megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
301 Moved Permanently 162 B URL HTTP/1.1 megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 30 Aug 2022 22:07:33 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer, strict-origin-when-cross-origin
X-Download-Options: noopen
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 99b7d23c1748d0526782b9ff9ea45f09
eadd801a3ba2aa00632c6fb52e1f9125bd6d5b4f
48f81668f76955320480b484138aebdad5d03c471036b4449c737aca1ecab08e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Content-Length, Backoff, Retry-After, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Tue, 30 Aug 2022 21:19:21 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 a7d2a4ec2f50830f128dc406960aef9a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: qWM8Lp6v4wNUk74BfOWG2eLF96A7_5LJxK5DzGBEJDG0NXJERsIy-A==
Age: 2892
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 517693963cc46e7a35a054296d0edfd5
11dfcd7e118e5f8d31e664e56ac29c57f973b8b3
ece269e8b9be8a5839d75c1343823d68b96930c593c2e3e8d522999176ee3149
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "ECE269E8B9BE8A5839D75C1343823D68B96930C593C2E3E8D522999176EE3149"
Last-Modified: Mon, 29 Aug 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6150
Expires: Tue, 30 Aug 2022 23:50:04 GMT
Date: Tue, 30 Aug 2022 22:07:34 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
IP
File type PEM certificate\012- , ASCII text
Hash 742edb4038f38bc533514982f3d2e861
cc3a20c8dc2a8c632ef9387a2744253f1e3fdef1
b6bfa49d3d135035701231db2fffc0c0643444394009a94c6a1b4d829d6b8345
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 20 Aug 2022 23:18:05 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Mon, 29 Aug 2022 22:35:59 GMT
etag: "742edb4038f38bc533514982f3d2e861"
x-cache: Hit from cloudfront
via: 1.1 a7d2a4ec2f50830f128dc406960aef9a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 4OwsLBCnS28HnK5R2PWXAEQIGTgWDz_P3Fk5yluz-wYaT3cnlfirCQ==
age: 84696
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash 3c8a89f86e36ddb5b264905220128110
cebedd11d66ad029554a9356cbfb3f853f9e3daa
15e35d490c8141afcfe6ce008833ff84898632c716539c63f7277acd3489ef4c
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 30 Aug 2022 22:07:34 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Mon, 29 Aug 2022 12:41:16 GMT
Expires: Mon, 05 Sep 2022 12:41:15 GMT
Etag: "cebedd11d66ad029554a9356cbfb3f853f9e3daa"
Cache-Control: max-age=483820,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7430d70e7a7afab8-OSL
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/?kzmmd=761186
200 OK 189 kB URL HTTP/2 dmmzkfd82wayn.cloudfront.net/?kzmmd=761186
IP
File type Unicode text, UTF-8 text, with very long lines (15945)
Size 189 kB (188751 bytes)
Hash 8035abc1b80ecc806ae4880b5a6b7f45
b9709a1a128dc302971d9eb8ffd3fd41c3e70ffe
77948894c0460a11533a0c4d0de6e9b2542e8edf828adaa1921986c634d980a2
GET /?kzmmd=761186 HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-length: 188751
date: Tue, 30 Aug 2022 21:38:07 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Hit from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: rv1g5adKBTPgZJ5VJzRNHbbg4xkLNEGWUr39XLM5ds-NqXugNLajtg==
age: 1767
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 0982b9e784a0a990d6318c92e33860a1
764377c393017e86d98a696da455509cba1806ac
27a19ec4ca0a052faface8ad45dca4d9a4a739c658d10f0e693aea065bdc607f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0713c18b7b968345bb5962c0ea9f2999
c035a22449c4ffe075168dddf2be1da187ef10b3
591f61b7ba63f05a084e67cb4a6ba528b51e430f999514b33a9f332f68c829e4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "591F61B7BA63F05A084E67CB4A6BA528B51E430F999514B33A9F332F68C829E4"
Last-Modified: Tue, 30 Aug 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1293
Expires: Tue, 30 Aug 2022 22:29:07 GMT
Date: Tue, 30 Aug 2022 22:07:34 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7a1dc190970a07ba09a08e67b7756ab6
05e7a89ee18357f3289ee877bf4496977a34f5a7
e2885e0b1bdf15d9cc3b5a940b9f60fcc7b1e88b8884885ee4731353c0b57b9d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2885E0B1BDF15D9CC3B5A940B9F60FCC7B1E88B8884885EE4731353C0B57B9D"
Last-Modified: Mon, 29 Aug 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9921
Expires: Wed, 31 Aug 2022 00:52:55 GMT
Date: Tue, 30 Aug 2022 22:07:34 GMT
Connection: keep-alive
www.googletagmanager.com/gtag/js?id=UA-108868042-1
200 OK 42 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=UA-108868042-1
IP
File type ASCII text, with very long lines (1615)
Hash 9b0186868d27cf4a3f0b6e687a5a16a8
bc34221cae1606c52590d5822e2c0e45f55dd775
0d001e1517ba9f15d88aa792e217e3d8a255646785f08ec500c8aa0e7a16ccc7
GET /gtag/js?id=UA-108868042-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 30 Aug 2022 22:07:34 GMT
expires: Tue, 30 Aug 2022 22:07:34 GMT
cache-control: private, max-age=900
last-modified: Tue, 30 Aug 2022 21:14:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 41985
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
keydawnawe.com/gwZ1U5hjA8ii/32575
200 OK 26 B URL HTTP/1.1 keydawnawe.com/gwZ1U5hjA8ii/32575
IP
File type ASCII text, with no line terminators
Hash 4e5d65669f8dcd928dad06adf883f025
d771713d758c3348dd7e5b38bb40c7935399ae46
0bebbf029fa045e4f462855e6c44edf8aaa36ded05b07a8ce456b67416d20c95
GET /gwZ1U5hjA8ii/32575 HTTP/1.1
Host: keydawnawe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; expires=Wed, 31-Aug-2022 22:07:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW; expires=Wed, 31-Aug-2022 22:07:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
megaup.net/themes/flow/images/main_logo_inverted.png
200 OK 7.1 kB URL HTTP/2 megaup.net/themes/flow/images/main_logo_inverted.png
IP
File type PNG image data, 203 x 40, 8-bit/color RGBA, non-interlaced\012- data
Hash 5d15526be10b904a6b48d1af04a10cc3
c09b6874359ac6d71db95593618a9acb55baa984
894d25472e0f890edf235e8f66fbeda7ea75043632924ecb82691d76bd7db018
GET /themes/flow/images/main_logo_inverted.png HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: image/png
content-length: 7137
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-1be1"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/isotope/custom-isotope.js
200 OK 1.1 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/isotope/custom-isotope.js
IP
File type ASCII text, with CRLF line terminators
Hash e5d85bd64936454f71fee800df177d09
6d459b54dc52af1baa06282221c7c090e736d205
e560b9588a87fb95ee52f32f4b54eb746b8610a56f5fea2aa81b3bc788bb743a
GET /themes/flow/frontend_assets/js/isotope/custom-isotope.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-71d"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
altowriestwispy.com/tysaSHG1FMaM/18410
200 OK 25 B URL HTTP/1.1 altowriestwispy.com/tysaSHG1FMaM/18410
IP
File type ASCII text, with no line terminators
Hash d488addc5df5fc9b9ff4135bb4e3a823
6ce56f48e851df4d562b43d3bc1269a504ae83fc
d1e90b8aef655ca37932287e04cbda72092eb029fe90de2bac019c10d3431f60
GET /tysaSHG1FMaM/18410 HTTP/1.1
Host: altowriestwispy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; expires=Wed, 31-Aug-2022 22:07:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW; expires=Wed, 31-Aug-2022 22:07:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
200 OK 54 kB URL HTTP/2 megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (58554), with CRLF, LF line terminators
Hash e2678bdd6c97ad994b8bea240f94f71b
6291ea1138713c28548f1f40e935d325051edc25
a6357b6e183262c3cd03564c13a2f3def11d7ff6b3278fdb52a6061a1fe2fa72
GET /20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4; expires=Wed, 31-Aug-2022 22:07:34 GMT; Max-Age=86400; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
altowriestwispy.com/tysaSHG1FMaM/18410
200 OK 25 B URL HTTP/1.1 altowriestwispy.com/tysaSHG1FMaM/18410
IP
File type ASCII text, with no line terminators
Hash d488addc5df5fc9b9ff4135bb4e3a823
6ce56f48e851df4d562b43d3bc1269a504ae83fc
d1e90b8aef655ca37932287e04cbda72092eb029fe90de2bac019c10d3431f60
GET /tysaSHG1FMaM/18410 HTTP/1.1
Host: altowriestwispy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
megaup.net/themes/flow/frontend_assets/fonts/raleway.woff
200 OK 32 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/raleway.woff
IP
File type Web Open Font Format, TrueType, length 31836, version 1.1\012- data
Hash 4514fa5a5b3d1e0b14aa32a7d068124a
e634977bfabc20ed15fe7ed03d3876cf68834b93
5b0f118d658eacc5740b10b0dc2ebbd99ee8e8262c72ff29bfcda48c02b19861
GET /themes/flow/frontend_assets/fonts/raleway.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: font/woff
content-length: 31836
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7c5c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/fonts/raleway_extrabold.woff
200 OK 31 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/raleway_extrabold.woff
IP
File type Web Open Font Format, TrueType, length 31344, version 1.1\012- data
Hash 21f79e4c0fbe54a555170aa70bb4c8b7
9d4aaf2016cd21f16bc45089a48de84dba951fa7
2b638674bc57ad355ef2ecbd68e78ecb36bc323aaaf4ddeb9cd4f61bc5f26c42
GET /themes/flow/frontend_assets/fonts/raleway_extrabold.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: font/woff
content-length: 31344
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7a70"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/fonts/raleway_semibold.woff
200 OK 32 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/raleway_semibold.woff
IP
File type Web Open Font Format, TrueType, length 31980, version 1.1\012- data
Hash 99ac81a158028ac2023fb3350d2497e7
f08c12c91ab29282a616c3ba8e533f49b5b433ca
92a8c8eca8cfcfc53855bc48ba50b866704a00323c4e3089b564c939a668925d
GET /themes/flow/frontend_assets/fonts/raleway_semibold.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: font/woff
content-length: 31980
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7cec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_fonts/socicon-webfont.woff
200 OK 21 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_fonts/socicon-webfont.woff
IP
File type Web Open Font Format, TrueType, length 20972, version 1.0\012- data
Hash cad75e2dacc6794c4e6b14727d4a989d
694d04c8f643df4100c23efc1463ac9f4e732f60
ebccc09339b7730324221aff3d11d215de9997b47bf708ca18a3be2d8e8b9887
GET /themes/flow/frontend_assets/socialsider-v1.0/_fonts/socicon-webfont.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: font/woff
content-length: 20972
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-51ec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
rtyvaluation.shop/cWhubjIQCg0DDRBVDEhHAwRTSwA3TVwoVhwFFAVUFVBcGVMIBkANXh4dCghAHgYaQFwUHEtcdBYJFAIDElo3J2QZGzg5YEg5KzsHIzA/BnciWSwgZwYxDS1wAi0hOllUWiwsZ0lbJgdZIjs/NwYkAiBWZwYLDSpFIy44P106PhYkfSApWzZ0Gl02OmQWOis4RhcgGSt2MjkvK3MgPSUvWQYmLRZ7MzxfI3UzWTQ7dRYDPiwDJD04AmMFLCgadiBZBSRqIBw2OVoJLyM7fCsrPAVTMipbLGc0LjkrRTcsIihwFyArN0ogWQUkcAY+Kjl6GSU8O1oTLShDcDM+CRZRNwAJJGYWGxQ/ZCsJLTtkMj4CAVEjWCMvcxobPyhjGjwmK1FAMF9eaiM+OzpkFg9IBEEeBh5TfjswABhwHCcXHkE6XDYr
