vexationworship.com/xnesdggu?dliuc=62&refer=https://menuphl.com/dunkin-donuts-menu-philippines/&kw=[%22dunkin%22,%22donuts%22,%22menu%22,%22philippines%22,%22updated%22,%22prices%22,%222023%22]&key=622c694e97979a35f9fc0cd0ea427363&scrWidth=1098&scrHeight=686&tz=8&v=23.12.v.1&ship=&sub3=invoke_layer&res=14.31&dev=r&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1&adb=n&adb=n/
1.7 kB URL vexationworship.com/xnesdggu?dliuc=62&refer=https://menuphl.com/dunkin-donuts-menu-philippines/&kw=[%22dunkin%22,%22donuts%22,%22menu%22,%22philippines%22,%22updated%22,%22prices%22,%222023%22]&key=622c694e97979a35f9fc0cd0ea427363&scrWidth=1098&scrHeight=686&tz=8&v=23.12.v.1&ship=&sub3=invoke_layer&res=14.31&dev=r&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1&adb=n&adb=n/
IP
ASN #39572 DataWeb Global Group B.V.
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (980)
Hash c344151c0386a53299219529f9a7a313
9f00d177a17e114aced9ed92cd591e4edc5cbe82
06c22274d8b2e33c2d717034c9e5a23c50f4822243a491e5a9ed79520a0336a0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /xnesdggu?dliuc=62&refer=https://menuphl.com/dunkin-donuts-menu-philippines/&kw=[%22dunkin%22,%22donuts%22,%22menu%22,%22philippines%22,%22updated%22,%22prices%22,%222023%22]&key=622c694e97979a35f9fc0cd0ea427363&scrWidth=1098&scrHeight=686&tz=8&v=23.12.v.1&ship=&sub3=invoke_layer&res=14.31&dev=r&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1&adb=n&adb=n/ HTTP/1.1
Host: vexationworship.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 22:32:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=20796289; expires=Sat, 09 Dec 2023 22:32:04 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDc5NjI4OSwiayI6IjYyMmM2OTRlOTc5NzlhMzVmOWZjMGNkMGVhNDI3MzYzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyOTU4MTgzLCJwaWQiOjEyMzI3MDAsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyOCwicHQiOjQsInBrIjoieG5lc2RnZ3UiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbWVudXBobC5jb20vZHVua2luLWRvbnV0cy1tZW51LXBoaWxpcHBpbmVzLyIsImFyIjpbXX19.ysDIO8-6Ezw_--LasmpebGf4xYcjfxckfNwCpLhQADs; expires=Fri, 08 Dec 2023 22:33:04 GMT
uid_id2=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1; expires=Fri, 15 Dec 2023 22:32:04 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 20ff6f29ca917bb981a5d9998a9eed18
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
vexationworship.com/api/users?token=L3huZXNkZ2d1P2FkYj1uJmRldj1yJmRsaXVjPTYyJmtleT02MjJjNjk0ZTk3OTc5YTM1ZjlmYzBjZDBlYTQyNzM2MyZrdz0lNUIlMjZxdW90JTNCZHVua2luJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jkb251dHMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQm1lbnUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnBoaWxpcHBpbmVzJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0J1cGRhdGVkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JwcmljZXMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQjIwMjMlMjZxdW90JTNCJTVEJnBzdD0xNzAyMDc0Nzg0JnJlZmVyPWh0dHBzJTNBJTJGJTJGbWVudXBobC5jb20lMkZkdW5raW4tZG9udXRzLW1lbnUtcGhpbGlwcGluZXMlMkYmcmVzPTE0LjMxJnJtdGM9dCZzY3JIZWlnaHQ9Njg2JnNjcldpZHRoPTEwOTgmc2hpcD0mc2h1PTNkZGE4YTk3NjI0ODFiZmY1NzhlMzZjNzNjMGY4MjVjZjY3ZTRlMWI4NzlmNjI0ZDhmODZlYTgwN2Y3N2Q3Y2ZiMWQ4ZmU3ZTk0MGY5ZmE2NjAxYmRjMDNmMzNiZWNlYWU0NmJlNzZlMTA2Njc1MDJmMGMwOTMxYjE1NThiMmI4NjY2MDY4N2YxOTA4NDFkMTQxNzhkM2U0MWRmZTU2Mzc5N2ZiZjg3NGM2ODg2OTliODU3MzRhM2QxMzI5YzYmc3ViMz1pbnZva2VfbGF5ZXImdHo9OCZ1dWlkPWMzZmZlMWU1LWRmM2EtNGY0ZC05ZjlmLTAzMzNjMTBiNzdkYyUzQTElM0ExJnY9MjMuMTIudi4x&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc%3A1%3A1&pii=&in=false
0 B URL vexationworship.com/api/users?token=L3huZXNkZ2d1P2FkYj1uJmRldj1yJmRsaXVjPTYyJmtleT02MjJjNjk0ZTk3OTc5YTM1ZjlmYzBjZDBlYTQyNzM2MyZrdz0lNUIlMjZxdW90JTNCZHVua2luJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jkb251dHMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQm1lbnUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnBoaWxpcHBpbmVzJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0J1cGRhdGVkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JwcmljZXMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQjIwMjMlMjZxdW90JTNCJTVEJnBzdD0xNzAyMDc0Nzg0JnJlZmVyPWh0dHBzJTNBJTJGJTJGbWVudXBobC5jb20lMkZkdW5raW4tZG9udXRzLW1lbnUtcGhpbGlwcGluZXMlMkYmcmVzPTE0LjMxJnJtdGM9dCZzY3JIZWlnaHQ9Njg2JnNjcldpZHRoPTEwOTgmc2hpcD0mc2h1PTNkZGE4YTk3NjI0ODFiZmY1NzhlMzZjNzNjMGY4MjVjZjY3ZTRlMWI4NzlmNjI0ZDhmODZlYTgwN2Y3N2Q3Y2ZiMWQ4ZmU3ZTk0MGY5ZmE2NjAxYmRjMDNmMzNiZWNlYWU0NmJlNzZlMTA2Njc1MDJmMGMwOTMxYjE1NThiMmI4NjY2MDY4N2YxOTA4NDFkMTQxNzhkM2U0MWRmZTU2Mzc5N2ZiZjg3NGM2ODg2OTliODU3MzRhM2QxMzI5YzYmc3ViMz1pbnZva2VfbGF5ZXImdHo9OCZ1dWlkPWMzZmZlMWU1LWRmM2EtNGY0ZC05ZjlmLTAzMzNjMTBiNzdkYyUzQTElM0ExJnY9MjMuMTIudi4x&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc%3A1%3A1&pii=&in=false
