| b2winadm-qeioqvnqg.com/assets/images/logos/logo-icon.png |  104.21.68.229 | 200 OK | 18 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/images/logos/logo-icon.png IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typePNG image data, 33 x 31, 8-bit/color RGBA, non-interlaced Hash88dea4feb241a942fef45a5152310d96 85b0cbb6d8fd98c744c0f3cc7de456ff86676ffe c47485e05e031836e588ff6889024f5e118f5cd9fca4eedf17a3ce690a782962
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/images/logos/logo-icon.png HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:01 GMT
content-type: image/png
content-length: 17700
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: "4524-613f9691798c7"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X5SBSd2MYR%2BqVFYvNsFQk3p7xipJkhljwngwelrb%2BXKvz87nJ7PduinY99DDpiTQV5A0DOipmPFYeHIDliB3Zfa1axRShMXHd4%2FvZj7CA2ezTUSkKh6%2FFDIUvEw%2B2gA%2FsxvTV32%2FlH5b"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880b1103ada35691-OSL
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/login | 104.21.68.229 | 200 OK | 5.4 kB |
URL User Request GET HTTP/2b2winadm-qeioqvnqg.com/login IP104.21.68.229:443
CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeHTML document, ASCII text Hash0c6f2b89cd8a2039b8a2ff8762bbce06 135c535d73ec530e00798d08cd190bd9c8d03349 70557f136919f837a36795afc61e1c13d50a9b57165b3f6df0426d94c06827d9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: bet2win_admin_session=eyJpdiI6ImlGKzU1RjRzc3liVnY1YjRXUEFlN2c9PSIsInZhbHVlIjoiRW0zZnZQM3AwUnFGekRCa1U0c3hsMFY0V2dyMkNKYWdYRXcwWmVRNVhBRTFxaFFFblZ1UmJsLzZSVzhqZ0dIdkNnWjY4WlBqSjdCMXVSTFAxMDJOTml3K2lPMWhWZ2JvUG5OZk5FZnpxZGE3UUZxR3VBK21ERjJJb2JDd3RNSFoiLCJtYWMiOiIzZjNmNzY5N2YyODg4NjFiNTc4OThjZTc5ODk4ZDY1ODZmZWFjOGUyNjc1ZDQ2YzZlNmI2MGU3ZTE4OTYzMzZmIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 08 May 2024 17:11:00 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D; expires=Wed, 08-May-2024 19:11:00 GMT; Max-Age=7200; path=/
bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; expires=Wed, 08-May-2024 19:11:00 GMT; Max-Age=7200; path=/; httponly
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ev6A3Jyhf%2FQWv%2BDcGJw%2FPwT%2B1NP4kwSA9bSgDJdCPgddaKNPvgbCQl%2FNUrBQaAD5CFE1D2h%2BjaIXWMhXC9DIIYGV96p02c7azguthOJUIqle213sUvM4ibNpxi2aHVkr4usfF4CDbbCB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b10fe590bb509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| b2winadm-qeioqvnqg.com/assets/libs/jquery/dist/jquery.min.js | 104.21.68.229 | 200 OK | 60 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/libs/jquery/dist/jquery.min.js IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeJavaScript source, ASCII text, with very long lines (65451) Hasha09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/libs/jquery/dist/jquery.min.js HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:01 GMT
content-type: application/javascript
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: W/"1538f-613f969175a47-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hw5qL39JGk%2FXS%2BVnFnapKQ3W49ut1zWpD85LmoNSKwSoVm0ax1Pc42ZOeRR424%2BwjCjwJ%2BisyLNH5YvcM0bz8JJNxSL0hY22%2Fbe9ix6Nzt%2BU5%2BSjRwu5yVOD6uag89Bcfu8iu14KmOB3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b1103ada55691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/dist/css/style.min.css | 104.21.68.229 | 200 OK | 111 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/dist/css/style.min.css IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeASCII text, with very long lines (48586) Size111 kB (111102 bytes) Hash34494b2a3d17f05e6448ad4240a4c752 18d8a4395cb1343890875b7192de7d7b30f96781 787bdc3d1cb9d853c9c37c9fe60d4ea0f8b82fc3f14075abca8b7347250cd72c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /dist/css/style.min.css HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:01 GMT