200 OK 1.2 kB URL HTTP/2 rtyvaluation.shop/cWhubjIQCg0DDRBVDEhHAwRTSwA3TVwoVhwFFAVUFVBcGVMIBkANXh4dCghAHgYaQFwUHEtcdBYJFAIDElo3J2QZGzg5YEg5KzsHIzA/BnciWSwgZwYxDS1wAi0hOllUWiwsZ0lbJgdZIjs/NwYkAiBWZwYLDSpFIy44P106PhYkfSApWzZ0Gl02OmQWOis4RhcgGSt2MjkvK3MgPSUvWQYmLRZ7MzxfI3UzWTQ7dRYDPiwDJD04AmMFLCgadiBZBSRqIBw2OVoJLyM7fCsrPAVTMipbLGc0LjkrRTcsIihwFyArN0ogWQUkcAY+Kjl6GSU8O1oTLShDcDM+CRZRNwAJJGYWGxQ/ZCsJLTtkMj4CAVEjWCMvcxobPyhjGjwmK1FAMF9eaiM+OzpkFg9IBEEeBh5TfjswABhwHCcXHkE6XDYr
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3024), with no line terminators
Hash 3d896db3529dbddd2cdfc9e4d1a7d267
b9869e600f5bbe2604fe47ac55a149413e8afe74
f1cb08ee361580a979d2139a9d25da1305e9a3ff6fee0db2ce462c32debb0c0c
GET /cWhubjIQCg0DDRBVDEhHAwRTSwA3TVwoVhwFFAVUFVBcGVMIBkANXh4dCghAHgYaQFwUHEtcdBYJFAIDElo3J2QZGzg5YEg5KzsHIzA/BnciWSwgZwYxDS1wAi0hOllUWiwsZ0lbJgdZIjs/NwYkAiBWZwYLDSpFIy44P106PhYkfSApWzZ0Gl02OmQWOis4RhcgGSt2MjkvK3MgPSUvWQYmLRZ7MzxfI3UzWTQ7dRYDPiwDJD04AmMFLCgadiBZBSRqIBw2OVoJLyM7fCsrPAVTMipbLGc0LjkrRTcsIihwFyArN0ogWQUkcAY+Kjl6GSU8O1oTLShDcDM+CRZRNwAJJGYWGxQ/ZCsJLTtkMj4CAVEjWCMvcxobPyhjGjwmK1FAMF9eaiM+OzpkFg9IBEEeBh5TfjswABhwHCcXHkE6XDYr HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html
content-length: 1178
date: Tue, 30 Aug 2022 22:07:34 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: -cSNDl2iexbFn3EArluBttnz0LV1VF0cQGK_AH1A9yNNxtY_tTBaOg==
X-Firefox-Spdy: h2
megaup.net/sw.js
200 OK 31 kB IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 6c3b76081ea5864172fc44ef56a19274
c8c7e10d812a15dccdb47c2b5ad0d66c074decef
41e7a9abddfd005c5bee315cb1881489bc80b7aa5c898cd4411b2f0c8eaec070
GET /sw.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:52 GMT
vary: Accept-Encoding
etag: W/"60758f38-12fe6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
keydawnawe.com/gwZ1U5hjA8ii/32575
200 OK 26 B URL HTTP/1.1 keydawnawe.com/gwZ1U5hjA8ii/32575
IP
File type ASCII text, with no line terminators
Hash 4e5d65669f8dcd928dad06adf883f025
d771713d758c3348dd7e5b38bb40c7935399ae46
0bebbf029fa045e4f462855e6c44edf8aaa36ded05b07a8ce456b67416d20c95
GET /gwZ1U5hjA8ii/32575 HTTP/1.1
Host: keydawnawe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Cookie: GL_UI4=eJw9jUtOwzAYhPMOVUnESDkAR2gi0rRLNqy4Q%2BTYf4Jp4r9y3Ae3xyDBbh6fZoIgiKoS4TWLEV9Ei%2BejGru9pJrkoW6a%2BuXQyLEdRDfWqunqdoeNXnsnhplcgseJDFkte8mKCjz56i85Gb6ZBOlghVEF0sUTc4F8sHxbyVYxEiMWQv6mLY1894T4ZIvouPdSGy%2FDHSJeq7jcIH3X5nIvt1lQFlmA7XkWbmS79Fp5m05WKEL4igcpHE1sv5ArWk%2BOzwDPqv%2Fnfz%2FT%2BWcNmaKrlt6y%2ByD7DTb9Sx8%3D; GL_GI10=eJxNjMFqg0AURXXSTCOK5UI%2FID9Qk7R2kW3TZdGFHzBY8xIGzDxxJm0mX181ULK5HA6cGwSBeE4hdIdku8m26yx%2FzTbvOWZHYoiiRNLw2bjeK1OfCLLg%2Frf2kD0dNRuI9RviG6uG94R5Ub7cuSmKS9vycjf%2BeDw0etxRIRr51j0O3eRm2nZIP1p9WVbcnt3wYhEZcsp2RHtEu%2Fq7pdVn9YX0304fMsRCW9X1fPEDPzl9oisbUnw4WHJSIPyR4g8Mt0dW
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
megaup.net/themes/flow/frontend_assets/js/gauge.min.js
200 OK 6.1 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/gauge.min.js
IP
File type ASCII text, with very long lines (1259)
Hash d28851890a2099067df9fdba23486eac
94138569735294bc32a57be1dd5d5b776d9b39b7
08ffdebcb6d5ac5e66b2aa94e25b7741befcdbf59a901c45fae2fe379355a50c
GET /themes/flow/frontend_assets/js/gauge.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-45b8"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/colors/flow.css
200 OK 607 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/colors/flow.css
IP
File type ASCII text, with CRLF line terminators
Hash 19ad1bda239992f63af637ea1e1cee59
66b357714b557ae057181cf93a0dc65a28335f9a
feec239eaf8702166f705dfdbd766ddbe019bbf362765b0317eafe0904bd85da
GET /themes/flow/frontend_assets/css/colors/flow.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-a83"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/nav/jquery.nav.js
200 OK 1.9 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/nav/jquery.nav.js
IP
File type ASCII text, with CRLF line terminators
Hash 88167ae4710e6df4c28a62f9eeb2a14c
c458370ce9f757c926bae898d3ddd5c233ae3060
25c92310ff1c0016176daebc879b773277e6959aab0153e7f966db685a836ee7
GET /themes/flow/frontend_assets/js/nav/jquery.nav.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1547"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
rtyvaluation.shop/NVd4OW9UNRtUUFRqGh8aRztFHF1zckp/C1g6AlIJUW9KTg5MOVZaA1oiHF8dWjkMFwFQI10LKUMNSms+VgM1fCxPYyB9LXgZNnwYfgJJCABnIBx7K1waHWE9UQ0+ajldETlWLns8NUkuYREgaxcFFhpsKmMUD2xKBxU+Xlp3FiwNPHE7InoiZwEqbgN3ZTp/JVQULAEjYjALcCJjBjpwOXNySns+Zw0ubydSHTlVNXcOAnQ4YwEpAShzZytxJ2MTOUFWVg0RDSlgZz5TIk0NLm8sfB8+VT5ZNi1aC2NnSQg+Qho5eDt4NiB8JWIRE3QrYzsqXj50GS9oOBgdOm8+AQA2awtWH0h/BnsgCGs8WBUgawNFAV5THFo5CAQqYQULVz9yJzZcDg
200 OK 1.2 kB URL HTTP/2 rtyvaluation.shop/NVd4OW9UNRtUUFRqGh8aRztFHF1zckp/C1g6AlIJUW9KTg5MOVZaA1oiHF8dWjkMFwFQI10LKUMNSms+VgM1fCxPYyB9LXgZNnwYfgJJCABnIBx7K1waHWE9UQ0+ajldETlWLns8NUkuYREgaxcFFhpsKmMUD2xKBxU+Xlp3FiwNPHE7InoiZwEqbgN3ZTp/JVQULAEjYjALcCJjBjpwOXNySns+Zw0ubydSHTlVNXcOAnQ4YwEpAShzZytxJ2MTOUFWVg0RDSlgZz5TIk0NLm8sfB8+VT5ZNi1aC2NnSQg+Qho5eDt4NiB8JWIRE3QrYzsqXj50GS9oOBgdOm8+AQA2awtWH0h/BnsgCGs8WBUgawNFAV5THFo5CAQqYQULVz9yJzZcDg
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2993), with no line terminators
Hash 61c23c447143c072791e3a3f374de68e
0e519e3cf5ee9a2edd576cf84e5a58a418bce7e2
bdcecbfc70bd360819f352023306b4bf0d90314ce63ef9f0bfeaee2c5062f80a
GET /NVd4OW9UNRtUUFRqGh8aRztFHF1zckp/C1g6AlIJUW9KTg5MOVZaA1oiHF8dWjkMFwFQI10LKUMNSms+VgM1fCxPYyB9LXgZNnwYfgJJCABnIBx7K1waHWE9UQ0+ajldETlWLns8NUkuYREgaxcFFhpsKmMUD2xKBxU+Xlp3FiwNPHE7InoiZwEqbgN3ZTp/JVQULAEjYjALcCJjBjpwOXNySns+Zw0ubydSHTlVNXcOAnQ4YwEpAShzZytxJ2MTOUFWVg0RDSlgZz5TIk0NLm8sfB8+VT5ZNi1aC2NnSQg+Qho5eDt4NiB8JWIRE3QrYzsqXj50GS9oOBgdOm8+AQA2awtWH0h/BnsgCGs8WBUgawNFAV5THFo5CAQqYQULVz9yJzZcDg HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/html
content-length: 1154
date: Tue, 30 Aug 2022 22:07:34 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: oqkC2otHhLw_eHwj5BJJtXf8vEkUPEjh9qrjaSFnykXIoF1cf9YGxg==
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/custom/custom.js
200 OK 1.4 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/custom/custom.js
IP
File type ASCII text, with CRLF line terminators
Hash bc2be29997bc7e1eb382f008e90611a9
4e3c307ff8e3aa91fdb1a92bf834c321837e740e
a1941e8f75bc8763e128e982b2d64e2eb6a387c953028c876ca308a63f16050e
GET /themes/flow/frontend_assets/js/custom/custom.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1420"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
rtyvaluation.shop/UmJIZDgzACsJBzNfKkJNIA51QQoUR3oiXD8PMg9eNlp6E1krDGYHVD0XLAJKPQw8SlY3Fm1WfiMvDwBVBA4eMHsTBT8FUwMtCQlMOyAkKmALDxkzfAA3fSsIEAMFE1sCBiEpCAg1CgZ0Klc/LW09Jh9WYig6CT1xHzUvM3k1BXkFeRQgCh5xYSYeKnkbCx4CfBQRIS0JJS0NHQwmMAlUaTEhCjZvNRF9KAk5LgsOXCUjISJsNyUdMm4EOG1Weh4zDjNpYDcQIm4ENQcOQDcnIFFCCBUJAmA/IwMmVBwmEjZbBDQePVMbGh4xcmBbIixUNjIrVlsTIwlJdWMyJF17BCAKCnkUOB8+VQMjHg92OTgePXcUJgUeYCpbDD56HygdMVA/AXgyWQQVbg5LPQw4WW0DOA4gamFXIyxA
200 OK 1.2 kB URL HTTP/2 rtyvaluation.shop/UmJIZDgzACsJBzNfKkJNIA51QQoUR3oiXD8PMg9eNlp6E1krDGYHVD0XLAJKPQw8SlY3Fm1WfiMvDwBVBA4eMHsTBT8FUwMtCQlMOyAkKmALDxkzfAA3fSsIEAMFE1sCBiEpCAg1CgZ0Klc/LW09Jh9WYig6CT1xHzUvM3k1BXkFeRQgCh5xYSYeKnkbCx4CfBQRIS0JJS0NHQwmMAlUaTEhCjZvNRF9KAk5LgsOXCUjISJsNyUdMm4EOG1Weh4zDjNpYDcQIm4ENQcOQDcnIFFCCBUJAmA/IwMmVBwmEjZbBDQePVMbGh4xcmBbIixUNjIrVlsTIwlJdWMyJF17BCAKCnkUOB8+VQMjHg92OTgePXcUJgUeYCpbDD56HygdMVA/AXgyWQQVbg5LPQw4WW0DOA4gamFXIyxA
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3015), with no line terminators
Hash 15c8b8196d53754c9ea1b271d471a955
ec026eb3408c148db50d929fd47fbac998664252
2e4fc1358eb6f50cae679e1e5c6e5caedb98ba795d53926bc5fae837551fd052
GET /UmJIZDgzACsJBzNfKkJNIA51QQoUR3oiXD8PMg9eNlp6E1krDGYHVD0XLAJKPQw8SlY3Fm1WfiMvDwBVBA4eMHsTBT8FUwMtCQlMOyAkKmALDxkzfAA3fSsIEAMFE1sCBiEpCAg1CgZ0Klc/LW09Jh9WYig6CT1xHzUvM3k1BXkFeRQgCh5xYSYeKnkbCx4CfBQRIS0JJS0NHQwmMAlUaTEhCjZvNRF9KAk5LgsOXCUjISJsNyUdMm4EOG1Weh4zDjNpYDcQIm4ENQcOQDcnIFFCCBUJAmA/IwMmVBwmEjZbBDQePVMbGh4xcmBbIixUNjIrVlsTIwlJdWMyJF17BCAKCnkUOB8+VQMjHg92OTgePXcUJgUeYCpbDD56HygdMVA/AXgyWQQVbg5LPQw4WW0DOA4gamFXIyxA HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/html
content-length: 1171
date: Tue, 30 Aug 2022 22:07:34 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: GpmU92qZW_8WjJwrY6boxUsx_WGeA1mFnghJk2QXGvmEMDruVLKPsA==
X-Firefox-Spdy: h2
atebilaterde.one/VXA4VFh6T1snZRo3djU5HRN2AR9gKmkjKDQRfhYXEUFMJgBlNR4gMTFNAGNuZkEAcig8FAVmYXMDTDUsIAMFZX48Hl47ZXMGBWV2ZV4NbXZlVk1paXMESDU/aEEeJCwhHAVlbmNBAG1vZ0UMbGBn
204 No Content 0 B URL HTTP/2 atebilaterde.one/VXA4VFh6T1snZRo3djU5HRN2AR9gKmkjKDQRfhYXEUFMJgBlNR4gMTFNAGNuZkEAcig8FAVmYXMDTDUsIAMFZX48Hl47ZXMGBWV2ZV4NbXZlVk1paXMESDU/aEEeJCwhHAVlbmNBAG1vZ0UMbGBn
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /VXA4VFh6T1snZRo3djU5HRN2AR9gKmkjKDQRfhYXEUFMJgBlNR4gMTFNAGNuZkEAcig8FAVmYXMDTDUsIAMFZX48Hl47ZXMGBWV2ZV4NbXZlVk1paXMESDU/aEEeJCwhHAVlbmNBAG1vZ0UMbGBn HTTP/1.1
Host: atebilaterde.one
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:34 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e91gE5sYEw3ekgSe6afS%2BdLZMVeLzz1jxTSXUGTfKY1yDorNoWgLezoeU20wCK4rJmGlZOMynyr22%2BZfuggByv6ztnI%2BMkDnZ9ns56gprrgof%2FaDPndw88i2fadfQumaQjRh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d7123bfffac8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
atebilaterde.one/eG0ycW9XUlECUi0HZDY6LAFZMFw6CnYcLj0OACAgITxwVF0+N0VXGxEJD0hbQVUERUkIBFZMXkBLQQUODBhBTF5eBFwXAEVLRExeVl0cQEFKS0dMXl4ZQhAIRVwUARsMAQ9AWU5cCkhYSlgGSVdB
204 No Content 0 B URL HTTP/2 atebilaterde.one/eG0ycW9XUlECUi0HZDY6LAFZMFw6CnYcLj0OACAgITxwVF0+N0VXGxEJD0hbQVUERUkIBFZMXkBLQQUODBhBTF5eBFwXAEVLRExeVl0cQEFKS0dMXl4ZQhAIRVwUARsMAQ9AWU5cCkhYSlgGSVdB
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /eG0ycW9XUlECUi0HZDY6LAFZMFw6CnYcLj0OACAgITxwVF0+N0VXGxEJD0hbQVUERUkIBFZMXkBLQQUODBhBTF5eBFwXAEVLRExeVl0cQEFKS0dMXl4ZQhAIRVwUARsMAQ9AWU5cCkhYSlgGSVdB HTTP/1.1
Host: atebilaterde.one
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:34 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YpIIFuXyZ8tsDlzQe0%2BLDyCKuXR2RxTI6zwKztWzsJg%2BJxW9KLcjeVmOGI58zbzv%2FXfldEzoBAhrCxcIHudXWocSr0L7cAyY07zy%2Bamu33cu4iqQSuhYguVvG3pr5ZMAZ%2ByT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d7124c0dfac8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
atebilaterde.one/dmMwT2FZXFM8XCU0Ynw2IDUFGTQsDGoXIyQxXXoLEFJyADgxOhY7CBJeB3lVR1cBaREfBw1+RwUXUTsUBV4BaQgYBV9yRwBeAWFSQk0Cd09GRUVyUFAXQC4GS1IWPxUCDw1+V0BSCHZWRFYEd1hO
204 No Content 0 B URL HTTP/2 atebilaterde.one/dmMwT2FZXFM8XCU0Ynw2IDUFGTQsDGoXIyQxXXoLEFJyADgxOhY7CBJeB3lVR1cBaREfBw1+RwUXUTsUBV4BaQgYBV9yRwBeAWFSQk0Cd09GRUVyUFAXQC4GS1IWPxUCDw1+V0BSCHZWRFYEd1hO
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /dmMwT2FZXFM8XCU0Ynw2IDUFGTQsDGoXIyQxXXoLEFJyADgxOhY7CBJeB3lVR1cBaREfBw1+RwUXUTsUBV4BaQgYBV9yRwBeAWFSQk0Cd09GRUVyUFAXQC4GS1IWPxUCDw1+V0BSCHZWRFYEd1hO HTTP/1.1
Host: atebilaterde.one
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:34 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y3E%2Fy4XmHXQMvlJNTNHldJXXjAsD28WAzE2ftElZJS7rMf6G5XaDOMqO%2Fdx5v4xNUmeA3%2Bp6JDJK%2BX0W%2Bf5%2FaR5nAcx27T10sPXUA2yUb48fxhVNp3DjrOcEB4GxH5eRr5dJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d7125c13fac8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash f67e41cdd7e5f2aa8f93d031979c9109