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /api/users?token=L3huZXNkZ2d1P2FkYj1uJmRldj1yJmRsaXVjPTYyJmtleT02MjJjNjk0ZTk3OTc5YTM1ZjlmYzBjZDBlYTQyNzM2MyZrdz0lNUIlMjZxdW90JTNCZHVua2luJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0Jkb251dHMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQm1lbnUlMjZxdW90JTNCJTJDJTI2cXVvdCUzQnBoaWxpcHBpbmVzJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0J1cGRhdGVkJTI2cXVvdCUzQiUyQyUyNnF1b3QlM0JwcmljZXMlMjZxdW90JTNCJTJDJTI2cXVvdCUzQjIwMjMlMjZxdW90JTNCJTVEJnBzdD0xNzAyMDc0Nzg0JnJlZmVyPWh0dHBzJTNBJTJGJTJGbWVudXBobC5jb20lMkZkdW5raW4tZG9udXRzLW1lbnUtcGhpbGlwcGluZXMlMkYmcmVzPTE0LjMxJnJtdGM9dCZzY3JIZWlnaHQ9Njg2JnNjcldpZHRoPTEwOTgmc2hpcD0mc2h1PTNkZGE4YTk3NjI0ODFiZmY1NzhlMzZjNzNjMGY4MjVjZjY3ZTRlMWI4NzlmNjI0ZDhmODZlYTgwN2Y3N2Q3Y2ZiMWQ4ZmU3ZTk0MGY5ZmE2NjAxYmRjMDNmMzNiZWNlYWU0NmJlNzZlMTA2Njc1MDJmMGMwOTMxYjE1NThiMmI4NjY2MDY4N2YxOTA4NDFkMTQxNzhkM2U0MWRmZTU2Mzc5N2ZiZjg3NGM2ODg2OTliODU3MzRhM2QxMzI5YzYmc3ViMz1pbnZva2VfbGF5ZXImdHo9OCZ1dWlkPWMzZmZlMWU1LWRmM2EtNGY0ZC05ZjlmLTAzMzNjMTBiNzdkYyUzQTElM0ExJnY9MjMuMTIudi4x&uuid=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc%3A1%3A1&pii=&in=false HTTP/1.1
Host: vexationworship.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vexationworship.com/xnesdggu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=20796289
Cookie: u_pl=20796289; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDc5NjI4OSwiayI6IjYyMmM2OTRlOTc5NzlhMzVmOWZjMGNkMGVhNDI3MzYzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyOTU4MTgzLCJwaWQiOjEyMzI3MDAsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyOCwicHQiOjQsInBrIjoieG5lc2RnZ3UiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbWVudXBobC5jb20vZHVua2luLWRvbnV0cy1tZW51LXBoaWxpcHBpbmVzLyIsImFyIjpbXX19.ysDIO8-6Ezw_--LasmpebGf4xYcjfxckfNwCpLhQADs; uid_id2=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.5
Date: Fri, 08 Dec 2023 22:32:05 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: http://ifsnickshriek.click/c9b2l0k.php?key=9du0ziaofrmpuq4tsxmm&SUB_ID_SHORT=305493ee61b84617c3a9ff0d30d479e0&COST_CPC=&PLACEMENT_ID=20796289&CAMPAIGN_ID=922433&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2663448
Set-Cookie: uid_id2=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1; expires=Fri, 15 Dec 2023 22:32:05 GMT
iprcffaf84307e5ebc7f52ad9c414299242e=4795642; expires=Sat, 09 Dec 2023 22:32:05 GMT
pdhtkv=true; expires=Sat, 09 Dec 2023 22:32:05 GMT
uncs=1; expires=Sat, 09 Dec 2023 22:32:05 GMT
pdhtkv28=true; expires=Sat, 09 Dec 2023 22:32:05 GMT
uncs28=1; expires=Sat, 09 Dec 2023 22:32:05 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6974831ebd72d7b1902b25baa3c90842
Strict-Transport-Security: max-age=0; includeSubdomains
vexationworship.com/favicon.ico
0 B URL vexationworship.com/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: vexationworship.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://vexationworship.com/xnesdggu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=20796289
Cookie: u_pl=20796289; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDc5NjI4OSwiayI6IjYyMmM2OTRlOTc5NzlhMzVmOWZjMGNkMGVhNDI3MzYzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyOTU4MTgzLCJwaWQiOjEyMzI3MDAsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyOCwicHQiOjQsInBrIjoieG5lc2RnZ3UiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6OTA3NTM0NTcsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjA2MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTA1LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbWVudXBobC5jb20vZHVua2luLWRvbnV0cy1tZW51LXBoaWxpcHBpbmVzLyIsImFyIjpbXX19.ysDIO8-6Ezw_--LasmpebGf4xYcjfxckfNwCpLhQADs; uid_id2=c3ffe1e5-df3a-4f4d-9f9f-0333c10b77dc:1:1; cjs=t
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 08 Dec 2023 22:32:05 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: be0e652e79db6b75a15437336c7e98b3
Strict-Transport-Security: max-age=0; includeSubdomains
ifsnickshriek.click/c9b2l0k.php?key=9du0ziaofrmpuq4tsxmm&SUB_ID_SHORT=305493ee61b84617c3a9ff0d30d479e0&COST_CPC=&PLACEMENT_ID=20796289&CAMPAIGN_ID=922433&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2663448
0 B URL ifsnickshriek.click/c9b2l0k.php?key=9du0ziaofrmpuq4tsxmm&SUB_ID_SHORT=305493ee61b84617c3a9ff0d30d479e0&COST_CPC=&PLACEMENT_ID=20796289&CAMPAIGN_ID=922433&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2663448
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /c9b2l0k.php?key=9du0ziaofrmpuq4tsxmm&SUB_ID_SHORT=305493ee61b84617c3a9ff0d30d479e0&COST_CPC=&PLACEMENT_ID=20796289&CAMPAIGN_ID=922433&DEVICE_BRAND=Unknown&BROWSER_NAME=Firefox&USER_OS=Windows&USER_CARRIER=Blix%20Solutions&USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0%29%20Gecko%2F20100101%20Firefox%2F105.0&REMOTE_LANGUAGE=11&BANNER_ID=2663448 HTTP/1.1
Host: ifsnickshriek.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.22.0
Date: Fri, 08 Dec 2023 22:32:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=h9xrgmojy9; expires=Sat, 09-Dec-2023 22:32:05 GMT; Max-Age=86400; path=/
uclickhash=h9xrgmojy9-h9xrgmojy9-p2ft-0-q57svr-3z5mdz-3z5mbl-ddd3c0; expires=Sat, 09-Dec-2023 22:32:05 GMT; Max-Age=86400; path=/
