jsd-version-type: version
etag: W/"4813-cVRgrthAcZRLwmt8seVl8+0QciE"
x-served-by: cache-fra-eddf8230084-FRA, cache-lga21950-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 9760
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=21GvpCEGA%2FxCCQPBrLIzh0KJACHGYxsuFqY92F4Qy5WRvZUG0ImcXTSFLsF8trHWi9kTNNAAzF15T0SLBe2MXP3H9IJXtuZzOMt7THSQwrt7KkvzOLLMwQhEh5244DEu2xY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881711b43b2a5687-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| shouldbyou.click/storage/258b120b-bc60-4a89-b623-758b919e2342/styles.css?v=715ca377cd72161d49456ab86fc1fcc684b74532 | 104.21.53.191 | 200 OK | 3.2 kB |
URL GET HTTP/3shouldbyou.click/storage/258b120b-bc60-4a89-b623-758b919e2342/styles.css?v=715ca377cd72161d49456ab86fc1fcc684b74532 IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeASCII text, with very long lines (3575), with no line terminators Hashbbd48240e159b26fc294dbe6a53a8a5d 08927ece656e7ad099003cdaaaf2c5eeb58ed9cd e4f8c4e88d49ca75854d1efdb8ae5da27e7b649e25acf7b165f0c24ed786d40c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/258b120b-bc60-4a89-b623-758b919e2342/styles.css?v=715ca377cd72161d49456ab86fc1fcc684b74532 HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:37 GMT
content-type: text/css
cache-control: max-age=43200
last-modified: Tue, 30 Apr 2024 11:56:08 GMT
cf-cache-status: HIT
age: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZoKT5Ivj1SQSXtk07HtvQbWFuizbSrhzzzE3mDfGQT1ra21FPFeT2QSlhRdfWAJNKqdF9PflUL52HBS%2Fs03tt%2FAJF3Bewt8MVg7BYSSLePdcFB%2FE3tmS6z09czYUms%2FqUHe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b41b4b0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shouldbyou.click/storage/7c1c16e9-f73e-4689-a7e6-09cf4ee702c8/shopping.webp?v=d05d1317261606be1af5d7b0ab974f32246aa1bb | 104.21.53.191 | 200 OK | 30 kB |
URL GET HTTP/3shouldbyou.click/storage/7c1c16e9-f73e-4689-a7e6-09cf4ee702c8/shopping.webp?v=d05d1317261606be1af5d7b0ab974f32246aa1bb IP104.21.53.191:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectshouldbyou.click Fingerprint2A:49:77:D6:C0:E5:87:5F:33:76:F7:CD:CB:7C:64:DB:A4:DD:2A:CC ValidityThu, 18 Apr 2024 10:10:22 GMT - Wed, 17 Jul 2024 10:10:21 GMT
File typeRIFF (little-endian) data, Web/P image Hash687cbb3c3d59112362cbe2b54ab6fccc d05d1317261606be1af5d7b0ab974f32246aa1bb 9fdc133dafbb187e7e58c1573baeb02e66ee515863b61ce0db2409823a3c906a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /storage/7c1c16e9-f73e-4689-a7e6-09cf4ee702c8/shopping.webp?v=d05d1317261606be1af5d7b0ab974f32246aa1bb HTTP/1.1
Host: shouldbyou.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id=
Cookie: XSRF-TOKEN=eyJpdiI6Iis5bTRkRHdnSyt0S2ZJWklUVmZTQkE9PSIsInZhbHVlIjoiZjVqNW5uNFFvYUF6UFlFK0FYWjVIQUZPWDJhRkh2QkhreXpRQ09vTzhjVDZiWHVBUmRRM0ExRlFsNnpFdjRDK2c3NVFITGh1REF1V2FxdzUyVkZQZWJpZ0xSZVZOWXJGdGZoZEM4UjRONUJUUUNGa2JCRkNYY0diWXA1dnliOTciLCJtYWMiOiJiZDE1MTdjMjhkMjY0MGYwNzg3MGFiNjZkN2M0YjE0MTljN2Q3NTUxYjMxMmYxYWIzMmNjOTQ5Y2RjZWRjNGExIiwidGFnIjoiIn0%3D; SESSION_ID=eyJpdiI6IjNyRnBIT04vckFZbmV2WE1mUWdzeWc9PSIsInZhbHVlIjoiVU5FMEhiQTJ3UTZTMWowTTZJWHdORHFTK1VtQjhPaVNuWUFsMUFCa056d2pIZmlxbWk4V2tnclZXRkV0THNHRTJDcTkvZ0JzcWZ1MjFheHBwYmMxakVZR1M1RFN4VWxTWTFQT1RJazZxYVh1T2diNUFrUzV5ZTk4dmhZL1l0K3AiLCJtYWMiOiI5YzU2N2M3Y2EyODJkMDNjMTg3ZDNmZjJmZWI3NjIxMmViNjVmMmJlNjI5MGJjYzA1YTAwN2UzNTY5Mjk2YzQ2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/webp
cache-control: max-age=43200
etag: d05d1317261606be1af5d7b0ab974f32246aa1bb
last-modified: Tue, 09 Jan 2024 09:30:43 GMT
cf-cache-status: HIT
age: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1VzZlKqyo2ImdAwUyobz3ta6G6J20yyfFNNh4x13PRcM7f4jC3J4L44ykMNPwkAvkOndoxaZJwKtEcrOxb8SBzJMweyi44R%2FrJ%2BtZqKFZ%2BJsBwUnqRh%2FpscuR7sbRsCoRfmA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881711b70c820b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| unpkg.com/intl-tel-input@17.0.19/build/img/flags.png | 104.17.249.203 | 200 OK | 71 kB |
URL GET HTTP/2unpkg.com/intl-tel-input@17.0.19/build/img/flags.png IP104.17.249.203:443
Requested byhttps://shouldbyou.click/c/CPqS2Nv1PGcP8bzXymb?s1=1022571a13c5d23d80027d60f09c33&s2=1206&s3=136&offer_id=12318&s4=&p_id= CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
File typePNG image data, 5652 x 15, 8-bit/color RGBA, non-interlaced Hash416250f60d785a2e02f17e054d2e4e44 21572c9751e5a3dc20395befa0fcb349c32c4811 0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55
GET /intl-tel-input@17.0.19/build/img/flags.png HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://unpkg.com/intl-tel-input@17.0.19/build/css/intlTelInput.min.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 04:08:38 GMT
content-type: image/png
content-length: 70857
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "114c9-IVcsl1Hlo9wgOVvvoPyzScMsSBE"
via: 1.1 fly.io
fly-request-id: 01HWR15109ZKW4P12AJ3TTV1X9-arn
cf-cache-status: HIT
age: 815647
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881711b77867568b-OSL
X-Firefox-Spdy: h2
|
|