content-type: text/css
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: W/"81723-613f9691a290b-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z7lk9zW2AySgcNN2Yx91c%2F%2FmcVCvC5qT8kdsuIY0OMPpmJV776wGhWlyFPHcxb5ZjfWGA4xWOhvqsgz14T4jDURPCRXEAYh84Ivtb8XI4xqPtCdagLxAE8UYdip8DNka65SvjaqWD5yZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b1103ada15691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| fonts.gstatic.com/s/rubik/v8/iJWHBXyIfDnIV7Eyjmmd8WU.ttf |  142.250.74.163 | 200 OK | 29 kB |
URL GET HTTP/2fonts.gstatic.com/s/rubik/v8/iJWHBXyIfDnIV7Eyjmmd8WU.ttf IP142.250.74.163:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeTrueType Font data, 17 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2015 The Rubik Project AuthorsRubik MediumRegular2.000;UKWN;Rubik-MediumVersion 2.000R Hash1ea0be70443b012852c6c2379308c71c 2a231a17fe452d5957f4cb4bf5b5a1c29e8435c4 7cffca3a3bfa6e50e09b201324ecf13812ec47297e049aa6b974c42d1ea13e0b
GET /s/rubik/v8/iJWHBXyIfDnIV7Eyjmmd8WU.ttf HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://b2winadm-qeioqvnqg.com
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 29220
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 May 2024 04:47:35 GMT
expires: Sat, 03 May 2025 04:47:35 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 19 Feb 2019 22:40:36 GMT
content-type: font/ttf
vary: Accept-Encoding
age: 476606
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/rubik/v8/iJWKBXyIfDnIV7nBrXk.ttf | 142.250.74.163 | 200 OK | 28 kB |
URL GET HTTP/2fonts.gstatic.com/s/rubik/v8/iJWKBXyIfDnIV7nBrXk.ttf IP142.250.74.163:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeTrueType Font data, 17 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2015 The Rubik Project AuthorsRubikRegular2.000;UKWN;Rubik-RegularRubik RegularVersion Hash17bedde315941b70131ecf25e34e8f47 0143c159f471f0277cce105da0332bf0b2946cca 96f9c87907877d9861187cb3649c4f1e826fa2e3ba77da27f47ab14c23105d08
GET /s/rubik/v8/iJWKBXyIfDnIV7nBrXk.ttf HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://b2winadm-qeioqvnqg.com
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 28521
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 May 2024 04:47:35 GMT
expires: Sat, 03 May 2025 04:47:35 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 19 Feb 2019 22:39:32 GMT
content-type: font/ttf
vary: Accept-Encoding
age: 476606
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| b2winadm-qeioqvnqg.com/assets/images/favicon.png | 104.21.68.229 | 200 OK | 17 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/images/favicon.png IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashc3dad2551adc8b320f6bd7296e43cd81 09763d502c21e8891895a4aedac67b5c22b802bc bf8897f1dc34cd600a6ed35c04ee84a1a6fa2c542bcf99b0b41dd2eb18fec7bc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/images/favicon.png HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:02 GMT
content-type: image/png
content-length: 17231