Location: https://hxjmm.canopusacrux.top/?pl=ie6-Rfz_PES67g8RDfx_CQ&click_id=a8b65h9xrgmojy9acf&sub_id=20796289
Strict-Transport-Security: max-age=31536000
hxjmm.canopusacrux.top/?pl=ie6-Rfz_PES67g8RDfx_CQ&click_id=a8b65h9xrgmojy9acf&sub_id=20796289
0 B URL hxjmm.canopusacrux.top/?pl=ie6-Rfz_PES67g8RDfx_CQ&click_id=a8b65h9xrgmojy9acf&sub_id=20796289
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?pl=ie6-Rfz_PES67g8RDfx_CQ&click_id=a8b65h9xrgmojy9acf&sub_id=20796289 HTTP/1.1
Host: hxjmm.canopusacrux.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 08 Dec 2023 22:32:05 GMT
content-length: 0
location: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
set-cookie: ie6-Rfz_PES67g8RDfx_CQ=5; max-age=345600; path=/; samesite=lax
__pl=fc571f00-1151-4b09-94bc-36546230f211; expires=Mon, 08 Dec 2025 22:32:05 GMT; path=/; samesite=lax
__cap=1; max-age=3600; path=/; samesite=lax
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ttz61y0S9RABK%2BUYcZx61WhxEr%2FUlyu38PdVEFc%2BYULJ7ZqAnGj6ngGXPvSuoH%2FOTwC4Rjw640srelj0zO1AL%2Fa7r%2BjGOTZvGPKeqeet3BrVZA%2Bl%2B4GaD0PBzNlDWLl07hK81dN061Sh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8328765c48004c8d-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
hxjmm.coreforger.top/eyes-robot/assets/1.png
11 kB URL hxjmm.coreforger.top/eyes-robot/assets/1.png
IP
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /eyes-robot/assets/1.png HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: image/png
content-length: 10591
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-295f"
cache-control: max-age=14400
cf-cache-status: HIT
age: 2307
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lz8gh%2B689Bv3T99u8QjOQ92SfeokyWoEeptmgy1dYqs0Y8hblFRv6RX65qwF%2F3Ip6Hbtot5rJVGfro%2BChs0%2FAbu4iqjsJer0r1Ezd7FHhnKhjllyrC4QN4wnohu5WuUHg4S9RRFqKg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328765f1aad3768-HEL
alt-svc: h3=":443"; ma=86400
hxjmm.coreforger.top/eyes-robot/assets/2.png
1.1 kB URL hxjmm.coreforger.top/eyes-robot/assets/2.png
IP
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /eyes-robot/assets/2.png HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: image/png
content-length: 1061
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-425"
cache-control: max-age=14400
cf-cache-status: HIT
age: 2307
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iLih8EKs1NJcLiDMvlzpKdzV1qUui%2BfodyIJmzapexrPmopwJBsdanUBnnRxyDUIaAoVUz6lEaHIZbcakKncIS%2F63gD%2BA%2F8dj1HWlHs1gYyvdyff2tklb1Hbc1aKDMtezMbbNkIQ6A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328765f1aae3768-HEL
alt-svc: h3=":443"; ma=86400
hxjmm.coreforger.top/eyes-robot/assets/image.png
11 kB URL hxjmm.coreforger.top/eyes-robot/assets/image.png
IP
File type PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Hash ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f
GET /eyes-robot/assets/image.png HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/assets/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: image/png
content-length: 11043
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-2b23"
cache-control: max-age=14400
cf-cache-status: HIT
age: 5151
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xz4XCLDp1qVdDn5Lx1zaoC%2FSpWc7onfewT6UQ8SesKtqXVh3cl3yyOA1d3%2BOqAhdecKK4zquFEGg7d1x%2FmcPSOzbjbkbk3v5%2BHPo8KG5KjOjCvUMCJEQ%2Btiq3ao8ih%2FRb81CeGQzCg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328765fdb863768-HEL
alt-svc: h3=":443"; ma=86400
hxjmm.coreforger.top/favicon.ico
0 B URL hxjmm.coreforger.top/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Fri, 08 Dec 2023 22:32:06 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 5801
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NvZz3nerCXg2rBIxmp7w4P1fnuK4xA2StS38Qigql1EnGxJvJ620JYQhQVKBGcqMltUmvlZmoxXqJrY%2FHa7SmUjkhCTqpTb7ex7%2FlS%2FoPU1m%2BVMVJ9rlOIyIsDFYajKQfjzcM6%2FabQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832876605c293768-HEL
alt-svc: h3=":443"; ma=86400
hxjmm.coreforger.top/shared-js/assets/static-pl.js?v=2
1.7 kB URL hxjmm.coreforger.top/shared-js/assets/static-pl.js?v=2
IP
File type ASCII text, with CRLF line terminators
Hash 7224243dd0b18bb2508a1d77d4b2a0b2
bd833c24aa241861316053fd8bd46a1bef3d343f
920aa94a10634fc23234b5e4f55c428f6311fc7811d3591792381678cb492659
GET /shared-js/assets/static-pl.js?v=2 HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: W/"656ef5c1-dee"
cache-control: max-age=14400
cf-cache-status: HIT
age: 2505
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mlbNhRnF8SMIpDfEU29TYxb8RhFluMtczuQdZr%2Fi%2F8oG2EF%2B5gzJs7RjcyvXHJVp4Hi3TxhQHWtzA99XjK4TmtDUx90hEwnXuVep2ryVrrWa8qvgajenSInoXXjQMBEx92rKoUPJiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328765f1ab43768-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
cdnstatic.coreforger.top/ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ
9.5 kB URL cdnstatic.coreforger.top/ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ
IP
File type ASCII text, with CRLF line terminators
Hash 512755a6a34075b4a23c875b7ae24013
f8cecb3663d1d20fcf19a10af2a47d8238636ed3
d9cc92407823fafcd54c6e83fb6b9a51fbf3a4d9c73b2f4da64243d24ce2f81a
GET /ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ HTTP/1.1
Host: cdnstatic.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/
Cookie: __psu=bc039b5b-3632-4826-ab9c-7b7f8ff19ca2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BKKO0PwscWLtkdnY0NDqv9y0qIkcKcrXbw7OwYPJ6gX25HXdELSW0PvmzjYyEd1Pg%2FLJTBiX9wQ%2BMMaSGkMLf%2BDkCVnkkm57mj4uGuO9Cu3i%2FTWI%2Fj0uQbS0kzbLYfKhonKEPtH8m%2B9H0MM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832876607c443768-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
9.9 kB URL www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP
File type ASCII text, with very long lines (38231)
Hash 0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522
GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 05:05:35 GMT
expires: Fri, 06 Dec 2024 05:05:35 GMT
cache-control: public, max-age=31536000
age: 149191
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
a.coreforger.top/eyes-robot/assets/2.png
1.1 kB URL a.coreforger.top/eyes-robot/assets/2.png
IP
File type PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Hash d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
GET /eyes-robot/assets/2.png HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: image/png
content-length: 1061
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-425"
cache-control: max-age=14400
cf-cache-status: HIT
age: 6566
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iE7i7IGUdU2hfiE0snw19b%2BuFxTKhzQfW3YT%2BTDnRePvvFBMvxrnpCYOu7yAxhI92eIIKsLb%2F3lCAkGYvPhI9OhQeEjRsqr%2FLvo%2FL8VZIPGxLz7b3DILG6HjUr%2B8R%2FrNnNrg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83287662ff4b3768-HEL
alt-svc: h3=":443"; ma=86400
a.coreforger.top/eyes-robot/assets/1.png
11 kB URL a.coreforger.top/eyes-robot/assets/1.png
IP
File type PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Hash a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
GET /eyes-robot/assets/1.png HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: image/png
content-length: 10591
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-295f"
cache-control: max-age=14400
cf-cache-status: HIT
age: 6566
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SLXRBdulAelGhsPQqvTEKLETUG64kxYK8tJ41z5vhC%2BBopD9TmMS0gzyEVhNZpGq036ckbNvVfGSKrWznmvMcWimj0Czv6RreT1gtNFoubUkeWnmx6O7pSKBKo%2FKlLpq5jjd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83287662ff493768-HEL
alt-svc: h3=":443"; ma=86400
hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
12 kB URL hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash d091598187b0c2607db0dc04029e3457
0594d408ea97d509719300d8e4c19ce49078f55b
9f40361e807d9f0d4bbb68b5e68f9626231ae6b04fb26262190529eff247ddf8
GET /eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025 HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 22:32:05 GMT
content-type: text/html
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QwWoalPQ%2BOlIQGuonZxXY4RhvmuN7g5BQXMAQRJg684ds%2B1InlI%2Bb9fnNyYGNGNfBJqVfpTDIKmqDzPby30NHp%2Fvy88wPq3cONPH3gzSpw6UOysqXcypsiY3QuWRNJ%2BhkpXcEsaYqA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8328765d3a0d376a-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdnstatic.coreforger.top/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=8c6927303e9043068b81755b900ff254
13 kB URL cdnstatic.coreforger.top/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=8c6927303e9043068b81755b900ff254
IP
File type Unicode text, UTF-8 text, with very long lines (31624), with no line terminators
Hash 2a6f55ce424a84fa0e39a71a92ae7494
28afb38c99115461e63cc49208e902e94e556c22
81d046796e5bfb8878119edaef532cc4897917f036279f1e5fd09a7483168a39
GET /ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=8c6927303e9043068b81755b900ff254 HTTP/1.1
Host: cdnstatic.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/
Cookie: __psu=bc039b5b-3632-4826-ab9c-7b7f8ff19ca2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5SKg5B7yh9dhVE8kY3q3kSFNubI4UIZxChM1LFeF70nbK6S652HGq6Voqj0aY1id6fmLD0aA%2ByAUg0dKA1Y5rYynYeCah46zH1o%2F6F4MHvdfjxlpp4a31%2BFqvbipVEhE%2Fb789dFKjX2dsLQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832876637ffb3768-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
cdnstatic.coreforger.top/ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ
9.5 kB URL cdnstatic.coreforger.top/ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ
IP
File type ASCII text, with CRLF line terminators
Hash 512755a6a34075b4a23c875b7ae24013
f8cecb3663d1d20fcf19a10af2a47d8238636ed3
d9cc92407823fafcd54c6e83fb6b9a51fbf3a4d9c73b2f4da64243d24ce2f81a
GET /ps/config.js?id=ie6-Rfz_PES67g8RDfx_CQ HTTP/1.1
Host: cdnstatic.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/