5f4c0093f9bf8f8e48e0d7f56ed31aba0c6f43f6
608e2b7d208977f18da12165c9eb1539656d7754dc49f3f687736151a4810e06
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5516
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:34 GMT
Last-Modified: Tue, 30 Aug 2022 20:35:38 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
megaup.net/imageads/005.gif
200 OK 216 kB URL HTTP/2 megaup.net/imageads/005.gif
IP
File type GIF image data, version 89a, 300 x 250\012- data
Size 216 kB (216289 bytes)
Hash 5c5bf0825af3dd18a10beb7823a61adc
3bd9d6cee30c45793947a14123413cfcfb75f966
67c74c7464572c528046ee559cdb616fa751c830083c30785f54ad6423fc5dfb
GET /imageads/005.gif HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: image/gif
content-length: 216289
last-modified: Thu, 02 Aug 2018 19:05:08 GMT
vary: Accept-Encoding
etag: "5b6355e4-34ce1"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
platform.bidgear.com/media/img/b15.png
200 OK 649 B URL HTTP/2 platform.bidgear.com/media/img/b15.png
IP
File type PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced\012- data
Hash d832fb80c97ff291b952757bb98240d2
63732e61a0784ed68fde494f83e4686a5c4bf7fa
7b35c11af8accdb40a14303dd3ae2762a97d2527933c56b6c9be6da2d0d11943
GET /media/img/b15.png HTTP/1.1
Host: platform.bidgear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: image/png
content-length: 649
last-modified: Mon, 25 Jul 2022 09:43:33 GMT
etag: "62de65c5-289"
expires: Fri, 23 Sep 2022 09:44:54 GMT
cache-control: max-age=2592000
access-control-allow-origin: *
cf-cache-status: HIT
age: 562943
accept-ranges: bytes
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lM4dHfyzHeRxTWa10CbntP%2FBOvP0CQDC7VnQZDD2Soj3S%2BU3BTLECVCEIeAULj9Ymoq4kTES4Eu471ukTZqcT4vRUmWaGK6ccE9N2J5VUe8%2BfrjYOgyMs5y%2BQbjMDhRNhjTl5l7R"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7430d713ed33b524-OSL
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 281 B IP
Hash 32757ad91de5ec82fe1aca252f8e70a4
2e232d2662f7588edc97a6ba23bd6d273a09db59
9bae39a314bcdf3fc58b97d2b0113f47154fa36691c4bb8e3230ab56391e5901
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 30 Aug 2022 22:07:35 GMT
Content-Type: application/ocsp-response
Content-Length: 281
Connection: keep-alive
Last-Modified: Tue, 30 Aug 2022 09:53:50 GMT
Expires: Tue, 06 Sep 2022 09:53:49 GMT
Etag: "2e232d2662f7588edc97a6ba23bd6d273a09db59"
Cache-Control: max-age=560173,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7430d713ac34fab8-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f421ee3c6c4cfbea2b14f2b3d85b3898
e1ac74530b6a0491fde13976a6a18d2b4400713d
32d812d76768b6e7a0dcc0638259334647c4911e5df3df15f62dda04dc93e5c7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "32D812D76768B6E7A0DCC0638259334647C4911E5DF3DF15F62DDA04DC93E5C7"
Last-Modified: Mon, 29 Aug 2022 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=922
Expires: Tue, 30 Aug 2022 22:22:57 GMT
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: keep-alive
platform.bidgear.com/async.php?domainid=5593&sizeid=12&zoneid=6192&k=1661897255020
200 OK 26 kB URL HTTP/2 platform.bidgear.com/async.php?domainid=5593&sizeid=12&zoneid=6192&k=1661897255020
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (4445), with no line terminators
Hash 35e4f4e78104b3812aa8db6308bedf11
8d13c318f7de283fc342e06cd9680bfd30e60396
394d97dd591ccedac43db5189c825cbb4af9ff2e3d484118860621c3f2f88114
GET /async.php?domainid=5593&sizeid=12&zoneid=6192&k=1661897255020 HTTP/1.1
Host: platform.bidgear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9i7vi6nj%2BCZQK%2BYYbJz3THZZd9E6goaD692ro3KTjw3rayVFvVVaiwxNEAOUu5JTgQis%2FaW85vFJNE5oRQqarhh6v5sd1eWqSHFUEOwyTk8ycfXxra5QWvTdH03z90Jmk1t4Fxsz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d7131b7db524-OSL
content-encoding: br
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/gazl1c2YIVhsVWR9QEU5RXQhES1BNUwYcCBsEOTk+BU83HikSSQY4UjN8UwccDwRFVQoKVxJOQA5XFk5XTVgREVtfHwEDCQAEAQUKAkwNCxIBT1MGB1ZUGgkPB1UUVlQtDFtDQ1kJXQtXWhxGMUNZCRkaCB5BUEFWEwFDLFBfHEYxQ1kJBwVDWHhMRUhbEF-BBVgxcFhgJTgszQVZaCUVCVlocR0MAAksQFQkTHEc1X10XRVUTVgg
200 OK 591 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/gazl1c2YIVhsVWR9QEU5RXQhES1BNUwYcCBsEOTk+BU83HikSSQY4UjN8UwccDwRFVQoKVxJOQA5XFk5XTVgREVtfHwEDCQAEAQUKAkwNCxIBT1MGB1ZUGgkPB1UUVlQtDFtDQ1kJXQtXWhxGMUNZCRkaCB5BUEFWEwFDLFBfHEYxQ1kJBwVDWHhMRUhbEF-BBVgxcFhgJTgszQVZaCUVCVlocR0MAAksQFQkTHEc1X10XRVUTVgg
IP
File type ASCII text, with very long lines (835), with no line terminators
Hash 1decf87c4669b3c1fbf81f7233af8b0e
455bb7b07a74fc681c0badbadf7a9e42b2a7bc77
affe37c99b32b408e0fb90a3fe8be53265ee1bbc6cd37fff70a782cbf338445e
GET /gazl1c2YIVhsVWR9QEU5RXQhES1BNUwYcCBsEOTk+BU83HikSSQY4UjN8UwccDwRFVQoKVxJOQA5XFk5XTVgREVtfHwEDCQAEAQUKAkwNCxIBT1MGB1ZUGgkPB1UUVlQtDFtDQ1kJXQtXWhxGMUNZCRkaCB5BUEFWEwFDLFBfHEYxQ1kJBwVDWHhMRUhbEF-BBVgxcFhgJTgszQVZaCUVCVlocR0MAAksQFQkTHEc1X10XRVUTVgg HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://rtyvaluation.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 591
date: Tue, 30 Aug 2022 22:07:35 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: zeI3g3J-WxgREqMicpmNJoyrzWdSI2VmgKCJcxA8V5SWx72nX0UPMA==
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/
200 OK 73 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/
IP
File type ASCII text, with no line terminators
Hash de37377b72195a4f064edf7ec8a76676
ed544d5b6a37acad78498099407c648a93316ddb
b3209cc0b1d1b71e85af4e843afe00a3079f3286d52b3fb47e72c6c5c48b8399
GET / HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 73
date: Tue, 30 Aug 2022 21:38:08 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Hit from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 7Calv2rcQEtxUSJTmIqAkL5_P8O-1UPU18a9yJL0lLAmxuKvyJcjzQ==
age: 1767
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/1eDFWTlkbXjgoZgxYMnNhSgRvf2heWyUhNwgMMXoSE2huHxUIVnA6IxwMZmg1GV8xc38dXzVzaF5QMixkTBciPjYTDCMgPR1XPyA8HBcjL2QVXiwnNRRQc3wfTR9ma2tIGS5/aF0CFGtrSF0/ICwAFGR+IUAHCXhtXQIUa2tIQyBrajkIYGBpURRkfj4dUj-0hfEp3ZH5oSAFnfmhdA2YoMApUMCEhXQMQd29WAXA7ZEk
200 OK 359 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/1eDFWTlkbXjgoZgxYMnNhSgRvf2heWyUhNwgMMXoSE2huHxUIVnA6IxwMZmg1GV8xc38dXzVzaF5QMixkTBciPjYTDCMgPR1XPyA8HBcjL2QVXiwnNRRQc3wfTR9ma2tIGS5/aF0CFGtrSF0/ICwAFGR+IUAHCXhtXQIUa2tIQyBrajkIYGBpURRkfj4dUj-0hfEp3ZH5oSAFnfmhdA2YoMApUMCEhXQMQd29WAXA7ZEk
IP
File type ASCII text, with very long lines (458), with no line terminators
Hash cfd84612fc5386b39af2ab50a22c0edd
dfab3affcb90b1467e526017ad644f2658e745c5
b94f2228cee40da93dda2891bffb8550681ee3e1cf4daa6242608dd835923615
GET /1eDFWTlkbXjgoZgxYMnNhSgRvf2heWyUhNwgMMXoSE2huHxUIVnA6IxwMZmg1GV8xc38dXzVzaF5QMixkTBciPjYTDCMgPR1XPyA8HBcjL2QVXiwnNRRQc3wfTR9ma2tIGS5/aF0CFGtrSF0/ICwAFGR+IUAHCXhtXQIUa2tIQyBrajkIYGBpURRkfj4dUj-0hfEp3ZH5oSAFnfmhdA2YoMApUMCEhXQMQd29WAXA7ZEk HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://rtyvaluation.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 359
date: Tue, 30 Aug 2022 22:07:35 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: F3jL4CNWJwFQxTOXPdIxti3L_6QYzaNa0jnKR8e_pgOjgjMJYLz78A==
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/vZ2RQcTMECz4XDBMNNEwKU11oRwdBDiMeXRdZFSVhFAoANkMpATFXRx0AbUEVCwU+Fg5BAT4SDlZCMRVRWlB2BFJaCT8LWgsIMVQBIVF+QRZVVHgJAlZBYzMWVVQ8GF0SHHVDAx9cZi4FU0FjMxZVVCIHFlQlaUcdV011QwMAATMaXEJWFkMDVlRgQANWQW-JBVQ4WNRdcH0FiNwpRSmBXRlpV
200 OK 189 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/vZ2RQcTMECz4XDBMNNEwKU11oRwdBDiMeXRdZFSVhFAoANkMpATFXRx0AbUEVCwU+Fg5BAT4SDlZCMRVRWlB2BFJaCT8LWgsIMVQBIVF+QRZVVHgJAlZBYzMWVVQ8GF0SHHVDAx9cZi4FU0FjMxZVVCIHFlQlaUcdV011QwMAATMaXEJWFkMDVlRgQANWQW-JBVQ4WNRdcH0FiNwpRSmBXRlpV
IP
File type ASCII text, with no line terminators
Hash d00e372e95fb97043c5171e53c7356f9
6534f8434443038df528dc321a3b61f8da763f24
7bf06d780827531937e71ddf08eb9cf124ddb89dc817b9882368337298e23ad7
GET /vZ2RQcTMECz4XDBMNNEwKU11oRwdBDiMeXRdZFSVhFAoANkMpATFXRx0AbUEVCwU+Fg5BAT4SDlZCMRVRWlB2BFJaCT8LWgsIMVQBIVF+QRZVVHgJAlZBYzMWVVQ8GF0SHHVDAx9cZi4FU0FjMxZVVCIHFlQlaUcdV011QwMAATMaXEJWFkMDVlRgQANWQW-JBVQ4WNRdcH0FiNwpRSmBXRlpV HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://rtyvaluation.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 189
date: Tue, 30 Aug 2022 22:07:35 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Wcpi32WllLqWPToHYcWtozrsVqBGqSOQkS6JSpZyJAi-Cub5ip6BSw==
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/yOThrbXdaVwULSE1RD1BPDg5YXE8fUhgCGUkFGyxHdGshNz1aC10rGG8eHxcTBAhNARZXX1ZLEldbVlxRWFwJUEMfTBsCHARMHQEeTEATGR1PHh4MSlRXEQQbVVlOXzEMFltIRQkQE1xGHAspSEUJVAIDAkEdWV0PAQ40W0McCylIRQlKHUhEeAFdQ0cQHV-ldEFxbAAJSC35ZXUYJCFpdRhwKWwseS10NAg8cCi1UQRcITRhKCA
200 OK 451 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/yOThrbXdaVwULSE1RD1BPDg5YXE8fUhgCGUkFGyxHdGshNz1aC10rGG8eHxcTBAhNARZXX1ZLEldbVlxRWFwJUEMfTBsCHARMHQEeTEATGR1PHh4MSlRXEQQbVVlOXzEMFltIRQkQE1xGHAspSEUJVAIDAkEdWV0PAQ40W0McCylIRQlKHUhEeAFdQ0cQHV-ldEFxbAAJSC35ZXUYJCFpdRhwKWwseS10NAg8cCi1UQRcITRhKCA
IP
File type ASCII text, with very long lines (602), with no line terminators
Hash 030e1f53cdf5491f9c457a422b2fc476
a0faa39b13bf463ab6632ef13dc9db4268ddb10c
af6152ed3e4e68ae6caa7c2812a7ef2f8a3573b2ceb78a123d5cc593a9904a44
GET /yOThrbXdaVwULSE1RD1BPDg5YXE8fUhgCGUkFGyxHdGshNz1aC10rGG8eHxcTBAhNARZXX1ZLEldbVlxRWFwJUEMfTBsCHARMHQEeTEATGR1PHh4MSlRXEQQbVVlOXzEMFltIRQkQE1xGHAspSEUJVAIDAkEdWV0PAQ40W0McCylIRQlKHUhEeAFdQ0cQHV-ldEFxbAAJSC35ZXUYJCFpdRhwKWwseS10NAg8cCi1UQRcITRhKCA HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://rtyvaluation.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 451
date: Tue, 30 Aug 2022 22:07:35 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: _ZF-xmdEsPYpYZZ189WqOM_njdhEwS-MZ3tIVfVeHV1kR9BiRxCjfA==
X-Firefox-Spdy: h2
imp9.bidgear.com/rec?t=1&z=6192&uuid=40ecad8b662740f78c6501aefceedc19&p=28&g=NO&token=4a44335432&tbg=1661897254
200 OK 599 B URL HTTP/2 imp9.bidgear.com/rec?t=1&z=6192&uuid=40ecad8b662740f78c6501aefceedc19&p=28&g=NO&token=4a44335432&tbg=1661897254
IP
File type JPEG image data, baseline, precision 8, 1x1, components 3\012- data
Hash ca49a7e783b806a4e8576ea80346203d
6fe9d083221dae98f6c76f7121c37bc884b02d82
3e9a98dd5f0a28ff4a059f33d760264a6db02786666ac1692095ebb976f5da28
GET /rec?t=1&z=6192&uuid=40ecad8b662740f78c6501aefceedc19&p=28&g=NO&token=4a44335432&tbg=1661897254 HTTP/1.1
Host: imp9.bidgear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: image/jpeg
content-length: 599
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ez9jpiwNFdAnkb5NkJJB2WRmAqnv4q5Mrd1fjCHq7smigcsswGCRZhpfYrzu152ekk3BVeY0KTgvODJqTbARSVtCUl4NsbXWb14B8OezUeDbr1D9nangZPlCHL8HByRS0k%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d713ed34b524-OSL
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/images/icons/favicon/apple-touch-icon-114x114.png
200 OK 951 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/images/icons/favicon/apple-touch-icon-114x114.png
IP
File type PNG image data, 114 x 114, 8-bit colormap, non-interlaced\012- data
Hash 76852bc6b2c028db97322a74e85bd020
ed52fb4de0d51f93277bbaae42fa80ba5f92c31e
8a5ef2ef8440c17db1b1b539065ba4a887e07a2c508b79c2d1659512e9016884