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: "434f-613f96917a867"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hBRjYHtjx9FXHi1UK%2FWcLDj8uZ8n5garD%2FcXNNiCPVe86VWVQZFTsfGuma4djbrVLTAR6oFvFb1TX3Eitv1dy8qDjsq8XJ%2FptDvRHlVZuhCDKkcaR7iy2gNTKi90HhHXy%2FWq0QZvDHnt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880b110ef8525691-OSL
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/dist/css/icons/themify-icons/fonts/themify.woff | 104.21.68.229 | 200 OK | 56 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/dist/css/icons/themify-icons/fonts/themify.woff IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeWeb Open Font Format, CFF, length 56108, version 1.0 Hasha1ecc3b826d01251edddf29c3e4e1e97 9394f35bd2addd24666b79bfc36d4f9d247cb01d 0db5c5a1475eb7a3e5028983ea1e642d1b2c00faff6a250a37502b0f3832a4a7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /dist/css/icons/themify-icons/fonts/themify.woff HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/dist/css/style.min.css
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:02 GMT
content-type: application/font-woff
content-length: 56108
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: "db2c-613f9691a57eb"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bJrHpvaa5LDyBf4qQhBa0KVT2Y0NhCWkaH6TqyfupOnv0VzSmrOPuY9vZSpKhQKus3GvVTuqzijyc7d6MI8xImlmHTirVuBYkVrbp8LfWM3FLh0yC0fFdd09z8MdepMEtiTM0bgiHNrn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880b110bca855691-OSL
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/assets/libs/bootstrap/dist/js/bootstrap.min.js | 104.21.68.229 | 200 OK | 132 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/libs/bootstrap/dist/js/bootstrap.min.js IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeJavaScript source, ASCII text, with very long lines (57791) Size132 kB (131847 bytes) Hashe1d98d47689e00f8ecbc5d9f61bdb42e 6778fed3cf095a318141a31f455c8f4663885bde 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/libs/bootstrap/dist/js/bootstrap.min.js HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:01 GMT
content-type: application/javascript
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: W/"e2d8-613f9691769e7-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tm6qUASUIYo26A8cz6nOOKcj389z0nUir3Jzj25P3s9ECykJWScRsxHA9HZDty6snf5PGg133wjoqOIuvo01Q99tEMwOwiuDAhxV6asdMdw4101bxl1ZnvcFplRcuGt%2BY4Y4B%2BMv5Gkx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b1103adaa5691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/assets/libs/popper.js/dist/umd/popper.min.js | 104.21.68.229 | 200 OK | 20 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/libs/popper.js/dist/umd/popper.min.js IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeJavaScript source, ASCII text, with very long lines (20164) Hash83fb8c4d9199dce0224da0206423106f d8503645c17f9856868a7def3dc0505e19a95ec7 f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/libs/popper.js/dist/umd/popper.min.js HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:01 GMT
content-type: application/javascript
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: W/"4f71-613f969174aa7-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uq3WfccdXM%2BPv2ylIMzFg2W11OsO9uG0o3n4Q5ARJ64qjFwG5BgH%2FeKZmVHIQy93TfSXFilg%2BJ4dScKHxQckdUip8mbm51fm1oBKqk2qPJiegpPa2OuCjI1baL7XMbaKJrAF1knkxsNw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b1103ada65691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| b2winadm-qeioqvnqg.com/getAlarm?_=1715187925403 | 104.21.68.229 | 302 Found | 6.0 kB |