Cookie: __psu=bc039b5b-3632-4826-ab9c-7b7f8ff19ca2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:07 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ng9SOjBKvRckejY9Pc0vXu%2Bs1uTVCAlzhe8%2F6e63%2BV%2Foodi%2Bz2Wlx9fFupJY8no9N7hy1CEhRtjdsxmcerR4SHWDPl3Ou%2B3TGingsL4dONM1B2C3Z6uuUDWdzXLqAlws%2F1vIU5%2BTGCY6Gag%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328766408843768-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
9.9 kB URL www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP
File type ASCII text, with very long lines (38231)
Hash 0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522
GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 05:05:35 GMT
expires: Fri, 06 Dec 2024 05:05:35 GMT
cache-control: public, max-age=31536000
age: 149192
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
keefeezo.net/sftouch?userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf
2 B URL keefeezo.net/sftouch?userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf
IP
File type ASCII text, with no line terminators
Hash 444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /sftouch?userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf HTTP/1.1
Host: keefeezo.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://keefeezo.net
DNT: 1
Connection: keep-alive
Referer: https://keefeezo.net/4/6666140
Cookie: OAID=8398272d56c94dfe84a752c43cc4aa34; oaidts=1702074727
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 08 Dec 2023 22:32:07 GMT
content-type: text/plain
content-length: 2
x-trace-id: 47756861cb94f1d1c56c08c6040e3074
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://keefeezo.net
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
keefeezo.net/favicon.ico
0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: keefeezo.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://keefeezo.net/4/6666140
Cookie: OAID=8398272d56c94dfe84a752c43cc4aa34; oaidts=1702074727
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Fri, 08 Dec 2023 22:32:07 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
pragma: public
cache-control: max-age=315360000, public, must-revalidate, proxy-revalidate
X-Firefox-Spdy: h2
my.rtmark.net/img.gif?f=merge&userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf
43 B URL my.rtmark.net/img.gif?f=merge&userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=merge&userId=8398272d56c94dfe84a752c43cc4aa34&z=6666140&p_rid=5cdd8d54-a8ee-4c12-807f-5071a7bcc848&p_src=sf HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://keefeezo.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 08 Dec 2023 22:32:07 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=8398272d56c94dfe84a752c43cc4aa34; expires=Sat, 07 Dec 2024 22:32:07 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
hxjmm.coreforger.top/eyes-robot/assets/trls.js
1.7 kB URL hxjmm.coreforger.top/eyes-robot/assets/trls.js
IP
File type Unicode text, UTF-8 text, with very long lines (362), with CRLF line terminators
Hash 0cdacbfa8d68265ac3893b159a75682a
a85878b59036d00ac878739dc187305bc29df8c3
2fb2aad4f3b3426df4bb5633b627f529940bd06d0690f6b11cfcf42f0fea3e4b
GET /eyes-robot/assets/trls.js HTTP/1.1
Host: hxjmm.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hxjmm.coreforger.top/eyes-robot/?pl=ie6-Rfz_PES67g8RDfx_CQ&sm=eyes-robot&click_id=a8b65h9xrgmojy9acf&sub_id=20796289&nrid=8c6927303e9043068b81755b900ff254&hash=i-6aQnMPTdJQoOApvPBPrQ&exp=1702075025
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 22:32:06 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: W/"656ef5c1-2af6"
cache-control: max-age=14400
cf-cache-status: HIT
age: 2307
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6F5ThbuJTmhKGVuv5JwGNO6KZYDAzTYw1oWqzubzZqc%2BaWkJzpWSNa6GtQ9d3hqeoxJxwvRYeQVfRkDO9%2FIv3aG9M%2FJy%2F1cb4RCT%2F%2BVWjI%2FaxMqYwvqma2fTSm%2FOVf3eg9XCJR4VlA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8328765f0a9f3768-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
gl0a7loeki02do.com/news.php?key=fz85sv8weugl8pkww9gu&SUBID=757118888302616641&cost=0.000455&zoneid=6666140&browser=firefox&browserversion=105&device=desktop&isp=blix%20group%20as&country=NO&os=windows&osversion=win10&carrier=?&language=en
302 Found 0 B URL User Request GET HTTP/1.1 gl0a7loeki02do.com/news.php?key=fz85sv8weugl8pkww9gu&SUBID=757118888302616641&cost=0.000455&zoneid=6666140&browser=firefox&browserversion=105&device=desktop&isp=blix%20group%20as&country=NO&os=windows&osversion=win10&carrier=?&language=en
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjectgl0a7loeki02do.com
Fingerprint63:1A:B9:58:A8:30:FD:6E:5D:65:70:EC:3B:31:59:71:62:75:F2:55
ValidityFri, 01 Dec 2023 16:50:17 GMT - Thu, 29 Feb 2024 16:50:16 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /news.php?key=fz85sv8weugl8pkww9gu&SUBID=757118888302616641&cost=0.000455&zoneid=6666140&browser=firefox&browserversion=105&device=desktop&isp=blix%20group%20as&country=NO&os=windows&osversion=win10&carrier=?&language=en HTTP/1.1