GET /themes/flow/frontend_assets/images/icons/favicon/apple-touch-icon-114x114.png HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: image/png
content-length: 951
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-3b7"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
dmmzkfd82wayn.cloudfront.net/qMGdmVlVTCAgwakQOAmtiBlNXYmQWDRU5O0BaMwcPdiM0ZWBbLx5wIUoDW2ZzXAYIMWgWAgg1aAFBBzI3DVNAIiVfDFsiI1wOEy4tRA0QcCBRWgs5L1kLCjdwAiFTeGUVVVZ+LQFWQ2UXFVVWOjxeEh5zZwAfXmAKBlNDZRcVVVYkIxVUJ29jHldPc2cAAA-M1Pl9CVBBnAFZWZmQAVkNkZVYOFDMzXx9DZBMJUUhmc0VaVw
200 OK 595 B URL HTTP/2 dmmzkfd82wayn.cloudfront.net/qMGdmVlVTCAgwakQOAmtiBlNXYmQWDRU5O0BaMwcPdiM0ZWBbLx5wIUoDW2ZzXAYIMWgWAgg1aAFBBzI3DVNAIiVfDFsiI1wOEy4tRA0QcCBRWgs5L1kLCjdwAiFTeGUVVVZ+LQFWQ2UXFVVWOjxeEh5zZwAfXmAKBlNDZRcVVVYkIxVUJ29jHldPc2cAAA-M1Pl9CVBBnAFZWZmQAVkNkZVYOFDMzXx9DZBMJUUhmc0VaVw
IP
File type ASCII text, with very long lines (831), with no line terminators
Hash dba4f34bc807d0513556eec1d26569e4
bff909fe206f73857067d1047d2e9a6b69fde5d6
d151e4e274ca637e83d40c2d65e2ef9aeac194d060b25686a7af87d9b034d6d0
GET /qMGdmVlVTCAgwakQOAmtiBlNXYmQWDRU5O0BaMwcPdiM0ZWBbLx5wIUoDW2ZzXAYIMWgWAgg1aAFBBzI3DVNAIiVfDFsiI1wOEy4tRA0QcCBRWgs5L1kLCjdwAiFTeGUVVVZ+LQFWQ2UXFVVWOjxeEh5zZwAfXmAKBlNDZRcVVVYkIxVUJ29jHldPc2cAAA-M1Pl9CVBBnAFZWZmQAVkNkZVYOFDMzXx9DZBMJUUhmc0VaVw HTTP/1.1
Host: dmmzkfd82wayn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://rtyvaluation.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 595
date: Tue, 30 Aug 2022 22:07:35 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: bEkJm6Cb35Yl_a_0ivWg9sB4HdoKvzeZaSca9VFgTJhdVH4E255ziA==
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 26918a542b9365b6f37166478b97350c
eb07defb2a83bc7f7ec9daf5677a8fb30648fcc6
2d798ea9020987b456a2e6fffc78fbadc5a31244d99fd3eb375911564daf3171
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3096
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:35 GMT
Last-Modified: Tue, 30 Aug 2022 21:15:59 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash ba486550360adc2eef170bc798cbba88
a042d037f2d996bf8f8f3516c41035b018153ee9
6dd9639492330e813edeff005757c1df825596fe9e28ec6fbfd4ae7bb6934713
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash ba486550360adc2eef170bc798cbba88
a042d037f2d996bf8f8f3516c41035b018153ee9
6dd9639492330e813edeff005757c1df825596fe9e28ec6fbfd4ae7bb6934713
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1325)
Hash 56f5d7f608e25d64207135f045f988cb
901eb59372ae330ae85e1384da93479b21ae1082
1910daea79e5a9d04829a91e432dfa56f45a80a3e14a8cf667fec73af9fd3d29
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20006
date: Tue, 30 Aug 2022 20:41:12 GMT
expires: Tue, 30 Aug 2022 22:41:12 GMT
cache-control: public, max-age=7200
age: 5183
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
rtyvaluation.shop/utx?cb=2ciOwKjJZ7P4&top=megaup.net&tid=761186
204 No Content 0 B URL HTTP/2 rtyvaluation.shop/utx?cb=2ciOwKjJZ7P4&top=megaup.net&tid=761186
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=2ciOwKjJZ7P4&top=megaup.net&tid=761186 HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 30 Aug 2022 22:08:35 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: YUj1ElLwovGcAeS7kV0ZwL1LlqDOqlNbjzMiKCmLPaC_4cZHM6qayQ==
X-Firefox-Spdy: h2
rtyvaluation.shop/utx?cb=0olWJXvLJWqm&top=megaup.net&tid=825911
204 No Content 0 B URL HTTP/2 rtyvaluation.shop/utx?cb=0olWJXvLJWqm&top=megaup.net&tid=825911
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=0olWJXvLJWqm&top=megaup.net&tid=825911 HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 30 Aug 2022 22:08:35 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: xdd2ZXrVa_lSMFfLGTsoYzF0mM6X54g2xy6hWHc2jrXrxieCfdAtuw==
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 398 B URL HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (383)
Hash ea3bd6513bc802fcd83a2b98acd254e5
f3cc217caf75ef7940e7b33ff6292eb7cd01a2e7
642ca13dd632eedee8ff67de214d776329f49a418c209804c383aee946b87215
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 30 Aug 2022 22:07:35 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S-1375402792%3A1661897255228740&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmXjEnXvDT70HGlBfI7QBJIOM5Ec6xZ7kJ7w0eIflaF9V_M94uQePbXtlrtvafvhyI9iK-fs
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-HPkfISy2fYZgqSqN9O5OtA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 398
server: GSE
set-cookie: __Host-GAPS=1:R6uvR6wP_RrOXoS8VEslZHv2qsZ6Ew:fKhW75xPBsQ4c9v_;Path=/;Expires=Thu, 29-Aug-2024 22:07:35 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/bootstrap/bootstrap.min.css
200 OK 19 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/bootstrap/bootstrap.min.css
IP
File type assembler source, ASCII text, with very long lines (540), with CRLF line terminators
Hash 06fe8320ffc3ce8f9c395afbe16446aa
ce80ceb3847bfd8a574d58b6c1045e867820b5bd
db1da37a0423754275d91f311ae7703f267093128911d2526b22eb2f48b4ea37
GET /themes/flow/frontend_assets/css/bootstrap/bootstrap.min.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1cc1b"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 392 B URL HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (381)
Hash b7b3028194e6b84dfd1ef02721d85fe4
382ce35eb8d250bbad3dd4b9c8d49eb04ac0df6d
61a4c14e724832aef2ee2b8c281b85cfc16d2e063ef53436134f79b459ad10de
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 30 Aug 2022 22:07:35 GMT
location: https://accounts.google.com/v3/signin/identifier?dsh=S-1643821255%3A1661897255270092&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmV30c5b6DLOG9HVdcxVj1rG9wN5q4IJ3cd-r7-oKm2V5jIRJAFpSioGYjo1vYUdU3SsWYnsnA
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-f72VdCPPRhHRT2g1XxlUlg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 392
server: GSE
set-cookie: __Host-GAPS=1:qlmB7E2nIPalutXqNUHaCgGLDWYzRQ:RQ34oVLB_E8SIpXq;Path=/;Expires=Thu, 29-Aug-2024 22:07:35 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
syndication.exdynsrv.com/v1/api.php
200 OK 724 B URL HTTP/1.1 syndication.exdynsrv.com/v1/api.php
IP
ASN #60781 LeaseWeb Netherlands B.V.
File type JSON data\012- , ASCII text, with very long lines (967), with no line terminators
Hash 942f73a462e46f4924bd8ff4cadce611
a95824a7a456fab314774a8621d6e2fbd4e6b838
bafcb612759a2d59aeffb0e8e57f5f9ce6175689920d1a1d0754c9bd5837b950
POST /v1/api.php HTTP/1.1
Host: syndication.exdynsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 306
Origin: https://megaup.net
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:35 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://megaup.net
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Request-Method: POST
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
accounts.google.com/v3/signin/identifier?dsh=S-1375402792%3A1661897255228740&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmXjEnXvDT70HGlBfI7QBJIOM5Ec6xZ7kJ7w0eIflaF9V_M94uQePbXtlrtvafvhyI9iK-fs
403 Forbidden 1.3 kB URL HTTP/2 accounts.google.com/v3/signin/identifier?dsh=S-1375402792%3A1661897255228740&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmXjEnXvDT70HGlBfI7QBJIOM5Ec6xZ7kJ7w0eIflaF9V_M94uQePbXtlrtvafvhyI9iK-fs
IP
Hash 89f7ec38529ec57e62c0d914270f04a6
b66464f4c1bbd9979eb671eff3a1d4ede3c56b8b
58089196a18464e2187ad3c030b3680392c7e495f36fafab1324f40dc89c8445
GET /v3/signin/identifier?dsh=S-1375402792%3A1661897255228740&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmXjEnXvDT70HGlBfI7QBJIOM5Ec6xZ7kJ7w0eIflaF9V_M94uQePbXtlrtvafvhyI9iK-fs HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 30 Aug 2022 22:07:35 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-RcIBcXO8k5XpH1J2PfbE8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi/external"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
set-cookie: NID=511=qJRU596QLhL6bYb7DX_zXcDLueACgx42Zx3EjVnktMC4mkIOdN6L4uWp_kz5MxGBhBfuasxNSUCG4AJVSLpBYbApSeT-idODbTjwWPSzHgCaaO9lzrR-9Cac4zlqlIviDX-Ct9YdAcmN2g8ZvYV1oFCW2_ZBEvx2RbUg1Vx7ETA; expires=Wed, 01-Mar-2023 22:07:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
static.a-ads.com/a-ads-banners/407258/300x250?region=eu-central-1
200 OK 621 kB URL HTTP/2 static.a-ads.com/a-ads-banners/407258/300x250?region=eu-central-1
IP
ASN #24940 Hetzner Online GmbH
File type GIF image data, version 89a, 300 x 250\012- data
Size 621 kB (621339 bytes)
Hash c8694e7d5d3b9a928d4d57026ac2b68b
169b9f311167e19bd5061b53fc7e4f528e3ba7a9
0c23834abdcff9f74a47b37290da55f2c84c31c82ce26d9493b39a388b51ed6a
GET /a-ads-banners/407258/300x250?region=eu-central-1 HTTP/1.1
Host: static.a-ads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ad.a-ads.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: image/gif
content-length: 621339
x-amz-id-2: BPvL1vk7bm6F4zx36fXrRzIGlHun6BLlRHcQ8CVupSOfKM88cidM0Q0wlhNMhRriw3VG9bPqFqg=
x-amz-request-id: 303V7CX6YDXXEH3J
x-amz-replication-status: COMPLETED
last-modified: Fri, 05 Aug 2022 10:27:24 GMT
etag: "c8694e7d5d3b9a928d4d57026ac2b68b"
cache-control: max-age=315360000
x-amz-version-id: 4Mo2D8..v2g7Hr5lFGow.NiBZmPPXN08
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 26918a542b9365b6f37166478b97350c
eb07defb2a83bc7f7ec9daf5677a8fb30648fcc6
2d798ea9020987b456a2e6fffc78fbadc5a31244d99fd3eb375911564daf3171
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3096
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:35 GMT
Last-Modified: Tue, 30 Aug 2022 21:15:59 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471
rtyvaluation.shop/utx?cb=um7gJp0trdg4&top=megaup.net&tid=876318
204 No Content 0 B URL HTTP/2 rtyvaluation.shop/utx?cb=um7gJp0trdg4&top=megaup.net&tid=876318
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=um7gJp0trdg4&top=megaup.net&tid=876318 HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 30 Aug 2022 22:08:35 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: wDwZigpwuvIFlhT_Hb85dc0xan_6LzL7mJKixh2c0EoNsfwLux5mKA==
X-Firefox-Spdy: h2
rtyvaluation.shop/utx?cb=v1IY6ApUD39P&top=megaup.net&tid=764141
204 No Content 0 B URL HTTP/2 rtyvaluation.shop/utx?cb=v1IY6ApUD39P&top=megaup.net&tid=764141
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=v1IY6ApUD39P&top=megaup.net&tid=764141 HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 30 Aug 2022 22:08:35 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: qDHqiTCpwZ5T1r6GNopm5eUI04Wi2G50Dc7MVOMduuDyd9JygqlR9w==
X-Firefox-Spdy: h2
syndication.exdynsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAA01PW0pDMRDdihtomGeS6bffCooLSNpcvyyCFSqcxZt7KxfnzMA8zryERA5UD0oPXI9UjuoITkHJJLEbnp5fYIyP8d6+P9NlXKEcWQg5gqwi1KpkmGXjmuHMMInsxWC1FiYjsENBE+JqtnqJiBiV8Pb6uBlPCJToJj4btrVgEtgM6LY2l8x98SHciBeN1iSq1iWfS5tafSX+v5PuSMRi2/S/xHzAVExw4D0wTCFs5fb1czkBO/0O3wfMB43OZfSIKLkvY+mDy6l3Z1HvPedfHeAbzlUBAAA=
200 OK 20 B URL HTTP/1.1 syndication.exdynsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAA01PW0pDMRDdihtomGeS6bffCooLSNpcvyyCFSqcxZt7KxfnzMA8zryERA5UD0oPXI9UjuoITkHJJLEbnp5fYIyP8d6+P9NlXKEcWQg5gqwi1KpkmGXjmuHMMInsxWC1FiYjsENBE+JqtnqJiBiV8Pb6uBlPCJToJj4btrVgEtgM6LY2l8x98SHciBeN1iSq1iWfS5tafSX+v5PuSMRi2/S/xHzAVExw4D0wTCFs5fb1czkBO/0O3wfMB43OZfSIKLkvY+mDy6l3Z1HvPedfHeAbzlUBAAA=
IP
ASN #60781 LeaseWeb Netherlands B.V.