URL User Request GET HTTP/2b2winadm-qeioqvnqg.com/getAlarm?_=1715187925403 IP104.21.68.229:443
CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /getAlarm?_=1715187925403 HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Wed, 08 May 2024 17:10:59 GMT
content-type: text/html; charset=UTF-8
location: https://b2winadm-qeioqvnqg.com/login
cache-control: no-cache, private
set-cookie: bet2win_admin_session=eyJpdiI6ImlGKzU1RjRzc3liVnY1YjRXUEFlN2c9PSIsInZhbHVlIjoiRW0zZnZQM3AwUnFGekRCa1U0c3hsMFY0V2dyMkNKYWdYRXcwWmVRNVhBRTFxaFFFblZ1UmJsLzZSVzhqZ0dIdkNnWjY4WlBqSjdCMXVSTFAxMDJOTml3K2lPMWhWZ2JvUG5OZk5FZnpxZGE3UUZxR3VBK21ERjJJb2JDd3RNSFoiLCJtYWMiOiIzZjNmNzY5N2YyODg4NjFiNTc4OThjZTc5ODk4ZDY1ODZmZWFjOGUyNjc1ZDQ2YzZlNmI2MGU3ZTE4OTYzMzZmIiwidGFnIjoiIn0%3D; expires=Wed, 08-May-2024 19:10:59 GMT; Max-Age=7200; path=/; httponly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IfDU4ae4FaZBkvSHpVRS9G%2BlNjHRVMaB53eoXjkOxdGfWVrEzZ1TAle9wJaFXYI6VXlH3fCcml67OjfEIFiEgvJ%2BlifnJHpWtPaKhrYG%2FHhQniZKOPImAzz9r2AqbXB2T6qK1me0NeyR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880b10fa7ac5b509-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| b2winadm-qeioqvnqg.com/assets/images/big/auth-bg.jpg | 104.21.68.229 | 200 OK | 116 kB |
URL GET HTTP/3b2winadm-qeioqvnqg.com/assets/images/big/auth-bg.jpg IP104.21.68.229:443
Requested byhttps://b2winadm-qeioqvnqg.com/login CertificateIssuerGoogle Trust Services LLC Subjectb2winadm-qeioqvnqg.com Fingerprint2B:61:22:D9:50:B9:4C:3B:4F:65:DB:B0:CE:81:50:BB:58:FD:C1:AE ValidityTue, 19 Mar 2024 03:43:03 GMT - Mon, 17 Jun 2024 03:43:02 GMT
File typeJPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2000x2000, components 3 Size116 kB (115936 bytes) Hash5d0f0ddd2e5eab5a307bbd580aad24f3 abc85c58c43f2e557fb9d2b68da90983dd9aa104 6e12de847d13d26be65010511d4244e3dd4757767dd166531fc66639534cd616
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/images/big/auth-bg.jpg HTTP/1.1
Host: b2winadm-qeioqvnqg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b2winadm-qeioqvnqg.com/login
Cookie: bet2win_admin_session=eyJpdiI6IldGMUI3RXRka3VCOVY3ZnRqK3o5aFE9PSIsInZhbHVlIjoiNDNVb2cwbWFzaFJTYXF4M0NmOTJDSitlTmp6SGthbFV6Tk5EVUJHRnZCUUI3Q1NMZmFoZnpxWVRTL1V3eVpZNkg5VnZUeWtscjkrMjVBTndBZW5Nczl3dDNCS3RLaERUMExaenFyaHdkcmtuMUZ6bnEwUFM3cklPZ2xndkhVTU4iLCJtYWMiOiJjMjRlMjNhNGVhZWRlYzg3ZDNhOTQzMTE3OTU3NzQ2ZTdmZTdhYjJhYjNiYTdhMzdhNmFiOTJiNGQ1OTBjMGFmIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IkozQVYrYlFnenRtRm9qTzRlSzc4NGc9PSIsInZhbHVlIjoiS0lKeUFvZThvNFlkVHJLODN3VmMrdGFSaGlQekROUm8zTXl3aXpOWW41N1dDbURIRENpeW5sQklVRGhNTEJkU1g5cVlqdkpiQ2ZSTW41S2ZpQ1JjMmYxdUc5T3I2NTZwMUNUbXZRazFwRWh1Y3crd2E1MWszNkZQRzIrL2hIaUYiLCJtYWMiOiJjZWE1MGM4MTg0OWFhYzc5YTIzOWE2ZmRjMzNlNmU2MzQ2MDI2M2VlMWUxYmZjMmM0ZTA2MjgyZTY0YTQ5NTI5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 17:11:02 GMT
content-type: image/jpeg
content-length: 115936
last-modified: Tue, 19 Mar 2024 01:29:51 GMT
etag: "1c4e0-613f96917a867"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XEPwqiIGwwpCF4dCZji1zaO8naBaEn%2BjtmwZjFykdB4As0%2FU1FNK1WJBv16OnegJwri%2BraYLDKmT13vaJFQ9kSbOEy4%2BdtKE2yzbFhZ1WecmEZua0J5Q9sHD5ExySPJKvp1TlOluA8f"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880b110bba6e5691-OSL
alt-svc: h3=":443"; ma=86400
|
|