Host: gl0a7loeki02do.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.22.0
Date: Fri, 08 Dec 2023 22:32:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=4kciejpm0; expires=Sat, 09-Dec-2023 22:32:08 GMT; Max-Age=86400; path=/; secure; SameSite=none
uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65; expires=Sat, 09-Dec-2023 22:32:08 GMT; Max-Age=86400; path=/; secure; SameSite=none
Location: https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Strict-Transport-Security: max-age=31536000
3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
200 OK 1.4 kB URL User Request GET HTTP/1.1 3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subject3tght76h.com
Fingerprint69:86:04:06:BA:1E:8D:32:8D:DC:3C:8A:58:4B:75:CE:E7:C1:2B:45
ValidityWed, 15 Nov 2023 12:22:03 GMT - Tue, 13 Feb 2024 12:22:02 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 26bc2b889534aead062fab4a41c790fe
c17fc01dc4cb6a7cb7fc24a73bad25b8e8115242
16e5a8b96ca3feecf8acdc49f84fba4486ff5a1bc7cd77bb1c88f3caf8d4fd82
GET /1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65 HTTP/1.1
Host: 3tght76h.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Fri, 08 Dec 2023 22:32:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
www.googletagmanager.com/gtm.js?id=GTM-547JG5H
200 OK 45 kB URL GET HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-547JG5H
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintC1:58:7C:BF:5A:61:79:08:CB:C2:00:63:60:07:86:BD:EA:0A:45:8A
ValidityMon, 20 Nov 2023 08:02:50 GMT - Mon, 12 Feb 2024 08:02:49 GMT
File type ASCII text, with very long lines (2213)
Hash 2a88587bb631c5de26185e05f9d590d8
8730783df7020d47249313bcd61813e22a271d5a
dd6f395dc71f86aa6ef87560d58833e343f1d366a199ced0961f268528c89336
GET /gtm.js?id=GTM-547JG5H HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 08 Dec 2023 22:32:09 GMT
expires: Fri, 08 Dec 2023 22:32:09 GMT
cache-control: private, max-age=900
last-modified: Fri, 08 Dec 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 45248
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
3tght76h.com/1/bg.png
200 OK 61 kB IP
ASN #24940 Hetzner Online GmbH
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerLet's Encrypt
Subject3tght76h.com
Fingerprint69:86:04:06:BA:1E:8D:32:8D:DC:3C:8A:58:4B:75:CE:E7:C1:2B:45
ValidityWed, 15 Nov 2023 12:22:03 GMT - Tue, 13 Feb 2024 12:22:02 GMT
File type PNG image data, 400 x 299, 8-bit grayscale, non-interlaced\012- data
Hash d7096ad35844972e015e865729d13235
42c79d98b50275dcc447bd61d845ee2ed52ae45e
8bccdb408e67a3b44e0f5d417486c8d251f2e4acbae8542465aad3c7052341dd
GET /1/bg.png HTTP/1.1
Host: 3tght76h.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Fri, 08 Dec 2023 22:32:09 GMT
Content-Type: image/png
Content-Length: 61362
Last-Modified: Wed, 15 Nov 2023 13:23:49 GMT
Connection: keep-alive
ETag: "6554c665-efb2"
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
3tght76h.com/favicon.png
404 Not Found 114 B IP
ASN #24940 Hetzner Online GmbH
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerLet's Encrypt
Subject3tght76h.com
Fingerprint69:86:04:06:BA:1E:8D:32:8D:DC:3C:8A:58:4B:75:CE:E7:C1:2B:45
ValidityWed, 15 Nov 2023 12:22:03 GMT - Tue, 13 Feb 2024 12:22:02 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash ac5ea41aae137cead073d37a7bb732bc
85bde4b57e1f38bd7ff0e6cf4b6ac5f626a5fbae
fcdc802dabd14bed15efb9235ee0decac4adb6908dca03eeba74e2bf8f4eb5a7
GET /favicon.png HTTP/1.1
Host: 3tght76h.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.22.0
Date: Fri, 08 Dec 2023 22:32:09 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
200 OK 191 kB URL GET HTTP/3 www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (563)
Size 191 kB (190682 bytes)
Hash 23b9dd721490a4062ba8d01454ef6ba9
efdbb7331585411f7d397dacbf51fd3e95f3031d
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
GET /recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3tght76h.com
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 190682
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 11:51:19 GMT
expires: Fri, 06 Dec 2024 11:51:19 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 124850
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
200 OK 49 kB URL GET HTTP/3 www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:3A:D9:47:14:B0:78:30:A1:BF:B4:45:F6:F5:81:AD:0A:C7:76:89
ValidityMon, 20 Nov 2023 08:02:55 GMT - Mon, 12 Feb 2024 08:02:54 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (31522)
Hash 6157d32c8fdfa1b077a717f58b72fd56
e9ba1612ff32164056b8ce1f8f83d00818063bdc
40d2b1b5fc173b3fdc4367f941471787ddeb7df12f10141f906ef63ba871042e
GET /recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 08 Dec 2023 22:32:09 GMT
content-security-policy: script-src 'nonce-_VpRbZcEX9OB1UByyAEG-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