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /cimp.php?t=api&data=H4sIAAAAAAAAA01PW0pDMRDdihtomGeS6bffCooLSNpcvyyCFSqcxZt7KxfnzMA8zryERA5UD0oPXI9UjuoITkHJJLEbnp5fYIyP8d6+P9NlXKEcWQg5gqwi1KpkmGXjmuHMMInsxWC1FiYjsENBE+JqtnqJiBiV8Pb6uBlPCJToJj4btrVgEtgM6LY2l8x98SHciBeN1iSq1iWfS5tafSX+v5PuSMRi2/S/xHzAVExw4D0wTCFs5fb1czkBO/0O3wfMB43OZfSIKLkvY+mDy6l3Z1HvPedfHeAbzlUBAAA= HTTP/1.1
Host: syndication.exdynsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://megaup.net
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 30 Aug 2022 22:07:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ocsp.digicert.com/
200 OK 313 B IP
Hash eceee0a3c1fef90ae8480ff820446321
ef0cf7cfc4ae42f49952e6ab13cb98411bf45206
7f19a32a86d5cf78b21a6cf7c54ceecff8d4cd9b0c0d2f123a6ab30cdb1789c1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3631
Cache-Control: max-age=154435
Content-Type: application/ocsp-response
Date: Tue, 30 Aug 2022 22:07:35 GMT
Etag: "630e343c-139"
Expires: Thu, 01 Sep 2022 17:01:30 GMT
Last-Modified: Tue, 30 Aug 2022 16:01:00 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 313
hw-cdn2.ang-content.com/delivery/vortex/vortex-simple-1.0.0.js
200 OK 5.0 kB URL HTTP/1.1 hw-cdn2.ang-content.com/delivery/vortex/vortex-simple-1.0.0.js
IP
File type ASCII text, with very long lines (5027), with no line terminators
Hash 5e5817bcf4c82c7c85d1d88636d221ce
b5c32cc6c931c33c1297884016e13d3b9a5bf261
6f0e50ac39121175ca0427c4e87cdfa2520b526c8497e23cffbca726eb6ca42c
GET /delivery/vortex/vortex-simple-1.0.0.js HTTP/1.1
Host: hw-cdn2.ang-content.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.adtng.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: Keep-Alive
ETag: "1541168231"
Content-Length: 5027
Content-Type: application/javascript
Last-Modified: Fri, 02 Nov 2018 14:17:11 GMT
Accept-Ranges: bytes
Cache-Control: max-age=10373784
X-HW: 1661897255.dop204.sk1.t,1661897255.cds254.sk1.shn,1661897255.cds254.sk1.c
Access-Control-Allow-Origin: *
rtyvaluation.shop/utx?tid=832633&top=megaup.net&cb=sHAl5QonkQYU
204 No Content 0 B URL HTTP/2 rtyvaluation.shop/utx?tid=832633&top=megaup.net&cb=sHAl5QonkQYU
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?tid=832633&top=megaup.net&cb=sHAl5QonkQYU HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Tue, 30 Aug 2022 22:08:35 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 8a4XuKEbgAnJLm7tt9zbD8BmSeRZ92LJSFSdhHzw884ve9OFlKepuA==
X-Firefox-Spdy: h2
hw-cdn2.adtng.com/delivery/intersection_observer/IntersectionObserver.js
200 OK 17 kB URL HTTP/1.1 hw-cdn2.adtng.com/delivery/intersection_observer/IntersectionObserver.js
IP
File type ASCII text, with very long lines (16885), with no line terminators
Hash 48c80c7c28b5b00a8b4ff94a22b72fe3
d57303c2ad2fd5cedc5cb20f264a6965a7819cee
6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356
GET /delivery/intersection_observer/IntersectionObserver.js HTTP/1.1
Host: hw-cdn2.adtng.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.adtng.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/1.1 200 OK
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: Keep-Alive
ETag: "1649192094"
Content-Length: 16885
Content-Type: application/javascript
Last-Modified: Tue, 05 Apr 2022 20:54:54 GMT
Accept-Ranges: bytes
Cache-Control: max-age=10721974
X-HW: 1661897255.dop205.sk1.t,1661897255.cds259.sk1.shn,1661897255.cds259.sk1.c
Access-Control-Allow-Origin: *
hw-cdn2.ang-content.com/a7/creatives/39/1393/805208/1028974/1028974_logo.png
200 OK 16 kB URL HTTP/1.1 hw-cdn2.ang-content.com/a7/creatives/39/1393/805208/1028974/1028974_logo.png
IP
File type PNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced\012- data
Hash 2aaacb14c0816c811151f7e5ad369e9f
2b51b630dcbbdcd9cb0e9c298a5d4323de0f19f5
c6f084bf2cbf871312c3c508455dfeff2bb11dc8909d98ab1a43897b16bedf4e
GET /a7/creatives/39/1393/805208/1028974/1028974_logo.png HTTP/1.1
Host: hw-cdn2.ang-content.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.adtng.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: Keep-Alive
ETag: "1649873991"
Content-Length: 15603
Content-Type: image/png
Last-Modified: Wed, 13 Apr 2022 18:19:51 GMT
Accept-Ranges: bytes
Cache-Control: max-age=10552566
X-HW: 1661897255.dop001.sk1.t,1661897255.cds206.sk1.shn,1661897255.dop001.sk1.t,1661897255.cds227.sk1.c
Access-Control-Allow-Origin: *
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8efe3f862f08b040d9209e0e3cad920e
9f0f7bdc0e49c4e9e7b149bc2313c032d0e5ed45
8b34d51987195f7a6ac75b7ae2bed61adda8f3badd1ab0b56822a65a4e1afc2f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B34D51987195F7A6AC75B7AE2BED61ADDA8F3BADD1AB0B56822A65A4E1AFC2F"
Last-Modified: Tue, 30 Aug 2022 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11143
Expires: Wed, 31 Aug 2022 01:13:18 GMT
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: keep-alive
hw-cdn2.ang-content.com/a7/creatives/39/1393/805208/1028974/1028974_video.mp4
206 Partial Content 513 kB URL HTTP/1.1 hw-cdn2.ang-content.com/a7/creatives/39/1393/805208/1028974/1028974_video.mp4
IP
File type ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]\012- data
Size 513 kB (513036 bytes)
Hash b8e13fc38d24155acfee347096dd0337
8b197d6a698841b21d30425c79c640912c31c55f
968c1265d8caffcb43ce690d7964e6f8c2f9fd2df304b53b43d4b76cf33834de
GET /a7/creatives/39/1393/805208/1028974/1028974_video.mp4 HTTP/1.1
Host: hw-cdn2.ang-content.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://a.adtng.com/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 206 Partial Content
Date: Tue, 30 Aug 2022 22:07:35 GMT
Connection: Keep-Alive
ETag: "1649875693"
Content-Length: 513036
Content-Range: bytes 0-513035/513036
Content-Type: video/mp4
Last-Modified: Wed, 13 Apr 2022 18:48:13 GMT
Accept-Ranges: bytes
Cache-Control: max-age=10471743
X-HW: 1661897255.dop001.sk1.t,1661897255.cds206.sk1.shn,1661897255.dop001.sk1.t,1661897255.cds222.sk1.c
Access-Control-Allow-Origin: *
rtyvaluation.shop/multi?cs=b2xFTkFaX3F%2FdV1Vd3Z4WFR0eXc&abt=0&red=1&sm=76&k=download%20file%20transformers%20revenge%20fallen%20part2&v=1.0.59.0&sts=0&prn=0&emb=0&tid=876318&u=2175408218330366&agec=1661897255&fs=1&mbkb=165.8374792703151&ref=https%3A%2F%2Fmegaup.net%2F20Py%2FTRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar&jst=0&enr=0&lcua=mozilla%2F5.0%20(x11%3B%20linux%20x86_64%3B%20rv%3A96.0)%20gecko%2F20100101%20firefox%2F96.0&tzd=0&uloc=&if=0&_MvCI=1661897255739&crc=1
200 OK 1.5 kB URL HTTP/2 rtyvaluation.shop/multi?cs=b2xFTkFaX3F%2FdV1Vd3Z4WFR0eXc&abt=0&red=1&sm=76&k=download%20file%20transformers%20revenge%20fallen%20part2&v=1.0.59.0&sts=0&prn=0&emb=0&tid=876318&u=2175408218330366&agec=1661897255&fs=1&mbkb=165.8374792703151&ref=https%3A%2F%2Fmegaup.net%2F20Py%2FTRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar&jst=0&enr=0&lcua=mozilla%2F5.0%20(x11%3B%20linux%20x86_64%3B%20rv%3A96.0)%20gecko%2F20100101%20firefox%2F96.0&tzd=0&uloc=&if=0&_MvCI=1661897255739&crc=1
IP
File type ASCII text, with very long lines (3195), with no line terminators
Hash 32b78c3d7d5413f4f0e08b38afdece43
66ccb5b41f514beff7e1e704fde51be574bea1de
74f2e875ca7eeb7ec6ee18fafeccc3087a85f3d5be91182a27032b6dce928291
GET /multi?cs=b2xFTkFaX3F%2FdV1Vd3Z4WFR0eXc&abt=0&red=1&sm=76&k=download%20file%20transformers%20revenge%20fallen%20part2&v=1.0.59.0&sts=0&prn=0&emb=0&tid=876318&u=2175408218330366&agec=1661897255&fs=1&mbkb=165.8374792703151&ref=https%3A%2F%2Fmegaup.net%2F20Py%2FTRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar&jst=0&enr=0&lcua=mozilla%2F5.0%20(x11%3B%20linux%20x86_64%3B%20rv%3A96.0)%20gecko%2F20100101%20firefox%2F96.0&tzd=0&uloc=&if=0&_MvCI=1661897255739&crc=1 HTTP/1.1
Host: rtyvaluation.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/plain
content-length: 1517
date: Tue, 30 Aug 2022 22:07:35 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://megaup.net
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: csu=770dc3c8-a96c-4626-a9a6-3264c1072938
csu=2175408218330366
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: KHurn8lYq2MxVPIcB6zCTVZTKW-S_U5HBsBRYDONFtRczOAT3wcYWg==
X-Firefox-Spdy: h2
stellihandles.hair/
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: stellihandles.hair
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain;charset=UTF-8
Content-Length: 384
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/fonts/raleway_bold.woff
200 OK 32 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/raleway_bold.woff
IP
File type Web Open Font Format, TrueType, length 31568, version 1.1\012- data
Hash e0c4ac0e73196bd0469c5c33304b7773
bb071565f82907d117b0732dca8013409162c67d
ff3bf3a4a1bf2b922157b18d0e8cddd95f2fc2dfe09c30a3ce67bc11a84c67af
GET /themes/flow/frontend_assets/fonts/raleway_bold.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4; _ga=GA1.2.156062990.1661897255; _gid=GA1.2.1978877189.1661897255; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: font/woff
content-length: 31568
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7b50"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
a.adtng.com/track/adviews/eyJleHRfemlkIjoiIiwiZXh0X2MiOiIiLCJleHRfYWlkIjoiIiwicGlkIjoiMTM5MyIsInNpZCI6IjEwMDEyNDU2IiwibmlkcyI6IjU5MTUxIiwiZHluX2RtbiI6IiIsImNyaWQiOiIxMDI4OTc0Iiwic3YiOiI1NjQ5IiwicmVmX2RtbiI6Im1lZ2F1cC5uZXQiLCJleHRfY2lkIjoiIiwidHNuYW1lIjoiTUIiLCJjcmMiOiIxIiwiY24iOiIzMDBYMjUwX1BDX05US19QUVRfU0ZXIiwibmlkIjoiNTkxNTEiLCJleHRfcHViIjoiIiwiY3JwIjoiMTAwIiwidGlkIjoiMSIsIml0IjoiMzBcL0F1Z1wvMjAyMjoyMjowNzozNSArMDAwMCIsImNjIjoiMyIsInNuY2lkIjoiOTUyOTkiLCJjaWQiOiIzNDMwMiIsImV4dF91aWQiOiIiLCJjcCI6IjQzLjg5Iiwic25jY2lkIjoiMTg3OTMzOSIsImlpZCI6ImUxODEzMzBkODk1MmFiN2Y1ZjBiMTU1NjAyMWZjZTUwIiwiZXh0X2lpZCI6IiJ9?unique_view=1
200 OK 3.8 kB URL HTTP/2 a.adtng.com/track/adviews/eyJleHRfemlkIjoiIiwiZXh0X2MiOiIiLCJleHRfYWlkIjoiIiwicGlkIjoiMTM5MyIsInNpZCI6IjEwMDEyNDU2IiwibmlkcyI6IjU5MTUxIiwiZHluX2RtbiI6IiIsImNyaWQiOiIxMDI4OTc0Iiwic3YiOiI1NjQ5IiwicmVmX2RtbiI6Im1lZ2F1cC5uZXQiLCJleHRfY2lkIjoiIiwidHNuYW1lIjoiTUIiLCJjcmMiOiIxIiwiY24iOiIzMDBYMjUwX1BDX05US19QUVRfU0ZXIiwibmlkIjoiNTkxNTEiLCJleHRfcHViIjoiIiwiY3JwIjoiMTAwIiwidGlkIjoiMSIsIml0IjoiMzBcL0F1Z1wvMjAyMjoyMjowNzozNSArMDAwMCIsImNjIjoiMyIsInNuY2lkIjoiOTUyOTkiLCJjaWQiOiIzNDMwMiIsImV4dF91aWQiOiIiLCJjcCI6IjQzLjg5Iiwic25jY2lkIjoiMTg3OTMzOSIsImlpZCI6ImUxODEzMzBkODk1MmFiN2Y1ZjBiMTU1NjAyMWZjZTUwIiwiZXh0X2lpZCI6IiJ9?unique_view=1
IP
File type ASCII text, with very long lines (5811), with no line terminators
Hash 9c6fb3dcabe037f5d09733ff6ec2a8dc
3534cd04c1862aef5e1a6ed8e4fa4d1d602934a3
376794f69c3aed72acfbd25cb960300f47fb733dda7944f0d3da3d49399ad189
GET /track/adviews/eyJleHRfemlkIjoiIiwiZXh0X2MiOiIiLCJleHRfYWlkIjoiIiwicGlkIjoiMTM5MyIsInNpZCI6IjEwMDEyNDU2IiwibmlkcyI6IjU5MTUxIiwiZHluX2RtbiI6IiIsImNyaWQiOiIxMDI4OTc0Iiwic3YiOiI1NjQ5IiwicmVmX2RtbiI6Im1lZ2F1cC5uZXQiLCJleHRfY2lkIjoiIiwidHNuYW1lIjoiTUIiLCJjcmMiOiIxIiwiY24iOiIzMDBYMjUwX1BDX05US19QUVRfU0ZXIiwibmlkIjoiNTkxNTEiLCJleHRfcHViIjoiIiwiY3JwIjoiMTAwIiwidGlkIjoiMSIsIml0IjoiMzBcL0F1Z1wvMjAyMjoyMjowNzozNSArMDAwMCIsImNjIjoiMyIsInNuY2lkIjoiOTUyOTkiLCJjaWQiOiIzNDMwMiIsImV4dF91aWQiOiIiLCJjcCI6IjQzLjg5Iiwic25jY2lkIjoiMTg3OTMzOSIsImlpZCI6ImUxODEzMzBkODk1MmFiN2Y1ZjBiMTU1NjAyMWZjZTUwIiwiZXh0X2lpZCI6IiJ9?unique_view=1 HTTP/1.1
Host: a.adtng.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://a.adtng.com/get/10012456?time=1614803572912&apb=ooddNHdLHTPHNVS4ASOpprpmtrdTbbZNLTK6V1Esqp6pXVTTOpmdQ6ap0rpXSunqoppdRNTRPTO6iamieml0rpnSuldK6V0zpXSumc6yubTireebOWbii7POe62i3ivazPazO2p0rv9.czijBuZznSuldK6V0rpXSuldK4Ps
Cookie: adtool_guid=Ch5KFmMOiid6ihe8sU26Ag==; RNLBSERVERID=ded7040
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: openresty
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: text/html
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-encoding: gzip
x-request-id: 630E8A27-42FE72AB01BB6A93-10A9D224
X-Firefox-Spdy: h2
stellihandles.hair/
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: stellihandles.hair
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain;charset=UTF-8
Origin: https://megaup.net
Content-Length: 353
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2
stellihandles.hair/
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1
Host: stellihandles.hair
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Content-Type: text/plain;charset=UTF-8
Origin: https://megaup.net
Content-Length: 356
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 0
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8483eb99dbd130593ed0072e2fbaccf9
fcb83f0b4a448f0b94b0bf9db431cc802413dacd
5e07e7bbf5dd7a48f9330dbc0248b7a1aa69dff7a9a913f493a384d2ec332f74
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5E07E7BBF5DD7A48F9330DBC0248B7A1AA69DFF7A9A913F493A384D2EC332F74"
Last-Modified: Sun, 28 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4636
Expires: Tue, 30 Aug 2022 23:24:52 GMT
Date: Tue, 30 Aug 2022 22:07:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8483eb99dbd130593ed0072e2fbaccf9
fcb83f0b4a448f0b94b0bf9db431cc802413dacd
5e07e7bbf5dd7a48f9330dbc0248b7a1aa69dff7a9a913f493a384d2ec332f74
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5E07E7BBF5DD7A48F9330DBC0248B7A1AA69DFF7A9A913F493A384D2EC332F74"
Last-Modified: Sun, 28 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4636
Expires: Tue, 30 Aug 2022 23:24:52 GMT
Date: Tue, 30 Aug 2022 22:07:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8483eb99dbd130593ed0072e2fbaccf9
fcb83f0b4a448f0b94b0bf9db431cc802413dacd
5e07e7bbf5dd7a48f9330dbc0248b7a1aa69dff7a9a913f493a384d2ec332f74
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5E07E7BBF5DD7A48F9330DBC0248B7A1AA69DFF7A9A913F493A384D2EC332F74"
Last-Modified: Sun, 28 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4636
Expires: Tue, 30 Aug 2022 23:24:52 GMT
Date: Tue, 30 Aug 2022 22:07:36 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa91a5094-5af6-430d-993d-243427b324ba.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa91a5094-5af6-430d-993d-243427b324ba.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 82bc1c69018845280d29653d6b2d6f8d
0c122f15422cab7ee3461e8fa657183ae54adcc5
e221638eff281c27ef4656f76e64963718186285c57e50a8958bd3065e662674
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa91a5094-5af6-430d-993d-243427b324ba.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9980
x-amzn-requestid: b9f6b930-9c47-41b9-879d-ce239e39f033
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XpTMGHlNoAMFuoA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630d324d-72ea52c010dff34438bbca28;Sampled=0
x-amzn-remapped-date: Mon, 29 Aug 2022 21:40:29 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: fHSa3fGJD-E4daWDZyyKGaErPw9YBbAwJ2uQ2dxbxl2UJCXXDRykag==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 21:45:04 GMT
age: 1352
etag: "0c122f15422cab7ee3461e8fa657183ae54adcc5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd073058d-a781-4fa3-abd4-05363877c306.jpeg
200 OK 8.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd073058d-a781-4fa3-abd4-05363877c306.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 87425d52d274ccbc12298aa7a47395f2
b2866f84f93b73d97e9aecfa2293ff47131b6d67
2284c74b04493c7a67907b2477bac252832f3550c6a7e57c221abefc45a12549
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd073058d-a781-4fa3-abd4-05363877c306.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8478
x-amzn-requestid: 8ae5ce3f-0d58-412b-84f1-579c5cf21fd8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XpTWIH5JoAMFh9g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630d328d-7bb707102a3acb0320585b52;Sampled=0
x-amzn-remapped-date: Mon, 29 Aug 2022 21:41:33 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: G0y5MCu_U2IUMTrWxPmyUefwSkF5tcEWpPh7sZ-Bn_1lXZv12tlpgQ==
via: 1.1 b47618c03bd47cf085f27b1e215f76cc.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 21:57:58 GMT
age: 578
etag: "b2866f84f93b73d97e9aecfa2293ff47131b6d67"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2ed547f-030a-462d-a7c7-12a7748cf9c8.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2ed547f-030a-462d-a7c7-12a7748cf9c8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 91310bc1fb5ae0efa502a9bafe046399
ec2a4baf0a21c1738a541d89756cccd6f3bef5fd
5fe0511116c6bd2d6e668c69764905c3a5c93fa23a4dc207b0f4b1604783ceb6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2ed547f-030a-462d-a7c7-12a7748cf9c8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5925
x-amzn-requestid: 15e5a8fd-8a14-486d-9e83-7da3dafd1713
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XpSfZEEooAMFbeA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630d312f-05652d4e06746e8b4f4be29b;Sampled=0
x-amzn-remapped-date: Mon, 29 Aug 2022 21:35:43 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: bYTWcGb1-aWdEhGox1If7F0NpZ0JDobDMZK6l0J7a2tb9_ejGKDiDQ==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 21:45:09 GMT
age: 1347
etag: "ec2a4baf0a21c1738a541d89756cccd6f3bef5fd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19e4053-4c42-4436-ba83-5e76fd16f5a4.webp
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19e4053-4c42-4436-ba83-5e76fd16f5a4.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0502c5060f29d82fd10f9f79459e2ce0
110f2eecf72c6b89f250ebefeff5ef664dc2f3f6
f722656c432bbec2baa63b6edc4116c1996850462864456105d9fea9c3bc7ff4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19e4053-4c42-4436-ba83-5e76fd16f5a4.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10056
x-amzn-requestid: 2eb7bbf2-47ad-4f80-98e8-ecb45e98961b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Xguh2H_woAMFXnQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6309c472-7dda060b4e7c81262aef3421;Sampled=0
x-amzn-remapped-date: Sat, 27 Aug 2022 07:14:58 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 1cunCq4Z1J-oQSmTlcAtgfXO0A4_XpHKl2UHpRCbf75--3eHEIgZGQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 11:39:46 GMT
age: 37670
etag: "110f2eecf72c6b89f250ebefeff5ef664dc2f3f6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feac04243-b8b9-46aa-ad1f-285d333e6c88.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feac04243-b8b9-46aa-ad1f-285d333e6c88.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9f9132960db725a095b0db1773dc6f69
bf1d4347e1641da5aebe6ae438c0431232ae6242
0e0b84df674d48517a04819604deb555c904518f093784691de4914b6ddb9e9d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feac04243-b8b9-46aa-ad1f-285d333e6c88.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10672
x-amzn-requestid: 9044b578-ffc7-4890-a16f-bf6d5e242f46
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XnTWcEUnoAMF_UA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630c65c2-4397932f1417f6ab2463c4b0;Sampled=0
x-amzn-remapped-date: Mon, 29 Aug 2022 07:07:46 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: uc8twk9uXve3wFxTvsZa_sg-aduiVBxXjTvOdqBc_BZmgw4BldMyHQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 07:15:20 GMT
age: 53536
etag: "bf1d4347e1641da5aebe6ae438c0431232ae6242"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4955929-0b9f-4215-9599-dffe8c74c90c.jpeg
200 OK 8.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4955929-0b9f-4215-9599-dffe8c74c90c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash feb433a0823cccb81dc4c5fa13ba4ed2
143f7bb98f57f8e6189e73e75a9fc93d29548962
09a5ddc32918b441b6d3ce3eed211d674d3844db6770e06bb3fecb86cc85771a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4955929-0b9f-4215-9599-dffe8c74c90c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8909
x-amzn-requestid: 2c4357d3-5c22-465a-a65a-e281d87c5305