200 OK 191 kB URL GET HTTP/3 www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (563)
Size 191 kB (190682 bytes)
Hash 23b9dd721490a4062ba8d01454ef6ba9
efdbb7331585411f7d397dacbf51fd3e95f3031d
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
GET /recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 190682
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 11:51:19 GMT
expires: Fri, 06 Dec 2024 11:51:19 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 124850
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:54:46 GMT
expires: Fri, 06 Dec 2024 15:54:46 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
age: 110244
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
200 OK 191 kB URL GET HTTP/3 www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (563)
Size 191 kB (190682 bytes)
Hash 23b9dd721490a4062ba8d01454ef6ba9
efdbb7331585411f7d397dacbf51fd3e95f3031d
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
GET /recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 190682
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 11:51:19 GMT
expires: Fri, 06 Dec 2024 11:51:19 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 124851
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/recaptcha/api2/logo_48.png
200 OK 2.2 kB URL GET HTTP/3 www.gstatic.com/recaptcha/api2/logo_48.png
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash ef9941290c50cd3866e2ba6b793f010d
4736508c795667dcea21f8d864233031223b7832
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
GET /recaptcha/api2/logo_48.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 2228
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 16:21:15 GMT
expires: Thu, 14 Dec 2023 16:21:15 GMT
cache-control: public, max-age=604800
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
age: 108655
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.google.com/js/bg/kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js
200 OK 6.9 kB URL GET HTTP/3 www.google.com/js/bg/kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:3A:D9:47:14:B0:78:30:A1:BF:B4:45:F6:F5:81:AD:0A:C7:76:89
ValidityMon, 20 Nov 2023 08:02:55 GMT - Mon, 12 Feb 2024 08:02:54 GMT
File type ASCII text, with very long lines (17050), with no line terminators
Hash 387099637df506ffbd3e00cb7d5c474a
f50240a6d036b68bc26812d87f8c887538691178
927da8c0f53be094ec3b04c6b72d1aa149574522922628425b104ccc4dda2d0b
GET /js/bg/kn2owPU74JTsOwTGty0aoUlXRSKSJihCWxBMzE3aLQs.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 6851
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 08 Dec 2023 03:42:23 GMT
expires: Sat, 07 Dec 2024 03:42:23 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 28 Nov 2023 18:30:00 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 67787
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
200 OK 25 kB URL GET HTTP/3 www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
IP
Requested by https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (56398), with no line terminators
Hash eb4bc511f79f7a1573b45f5775b3a99b
d910fb51ad7316aa54f055079374574698e74b35
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
GET /recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24606
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 23:27:04 GMT
expires: Fri, 06 Dec 2024 23:27:04 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
content-type: text/css
vary: Accept-Encoding
age: 83106
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
200 OK 191 kB URL GET HTTP/3 www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type ASCII text, with very long lines (563)
Size 191 kB (190682 bytes)
Hash 23b9dd721490a4062ba8d01454ef6ba9
efdbb7331585411f7d397dacbf51fd3e95f3031d
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
GET /recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 190682
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 11:51:19 GMT
expires: Fri, 06 Dec 2024 11:51:19 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 124851
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui
200 OK 7.3 kB URL GET HTTP/3 www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:3A:D9:47:14:B0:78:30:A1:BF:B4:45:F6:F5:81:AD:0A:C7:76:89
ValidityMon, 20 Nov 2023 08:02:55 GMT - Mon, 12 Feb 2024 08:02:54 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7487), with no line terminators
Hash a54c06d5da217e0af63853cded27b617
5285ae43ee541b06eaf62b269ef599c9b48e7aff
0acdd8e1670318f81e3e10d17ec951a143f563b0763de7fda9b2d1837c8e0e29
GET /recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 08 Dec 2023 22:32:10 GMT
content-security-policy: script-src 'nonce-lVTNpvzi1vd-cAE3_kzZ2g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
unpkg.com/axios@1.6.2/dist/axios.min.js
200 OK 34 kB URL GET HTTP/2 unpkg.com/axios@1.6.2/dist/axios.min.js
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
File type ASCII text, with very long lines (33582)