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XnTxZGYEIAMFeZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-630c666f-36b5010a793ab9c87182a895;Sampled=0
x-amzn-remapped-date: Mon, 29 Aug 2022 07:10:39 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2Y3cwsCGFKFQYWkxG96XsjTJMrCMccbdhjRvbB04PCNF2YupDcEcng==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google
date: Tue, 30 Aug 2022 07:33:49 GMT
age: 52427
etag: "143f7bb98f57f8e6189e73e75a9fc93d29548962"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash dceff50588039a3e14ff008d222a289e
b4ef462b95f0d914e537cb23ceab77205dadda26
2bad5a74da16025d8aca0967c36e87ec039519e04b543b9000c27fe96284bcc7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "2BAD5A74DA16025D8ACA0967C36E87EC039519E04B543B9000C27FE96284BCC7"
Last-Modified: Mon, 29 Aug 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3427
Expires: Tue, 30 Aug 2022 23:04:45 GMT
Date: Tue, 30 Aug 2022 22:07:38 GMT
Connection: keep-alive
xml.serve-servee.com/thumbnail?i=aMpvXSUB5no_0&imgt=icon
302 Found 0 B URL HTTP/2 xml.serve-servee.com/thumbnail?i=aMpvXSUB5no_0&imgt=icon
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /thumbnail?i=aMpvXSUB5no_0&imgt=icon HTTP/1.1
Host: xml.serve-servee.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Tue, 30 Aug 2022 22:07:38 GMT
content-length: 0
location: https://static.serve-servee.com/n337/ad/250x250_hqCCg8Cm.png
cache-control: no-store
age: 0
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJB%2BS7jflAIIuf7UYJ%2FAc12gxx%2FWSZ%2Btu2%2Bc6JMoz5BXwUGnw7BzpaSvWzzbIdo%2Fw9Azjo4APD67RfJang9i54F1r1FHJSPsEpL3QjB1BhyqBTpWzI9tSC7oE2CmeNRGxexpqkAo2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d727fc8fb4eb-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash dceff50588039a3e14ff008d222a289e
b4ef462b95f0d914e537cb23ceab77205dadda26
2bad5a74da16025d8aca0967c36e87ec039519e04b543b9000c27fe96284bcc7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "2BAD5A74DA16025D8ACA0967C36E87EC039519E04B543B9000C27FE96284BCC7"
Last-Modified: Mon, 29 Aug 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3427
Expires: Tue, 30 Aug 2022 23:04:45 GMT
Date: Tue, 30 Aug 2022 22:07:38 GMT
Connection: keep-alive
static.serve-servee.com/n337/ad/250x250_hqCCg8Cm.png
200 OK 89 kB URL HTTP/2 static.serve-servee.com/n337/ad/250x250_hqCCg8Cm.png
IP
File type PNG image data, 250 x 250, 8-bit/color RGB, non-interlaced\012- data
Hash 0994ec31361ea569c5549063145bfdd2
9b270e9f7a346a0f0f60a978e154f49740350270
e4dbff1cf1f9750d68296737897eba9bd59ebdcb292015e87c3be61b5c242422
GET /n337/ad/250x250_hqCCg8Cm.png HTTP/1.1
Host: static.serve-servee.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:38 GMT
content-type: image/png
content-length: 88957
last-modified: Thu, 08 Apr 2021 13:54:09 GMT
accept-ranges: bytes
etag: "606f0b01-15b7d"
cache-control: max-age=86400
x-hw: 1661897258.cds242.sk1.h2,1661897258.cds203.sk1.c
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9NW6%2B4UzckfLjVeM2m11OiG%2FsPJHrYGH1iYfwBZF8VdF9S09b2YTFIlPM4j%2FB8Cn51mtm9fuRsscU%2FBUaHbBNZ2kqQj2xm4VWQfMeX4C9EDi84yhNHPyyHW1LINHxXTtQTMDDLWpn%2FWUoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d728bd41b4eb-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/fonts/raleway_medium.woff
200 OK 32 kB URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/raleway_medium.woff
IP
File type Web Open Font Format, TrueType, length 31900, version 1.1\012- data
Hash 1b285c8e5b7445a8e434b2cdf036bab2
c97d4772fbb5c5637d466b5f991bc7ec28830b32
09b979826f2ac158a63ba234042c66414c21282d0bb46eadc62c64a873778825
GET /themes/flow/frontend_assets/fonts/raleway_medium.woff HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://megaup.net/themes/flow/frontend_assets/css/fonts.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4; _ga=GA1.2.156062990.1661897255; _gid=GA1.2.1978877189.1661897255; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:40 GMT
content-type: font/woff
content-length: 31900
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-7c9c"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 937bd171a489e50cdfe65e8a366f946d
3dfb370319a40e243f46b6f397b7c45a01d1a742
19732a691cddb1515bd47cd69421dbfae5c99aced289122ffb66eb5b0ac50cb3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "19732A691CDDB1515BD47CD69421DBFAE5C99ACED289122FFB66EB5B0AC50CB3"
Last-Modified: Tue, 30 Aug 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20871
Expires: Wed, 31 Aug 2022 03:55:33 GMT
Date: Tue, 30 Aug 2022 22:07:42 GMT
Connection: keep-alive
fibbermedia.com/winnotice?sid=H4sIAAAAAAAC%2F1RTz2skRRSu0VwWT%2BqKlz2MNxWZdHcmM9MuEozZSDBull0XPSnVVdXJM91dTVX39CSnoCB7khEPeqx8ySasrr%2F%2BAFfpLHgICJlbRHP2pijsWWYcE3zQvNfvexTfq%2B%2Brj3bLM9ZCyU%2BX3tTblCR8dr7lNZ9%2Fx%2FevNlcpKwfNQa%2FzXqd9tWn6L4edlvdC83UlNvVs4Pme53t%2Bc5mMivVgdgyC8vuh3wq9Vjto%2BfNtDIyDLRuwvAHZP2NPgeRo5mHjMkjUyNJvl5TdLHT%2B0rW0THihDfry8Ha2mekqQ3pRxqaBODucTkPbk%2BUH0NndCUXo%2FvlgRCPW%2BOkBouxwSgxRf3%2FCLUqgMkTyCVT9GiqpQbyG0B%2BC5AkDhMT1NWTpwXVtKr71L8rH6IjNPPobVI3YzG%2BXkaVfLyY0aN7SSVmQziwGsQMNatB6jbw8QrHNQNURRPEBSP7MZh%2BtIkv312yiQdJNdieqQXGNRA3BLUM5%2FoihjBso8wZSedoUvu93PSm41wuFmJNdFXWk5%2FNu7HPf6%2FRQijG9IYp8CJEMIcwOcrODTRrClB%2BDbI2SO1DukNuDXjAf%2Bj6UOF74nU0CnE6b3SAM5tt%2B4HmR6MZyrheLSMTRfBB7Kgy7bUR0vPD0vRe920GEhBgUP%2F7hz%2BkBNnPISreXGXIw6phNY8%2FI4njhfGrDwUoGWzD0pUOlGCrLUHGGihiqgqHqu7sysYF1BzKxZeRPczDNc243P2NPTvT4S7yLTXXajD0R9OKwPRf02mEY9WS7O9fpdaTwZU%2B1exKW%2Ftua7GPgtoFtGrFnfv0D%2Bdgp8lNE%2FAg2OYKg58DLK%2BCVA99w2M4cpP4mpihSJlWSeEvoFHlxCcVWYzc5Y89OqHQ%2Bv%2FO%2FGxXGITcO79NDhvXkzt5NXbH9m7qy7Lu1vKCUtvnYNrcKXqjHv3hDbVXayJUlO7z3qhgD4%2FL%2BW8oWqzyTlK1b9uUiSanMsjZCse9X7NsqulHajcXSZGW%2BeuO15ZU0N8pa0lkNTifXPoOgEbv0yS%2BT93Dlq1dApoYpHdLyXCGQriHyHdj8omc1g0ku%2FqOcoSrdngmii%2BbYA8mF1OCR27U%2FwpJDYdk%2FAAAA%2F%2F8BAAD%2F%2Fx3WQWBUBAAA&ap=${AUCTION_PRICE}&l=3577992&sub3=1661897255&pid=91283&sub2=icon&auid=7292541200bc7fd38fcbcfb52f0e9974&icon=https://cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg
307 Temporary Redirect 0 B URL HTTP/1.1 fibbermedia.com/winnotice?sid=H4sIAAAAAAAC%2F1RTz2skRRSu0VwWT%2BqKlz2MNxWZdHcmM9MuEozZSDBull0XPSnVVdXJM91dTVX39CSnoCB7khEPeqx8ySasrr%2F%2BAFfpLHgICJlbRHP2pijsWWYcE3zQvNfvexTfq%2B%2Brj3bLM9ZCyU%2BX3tTblCR8dr7lNZ9%2Fx%2FevNlcpKwfNQa%2FzXqd9tWn6L4edlvdC83UlNvVs4Pme53t%2Bc5mMivVgdgyC8vuh3wq9Vjto%2BfNtDIyDLRuwvAHZP2NPgeRo5mHjMkjUyNJvl5TdLHT%2B0rW0THihDfry8Ha2mekqQ3pRxqaBODucTkPbk%2BUH0NndCUXo%2FvlgRCPW%2BOkBouxwSgxRf3%2FCLUqgMkTyCVT9GiqpQbyG0B%2BC5AkDhMT1NWTpwXVtKr71L8rH6IjNPPobVI3YzG%2BXkaVfLyY0aN7SSVmQziwGsQMNatB6jbw8QrHNQNURRPEBSP7MZh%2BtIkv312yiQdJNdieqQXGNRA3BLUM5%2FoihjBso8wZSedoUvu93PSm41wuFmJNdFXWk5%2FNu7HPf6%2FRQijG9IYp8CJEMIcwOcrODTRrClB%2BDbI2SO1DukNuDXjAf%2Bj6UOF74nU0CnE6b3SAM5tt%2B4HmR6MZyrheLSMTRfBB7Kgy7bUR0vPD0vRe920GEhBgUP%2F7hz%2BkBNnPISreXGXIw6phNY8%2FI4njhfGrDwUoGWzD0pUOlGCrLUHGGihiqgqHqu7sysYF1BzKxZeRPczDNc243P2NPTvT4S7yLTXXajD0R9OKwPRf02mEY9WS7O9fpdaTwZU%2B1exKW%2Ftua7GPgtoFtGrFnfv0D%2Bdgp8lNE%2FAg2OYKg58DLK%2BCVA99w2M4cpP4mpihSJlWSeEvoFHlxCcVWYzc5Y89OqHQ%2Bv%2FO%2FGxXGITcO79NDhvXkzt5NXbH9m7qy7Lu1vKCUtvnYNrcKXqjHv3hDbVXayJUlO7z3qhgD4%2FL%2BW8oWqzyTlK1b9uUiSanMsjZCse9X7NsqulHajcXSZGW%2BeuO15ZU0N8pa0lkNTifXPoOgEbv0yS%2BT93Dlq1dApoYpHdLyXCGQriHyHdj8omc1g0ku%2FqOcoSrdngmii%2BbYA8mF1OCR27U%2FwpJDYdk%2FAAAA%2F%2F8BAAD%2F%2Fx3WQWBUBAAA&ap=${AUCTION_PRICE}&l=3577992&sub3=1661897255&pid=91283&sub2=icon&auid=7292541200bc7fd38fcbcfb52f0e9974&icon=https://cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /winnotice?sid=H4sIAAAAAAAC%2F1RTz2skRRSu0VwWT%2BqKlz2MNxWZdHcmM9MuEozZSDBull0XPSnVVdXJM91dTVX39CSnoCB7khEPeqx8ySasrr%2F%2BAFfpLHgICJlbRHP2pijsWWYcE3zQvNfvexTfq%2B%2Brj3bLM9ZCyU%2BX3tTblCR8dr7lNZ9%2Fx%2FevNlcpKwfNQa%2FzXqd9tWn6L4edlvdC83UlNvVs4Pme53t%2Bc5mMivVgdgyC8vuh3wq9Vjto%2BfNtDIyDLRuwvAHZP2NPgeRo5mHjMkjUyNJvl5TdLHT%2B0rW0THihDfry8Ha2mekqQ3pRxqaBODucTkPbk%2BUH0NndCUXo%2FvlgRCPW%2BOkBouxwSgxRf3%2FCLUqgMkTyCVT9GiqpQbyG0B%2BC5AkDhMT1NWTpwXVtKr71L8rH6IjNPPobVI3YzG%2BXkaVfLyY0aN7SSVmQziwGsQMNatB6jbw8QrHNQNURRPEBSP7MZh%2BtIkv312yiQdJNdieqQXGNRA3BLUM5%2FoihjBso8wZSedoUvu93PSm41wuFmJNdFXWk5%2FNu7HPf6%2FRQijG9IYp8CJEMIcwOcrODTRrClB%2BDbI2SO1DukNuDXjAf%2Bj6UOF74nU0CnE6b3SAM5tt%2B4HmR6MZyrheLSMTRfBB7Kgy7bUR0vPD0vRe920GEhBgUP%2F7hz%2BkBNnPISreXGXIw6phNY8%2FI4njhfGrDwUoGWzD0pUOlGCrLUHGGihiqgqHqu7sysYF1BzKxZeRPczDNc243P2NPTvT4S7yLTXXajD0R9OKwPRf02mEY9WS7O9fpdaTwZU%2B1exKW%2Ftua7GPgtoFtGrFnfv0D%2Bdgp8lNE%2FAg2OYKg58DLK%2BCVA99w2M4cpP4mpihSJlWSeEvoFHlxCcVWYzc5Y89OqHQ%2Bv%2FO%2FGxXGITcO79NDhvXkzt5NXbH9m7qy7Lu1vKCUtvnYNrcKXqjHv3hDbVXayJUlO7z3qhgD4%2FL%2BW8oWqzyTlK1b9uUiSanMsjZCse9X7NsqulHajcXSZGW%2BeuO15ZU0N8pa0lkNTifXPoOgEbv0yS%2BT93Dlq1dApoYpHdLyXCGQriHyHdj8omc1g0ku%2FqOcoSrdngmii%2BbYA8mF1OCR27U%2FwpJDYdk%2FAAAA%2F%2F8BAAD%2F%2Fx3WQWBUBAAA&ap=${AUCTION_PRICE}&l=3577992&sub3=1661897255&pid=91283&sub2=icon&auid=7292541200bc7fd38fcbcfb52f0e9974&icon=https://cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg HTTP/1.1
Host: fibbermedia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.22.0
Date: Tue, 30 Aug 2022 22:07:42 GMT
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1201ad4e3536e20fd00ba81f0b50d13b
Strict-Transport-Security: max-age=0; includeSubdomains
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 44f5b82c370258db6b5e292381511843
d0753817b1ca79ca8fa4d15b58acabb7bf2bbfc1
a3b28fba3beddb8b9041f48c3fa062913ea5bb82fb3a6c7a3b76ea874d8f0112
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A3B28FBA3BEDDB8B9041F48C3FA062913EA5BB82FB3A6C7A3B76EA874D8F0112"
Last-Modified: Tue, 30 Aug 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9364
Expires: Wed, 31 Aug 2022 00:43:46 GMT
Date: Tue, 30 Aug 2022 22:07:42 GMT
Connection: keep-alive
cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg
200 OK 33 kB URL HTTP/2 cdn.cloudimagesb.com/cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg
IP
ASN #39572 DataWeb Global Group B.V.
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Windows), datetime=2020:05:18 19:19:17], baseline, precision 8, 200x200, components 3\012- data
Hash 70cf8250da1a25a7b445231428af7828
a849d338423d2919949340838c768bba90b9081c
b7060bc46dc459a00d4124523a26f0cbf31fba31d41fccae9f82bedaf22c1186
GET /cti/34/74/d7/3474d78aff0bf2df5207c5e1bcb89147/1591703087.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:42 GMT
content-type: image/jpeg
content-length: 33103
server: nginx/1.17.6
last-modified: Tue, 09 Jun 2020 11:44:50 GMT
etag: "5edf7632-814f"
expires: Thu, 01 Sep 2022 22:07:42 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
freychang.fun/asd100.bin
200 OK 0 B IP
Analyzer Verdict Alert quad9 Sinkholed
GET /asd100.bin HTTP/1.1
Host: freychang.fun
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 2049
last-modified: Tue, 30 Aug 2022 21:33:26 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nFQfOuX7yj7DC6cXEIIKfGhxNgBTHgRUS8%2Bx7fgBAVhmJ%2B4YnN%2FzPAbhD2Njq1ECwjWjBoeDSMsgnPXSaIaAvKyyK%2BMfH5EZr7Rrl%2B%2Fe%2Buc3cuOBAnD%2FyxT1GlWvvcSs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7430d7150d84b4fa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.tmpl.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.tmpl.min.js
IP
GET /themes/flow/js/jquery.tmpl.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3cb"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/styles/file-upload.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/styles/file-upload.css
IP
GET /themes/flow/styles/file-upload.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-21ec"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.dataTables.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.dataTables.min.js
IP
GET /themes/flow/js/jquery.dataTables.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-10fe4"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.iframe-transport.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.iframe-transport.js
IP
GET /themes/flow/js/jquery.iframe-transport.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-2427"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.fileupload-process.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.fileupload-process.js
IP
GET /themes/flow/js/jquery.fileupload-process.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-14b6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/isotope/isotope-style.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/isotope/isotope-style.css
IP
GET /themes/flow/frontend_assets/css/isotope/isotope-style.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-af3"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.fileupload-validate.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.fileupload-validate.js
IP
GET /themes/flow/js/jquery.fileupload-validate.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-fea"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/animation/jquery.appear.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/animation/jquery.appear.js
IP
GET /themes/flow/frontend_assets/js/animation/jquery.appear.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-5c6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.plugins.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.plugins.min.js
IP
GET /themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.plugins.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-14cc1"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
ad.a-ads.com/1811811?size=300x250
200 OK 0 B URL HTTP/2 ad.a-ads.com/1811811?size=300x250
IP
ASN #24940 Hetzner Online GmbH
GET /1811811?size=300x250 HTTP/1.1
Host: ad.a-ads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: text/html;charset=utf-8
vary: Accept-Encoding, Accept-Encoding
status: 200 OK
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-powered-by: Phusion Passenger(R)
x-original-referer: https://megaup.net/
x-robots-tag: noindex, nofollow, nosnippet, noarchive
content-encoding: gzip
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/global.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/global.js
IP
GET /themes/flow/js/global.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-d59"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
freychang.fun/
200 OK 0 B IP
Analyzer Verdict Alert quad9 Sinkholed
GET / HTTP/1.1
Host: freychang.fun
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: text/plain
set-cookie: csu=252253002071440@1@1661897255; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k2B3IhfBEdHyGD7f5hSbAKzBZKg3KVunngoZo9olh8QSWM%2BU%2FwvKshH67Z52SjRJQbfRU27pAKo%2BcbrhhilLD43hBgqmp1e0NyUxdhnmeT4jkazHZGDNuuv5xpLpUiXZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7430d7153dd6b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css
IP
GET /themes/flow/frontend_assets/socialsider-v1.0/_css/socialsider-v1.0.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-8d4b"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery-1.11.0.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery-1.11.0.min.js
IP
GET /themes/flow/js/jquery-1.11.0.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1787d"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/images/loading_small.gif
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/images/loading_small.gif
IP
GET /themes/flow/images/loading_small.gif HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: image/gif
content-length: 184355
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: "60758f34-2d023"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
accept-ranges: bytes
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/bootstrap/bootstrap.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/bootstrap/bootstrap.min.js
IP
GET /themes/flow/frontend_assets/js/bootstrap/bootstrap.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-71b6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/clipboardjs/clipboard.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/clipboardjs/clipboard.min.js
IP
GET /themes/flow/js/clipboardjs/clipboard.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-2296"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/canvas-to-blob.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/canvas-to-blob.min.js
IP
GET /themes/flow/js/canvas-to-blob.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-408"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/sw.js?c2dPT1koRXd8a0VUfG11UUVjbT9HA3Z6aBYDYnxpQ15ie2FEAWJ3P0VSYndoEV4ueG4WVnosP1FLbS49RFN%2BKWBHSnh2aUVKe3s9R0p3f2gSSnd9P0MELS44EV4te3tfRTw4e19FPDs8HwsmJzgdAyMqKl0PLiYrUUttfmldUm1jPxILPCp1FQYjPDxfAS4jKhY6
200 OK 0 B URL HTTP/2 megaup.net/sw.js?c2dPT1koRXd8a0VUfG11UUVjbT9HA3Z6aBYDYnxpQ15ie2FEAWJ3P0VSYndoEV4ueG4WVnosP1FLbS49RFN%2BKWBHSnh2aUVKe3s9R0p3f2gSSnd9P0MELS44EV4te3tfRTw4e19FPDs8HwsmJzgdAyMqKl0PLiYrUUttfmldUm1jPxILPCp1FQYjPDxfAS4jKhY6
IP
GET /sw.js?c2dPT1koRXd8a0VUfG11UUVjbT9HA3Z6aBYDYnxpQ15ie2FEAWJ3P0VSYndoEV4ueG4WVnosP1FLbS49RFN%2BKWBHSnh2aUVKe3s9R0p3f2gSSnd9P0MELS44EV4te3tfRTw4e19FPDs8HwsmJzgdAyMqKl0PLiYrUUttfmldUm1jPxILPCp1FQYjPDxfAS4jKhY6 HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4; _ga=GA1.2.156062990.1661897255; _gid=GA1.2.1978877189.1661897255; _gat_gtag_UA_108868042_1=1
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:52 GMT
vary: Accept-Encoding
etag: W/"60758f38-12fe6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/nav/jquery.scrollTo.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/nav/jquery.scrollTo.js
IP
GET /themes/flow/frontend_assets/js/nav/jquery.scrollTo.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-981"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/isotope/jquery.isotope.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/isotope/jquery.isotope.min.js
IP
GET /themes/flow/frontend_assets/js/isotope/jquery.isotope.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3ead"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/fonts/font-awesome/css/font-awesome.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/fonts/font-awesome/css/font-awesome.css
IP
GET /themes/flow/frontend_assets/fonts/font-awesome/css/font-awesome.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-59d6"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
freychang.fun/asd100.bin
200 OK 0 B IP
Analyzer Verdict Alert quad9 Sinkholed
GET /asd100.bin HTTP/1.1
Host: freychang.fun
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 2049
last-modified: Tue, 30 Aug 2022 21:33:26 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NVV2eys3uB5zSgOW5XWiHkGxsH95N2KFvrdNgSxapGJH%2Ffw4KuES7HU8l5oOWs3TF9%2FAgq0%2BPjeX66UWpBtPMxrX3YiqNFJUOdJROcwhZaxqoFugKP12wW1ov1bzxhnR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7430d7150d83b4fa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
societingna.info/aGg5Nk4TSkpBER0aVRR0SgBNQj4bUhYZIw0PWEM%2BRgZcQmEbHxdcPUpEG0UjDkoDB2JKHFhREQEMGwxsUFsLAH1bShUUPR0KZl8qWkoDFChcDAADfw0MFAV%2BWFEUAnZfDhQOKF5dFA5%2FClFYAXkNWQxVKEoV
200 OK 0 B URL HTTP/2 societingna.info/aGg5Nk4TSkpBER0aVRR0SgBNQj4bUhYZIw0PWEM%2BRgZcQmEbHxdcPUpEG0UjDkoDB2JKHFhREQEMGwxsUFsLAH1bShUUPR0KZl8qWkoDFChcDAADfw0MFAV%2BWFEUAnZfDhQOKF5dFA5%2FClFYAXkNWQxVKEoV
IP
GET /aGg5Nk4TSkpBER0aVRR0SgBNQj4bUhYZIw0PWEM%2BRgZcQmEbHxdcPUpEG0UjDkoDB2JKHFhREQEMGwxsUFsLAH1bShUUPR0KZl8qWkoDFChcDAADfw0MFAV%2BWFEUAnZfDhQOKF5dFA5%2FClFYAXkNWQxVKEoV HTTP/1.1
Host: societingna.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
set-cookie: a044f4de4c00c10a5735d6b940f05d82=1; Max-Age=604800
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET, POST
access-control-allow-headers: X-Requested-With,content-type
etag: W/"e0fd-Y8DoK3k6q3+Dzvh4bq8qV+udOcI"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
a.adtng.com/get/10012456?time=1614803572912&apb=ooddNHdLHTPHNVS4ASOpprpmtrdTbbZNLTK6V1Esqp6pXVTTOpmdQ6ap0rpXSunqoppdRNTRPTO6iamieml0rpnSuldK6V0zpXSumc6yubTireebOWbii7POe62i3ivazPazO2p0rv9.czijBuZznSuldK6V0rpXSuldK4Ps
200 OK 0 B URL HTTP/2 a.adtng.com/get/10012456?time=1614803572912&apb=ooddNHdLHTPHNVS4ASOpprpmtrdTbbZNLTK6V1Esqp6pXVTTOpmdQ6ap0rpXSunqoppdRNTRPTO6iamieml0rpnSuldK6V0zpXSumc6yubTireebOWbii7POe62i3ivazPazO2p0rv9.czijBuZznSuldK6V0rpXSuldK4Ps
IP
GET /get/10012456?time=1614803572912&apb=ooddNHdLHTPHNVS4ASOpprpmtrdTbbZNLTK6V1Esqp6pXVTTOpmdQ6ap0rpXSunqoppdRNTRPTO6iamieml0rpnSuldK6V0zpXSumc6yubTireebOWbii7POe62i3ivazPazO2p0rv9.czijBuZznSuldK6V0rpXSuldK4Ps HTTP/1.1
Host: a.adtng.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: openresty
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: text/html
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-encoding: gzip
set-cookie: adtool_guid=Ch5KFmMOiid6ihe8sU26Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/; Secure; HTTPOnly; SameSite=None;
RNLBSERVERID=ded7040; path=/; HttpOnly; Secure; SameSite=None
x-request-id: 630E8A27-42FE72AB01BB6A93-10A9D1F6
X-Firefox-Spdy: h2
stellihandles.hair/SmZzWVkRREtqa3xVQHt1aERfez9%2BAkpsaC8CXmppel9ebWF9AF5hP3xTXmFoKF8Sbm4vV0Y6P2hKUTg9fVJCP2B%2BS0RgaXxLR209fktLaWgrS0trP3oFETg4KF8RbXtmRAAue2ZEAC08JgoaMTgkAh88KmQOEjAraEpRaGlkU1F1PysKADx1LAcfKjxmABI1Ki87
200 OK 0 B URL HTTP/2 stellihandles.hair/SmZzWVkRREtqa3xVQHt1aERfez9%2BAkpsaC8CXmppel9ebWF9AF5hP3xTXmFoKF8Sbm4vV0Y6P2hKUTg9fVJCP2B%2BS0RgaXxLR209fktLaWgrS0trP3oFETg4KF8RbXtmRAAue2ZEAC08JgoaMTgkAh88KmQOEjAraEpRaGlkU1F1PysKADx1LAcfKjxmABI1Ki87
IP
GET /SmZzWVkRREtqa3xVQHt1aERfez9%2BAkpsaC8CXmppel9ebWF9AF5hP3xTXmFoKF8Sbm4vV0Y6P2hKUTg9fVJCP2B%2BS0RgaXxLR209fktLaWgrS0trP3oFETg4KF8RbXtmRAAue2ZEAC08JgoaMTgkAh88KmQOEjAraEpRaGlkU1F1PysKADx1LAcfKjxmABI1Ki87 HTTP/1.1
Host: stellihandles.hair
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://megaup.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
set-cookie: 12190586dacd742565ecc8f993809ee1=1; Max-Age=604800
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET, POST
access-control-allow-headers: X-Requested-With,content-type
cache-control: public, max-age=86400
etag: W/"8449-s+w7bsdseUHeC4zVR/WJKaWWRuA"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/responsive.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/responsive.css
IP
GET /themes/flow/frontend_assets/css/responsive.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-e56"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/load-image.min.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/load-image.min.js
IP
GET /themes/flow/js/load-image.min.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-9f2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.fileupload.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.fileupload.js
IP
GET /themes/flow/js/jquery.fileupload.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-dbd4"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/zeroClipboard/ZeroClipboard.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/zeroClipboard/ZeroClipboard.js
IP
GET /themes/flow/js/zeroClipboard/ZeroClipboard.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3bd2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.revolution.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.revolution.js
IP
GET /themes/flow/frontend_assets/rs-plugin/js/jquery.themepunch.revolution.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-303b2"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/sticky/jquery.sticky.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/sticky/jquery.sticky.js
IP
GET /themes/flow/frontend_assets/js/sticky/jquery.sticky.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1099"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
freychang.fun/asd100.bin
200 OK 0 B IP
Analyzer Verdict Alert quad9 Sinkholed
GET /asd100.bin HTTP/1.1
Host: freychang.fun
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Origin: https://megaup.net
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://megaup.net
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 2049
last-modified: Tue, 30 Aug 2022 21:33:26 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kp%2FrqTsnaAMot8oPMLqfwYQD7FLOa2uo1J1fEqHuPXADcHNVrayQb7PSRKBeQEjVoBg4qBIaDdrJCTY1QCJMFNUHdvUA7njmHhIL9K8giYzX5XISik91g5aDB3PVfvIJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7430d7150d8eb4fa-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/custom.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/custom.css
IP
GET /themes/flow/frontend_assets/css/custom.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-3577"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.fileupload-resize.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.fileupload-resize.js
IP
GET /themes/flow/js/jquery.fileupload-resize.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1f7f"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/images/icons/favicon/favicon.ico
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/images/icons/favicon/favicon.ico
IP
GET /themes/flow/frontend_assets/images/icons/favicon/favicon.ico HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:35 GMT
content-type: image/x-icon
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-47e"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
accounts.google.com/v3/signin/identifier?dsh=S-1643821255%3A1661897255270092&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmV30c5b6DLOG9HVdcxVj1rG9wN5q4IJ3cd-r7-oKm2V5jIRJAFpSioGYjo1vYUdU3SsWYnsnA
403 Forbidden 0 B URL HTTP/2 accounts.google.com/v3/signin/identifier?dsh=S-1643821255%3A1661897255270092&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmV30c5b6DLOG9HVdcxVj1rG9wN5q4IJ3cd-r7-oKm2V5jIRJAFpSioGYjo1vYUdU3SsWYnsnA
IP
GET /v3/signin/identifier?dsh=S-1643821255%3A1661897255270092&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AQN2RmV30c5b6DLOG9HVdcxVj1rG9wN5q4IJ3cd-r7-oKm2V5jIRJAFpSioGYjo1vYUdU3SsWYnsnA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 30 Aug 2022 22:07:35 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-8RIVQFHpc2GBSC4vQJ-3yA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
set-cookie: NID=511=SRQguwOsDqMSLyMOJxTqOWl4o4-4gWkLBldhiYpM-cVNH3rl3KI5uwwCa2BYjbQT9I4RoNvggi5UEx0AKJ0qaZu6_8UflMIn-Mba_QirItgWvFLOgg6dxDx5rHzwjN9IChzSatCVqq7ECZ3mEg9UH_MBv8p1kguTXl1EIcEQiJk; expires=Wed, 01-Mar-2023 22:07:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
megaup.net/themes/flow/styles/font-icons/entypo/css/entypo.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/styles/font-icons/entypo/css/entypo.css
IP
GET /themes/flow/styles/font-icons/entypo/css/entypo.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-45f5"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery-ui.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery-ui.js
IP
GET /themes/flow/js/jquery-ui.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-6a684"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/js/jquery.fileupload-ui.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/js/jquery.fileupload-ui.js
IP
GET /themes/flow/js/jquery.fileupload-ui.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-61ef"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
200 OK 0 B URL HTTP/2 www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
IP
GET /login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-encoding: br
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
vary: Sec-Fetch-Site, Sec-Fetch-Mode, Accept-Encoding
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: FT/tNtVYLaEipHcQuuTiMxnwVmz0D79Hw8yO70Hpshu+bKSu67+Tr+hh9U6dEqY1FfCulZVQ/j4MMexI4ChtAw==
date: Tue, 30 Aug 2022 22:07:35 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/retina/retina.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/retina/retina.js
IP
GET /themes/flow/frontend_assets/js/retina/retina.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-52e"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/js/SmoothScroll/SmoothScroll.js
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/js/SmoothScroll/SmoothScroll.js
IP
GET /themes/flow/frontend_assets/js/SmoothScroll/SmoothScroll.js HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/20Py/TRANSFORMERS.REVENGE.OF.THE.FALLEN.part2.rar
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: application/javascript
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-1cdf"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
megaup.net/themes/flow/frontend_assets/css/fonts.css
200 OK 0 B URL HTTP/2 megaup.net/themes/flow/frontend_assets/css/fonts.css
IP
GET /themes/flow/frontend_assets/css/fonts.css HTTP/1.1
Host: megaup.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://megaup.net/themes/flow/frontend_assets/css/All-stylesheets.css
Connection: keep-alive
Cookie: filehosting=0vfingiq4nnf1lp96n7v2jeck4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 30 Aug 2022 22:07:34 GMT
content-type: text/css
last-modified: Tue, 13 Apr 2021 12:31:48 GMT
vary: Accept-Encoding
etag: W/"60758f34-690"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
x-download-options: noopen
content-encoding: br
X-Firefox-Spdy: h2
91.209.70.182
143.204.42.115
104.21.45.207
95.211.229.245
23.36.76.226
213.239.209.209
31.13.72.36
93.184.220.29