Hash a68c57e04fd79331988c16fc3585405d
413c97b8c8ba0be18c36a65a5be940239c5956c2
550f26d03776c62d33e90b8028c6b4e2e7d1301c6ff769cff94592a93df71c68
GET /axios@1.6.2/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3tght76h.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 22:32:09 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"8355-QTyXuMi6C+GMNqZaW+lAI5xZVsI"
via: 1.1 fly.io
fly-request-id: 01HGAEP5ZKBFM4G5TRQJ70JS1R-fra
cf-cache-status: HIT
age: 916729
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 832876712d479933-ARN
content-encoding: br
X-Firefox-Spdy: h2
www.google.com/recaptcha/api2/webworker.js?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed
200 OK 102 B URL GET HTTP/3 www.google.com/recaptcha/api2/webworker.js?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed
IP
Requested by https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5D:3A:D9:47:14:B0:78:30:A1:BF:B4:45:F6:F5:81:AD:0A:C7:76:89
ValidityMon, 20 Nov 2023 08:02:55 GMT - Mon, 12 Feb 2024 08:02:54 GMT
File type ASCII text, with no line terminators
Hash b581f6e6ac7eb4d572233bdd384918f8
12a90cd14cfea2286982801538560f638670eaff
b62f36160407c81030404ab242125afd42fa0da6626ef11e5f406dda12acf144
GET /recaptcha/api2/webworker.js?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcCY5cUAAAAAA_SZQSTJfioaxkS1vVcGuv9gNui&co=aHR0cHM6Ly8zdGdodDc2aC5jb206NDQz&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=bm4l6aovzn4z
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/javascript; charset=utf-8
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 08 Dec 2023 22:32:10 GMT
date: Fri, 08 Dec 2023 22:32:10 GMT
cache-control: private, max-age=300
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
unpkg.com/axios/dist/axios.min.js
302 Found 34 kB URL GET HTTP/2 unpkg.com/axios/dist/axios.min.js
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /axios/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 08 Dec 2023 22:32:09 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /axios@1.6.2/dist/axios.min.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01HH5REGRK6N6Y88WWV852ZFFC-fra
cf-cache-status: HIT
age: 525
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 832876710d2d9933-ARN
X-Firefox-Spdy: h2
keefeezo.net/?z=6666140&syncedCookie=true&rhd=false
302 Found 3.1 kB URL User Request POST HTTP/2 keefeezo.net/?z=6666140&syncedCookie=true&rhd=false
IP
Certificate IssuerLet's Encrypt
Subjectkeefeezo.net
Fingerprint1F:3C:1B:96:59:1F:35:78:7E:83:7A:2D:97:C4:26:42:0C:6B:D6:AA
ValidityMon, 23 Oct 2023 09:24:42 GMT - Sun, 21 Jan 2024 09:24:41 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /?z=6666140&syncedCookie=true&rhd=false HTTP/1.1
Host: keefeezo.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 440
Origin: https://keefeezo.net
DNT: 1
Connection: keep-alive
Referer: https://keefeezo.net/afu.php?zoneid=6666140&var=6666140&rid=mnhKzS_wDF_SW3g2Y1iWsw%3D%3D&rhd=false
Cookie: OAID=8398272d56c94dfe84a752c43cc4aa34; oaidts=1702074727
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Fri, 08 Dec 2023 22:32:08 GMT
content-length: 0
location: https://gl0a7loeki02do.com/news.php?key=fz85sv8weugl8pkww9gu&SUBID=757118888302616641&cost=0.000455&zoneid=6666140&browser=firefox&browserversion=105&device=desktop&isp=blix group as&country=NO&os=windows&osversion=win10&carrier=?&language=en
x-trace-id: a01ea5e2be49a5fcbce7741d9882b4f6
link: <https://gl0a7loeki02do.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
referrer-policy: no-referrer
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Wow64
access-control-allow-origin: https://keefeezo.net
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=8398272d56c94dfe84a752c43cc4aa34; expires=Sat, 07 Dec 2024 22:32:08 GMT; path=/; secure; SameSite=None
oaidts=1702074727; expires=Sat, 07 Dec 2024 22:32:08 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Fri, 15 Dec 2023 22:32:08 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
www.google.com/recaptcha/api.js
200 OK 850 B URL GET HTTP/2 www.google.com/recaptcha/api.js
IP
Requested by https://3tght76h.com/1/?lpkey=17650266078d50bb28&uclick=4kciejpm0&uclickhash=4kciejpm0-4kciejpm0-46-h9i4-8rfe-2thq-4p1n-a70b65
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint50:3E:DA:12:EC:7F:39:A5:E9:4F:16:D7:D6:AA:BF:45:15:44:7F:E9
ValidityMon, 20 Nov 2023 08:09:47 GMT - Mon, 12 Feb 2024 08:09:46 GMT
File type ASCII text, with very long lines (850), with no line terminators
Hash 57e10dcd72dd2953878092014eae522b
95ba7e48825c26c5d9395ef2edb73e790bce6fa7
c7b54326365940d062bce26ed41579eebcb4946a86ba280790b603926692bd59
GET /recaptcha/api.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3tght76h.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Fri, 08 Dec 2023 22:32:09 GMT
date: Fri, 08 Dec 2023 22:32:09 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
173.233.139.164
104.21.30.54
139.45.195.8
78.46.92.254