Report - www.18dd.net/new/5.exe

Report Overview

Submitted URL
www.18dd.net/new/5.exe
IP
38.173.90.56
ASN
#398993 PEG-TY
Submitted
2024-04-19 09:40:27
Access
public
Website Title
请牢记域名永不失联
Final URL
www.18dd.net/new/5.exe
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.18dd.net	unknown	2021-10-15	2012-09-28	2024-03-31	1.1 kB	2.4 kB	38.173.90.56
0b30a3.com	unknown	2022-12-30	2023-08-02	2024-04-12	503 B	1.9 kB	107.148.62.239
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-19	3.4 kB	37 kB	14.215.182.140
registry.npmmirror.com	743131	2021-07-22	2022-06-20	2024-04-18	4.4 kB	995 kB	47.246.2.229
ndj189.wwpv0nkp90yqz5034j2s.top	unknown	unknown	No data	No data	493 B	43 kB	107.148.199.130
y4video.bytedance.sbs	unknown	unknown	No data	No data	7.7 kB	771 kB	104.19.88.56

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-19 09:40:02	high	Client IP	38.173.90.56	ET MALWARE Single char EXE direct download likely trojan (multiple families)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-19	medium	18dd.net	Sinkholed
2024-04-19	medium	18dd.net	Sinkholed
2024-04-19	medium	18dd.net	Sinkholed
2024-04-19	medium	wwpv0nkp90yqz5034j2s.top	Sinkholed

ThreatFox

No alerts detected

JavaScript (13)

	URL	Size	First Seen	Last Seen
	ndj189.wwpv0nkp90yqz5034j2s.top/home.html	67 B	2024-03-17	2024-04-30
Pretty URL ndj189.wwpv0nkp90yqz5034j2s.top/home.html IP 107.148.199.130 ASN #54600 PEG-SV Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-17 01:35:49 Last Seen2024-04-30 07:01:57 Times Seen153 Hash b865c38761001fe39a4b9b5667d26065 6602e28466475d3dd4f2321a5adc5b33b4bce72d 9d4df4ae47a756dc8970c02763601a1200d846f7d870c13463f5dd08e6c8b985 Loading...

	registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/main.js	14 kB	2024-03-29	2024-04-30
Pretty URL registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/main.js IP 47.246.2.229 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 04:28:00 Last Seen2024-04-30 07:01:57 Times Seen88 Hash dd58f6728ed059921c19dacabb9dfa9b 632b3575fdcb11f1ad899f73f482eafe17b3c1ba db795e95c1f8005e0ddb09270fac54d28739def33e123a3988fa543973e4e5b5 Loading...

	ndj189.wwpv0nkp90yqz5034j2s.top/home.html	102 kB	2024-04-19	2024-04-19
Pretty URL ndj189.wwpv0nkp90yqz5034j2s.top/home.html IP 107.148.199.130 ASN #54600 PEG-SV Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:38 Times Seen2 Hash 40e10ab4038f5acb82e6e6772c47dd8d e0559cffc6d92e8e1af1a7ecf7ca7f136034a17a b79172cfd92db14602fc0ce4825d693c2246bd11db769f5a9a5d95da26817e33 Loading...

	registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/index.js	3.3 kB	2024-03-17	2024-04-30
Pretty URL registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/index.js IP 47.246.2.229 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-17 01:35:49 Last Seen2024-04-30 07:01:57 Times Seen308 Hash d88b09cfdfb50f1d610f99e29f29b4f5 af7ba9c6685658946a056dfd7c71e31c10bf1d8d f3fa47d90201ed6b5db62ffe7315616b16032476c8cedb863f5c065a5275bac1 Loading...

	unknown	37 B	2023-04-11	2024-05-02
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49:14 Last Seen2024-05-02 12:16:18 Times Seen22132 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	unknown	333 B	2024-04-19	2024-04-19
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:34 Times Seen1 Hash 5cc45796a5cec8a67e0a4eee24b03bed 7145fc1256a38bd4bc9ec6bedc1134d4bd646ae8 5494c64ef6a2fe7c9659075a65d5807789d53d84be94547958133035c0e1564b Loading...

	www.18dd.net/tj.js	258 B	2023-08-02	2024-04-19
Pretty URL www.18dd.net/tj.js IP 38.173.90.56 ASN #398993 PEG-TY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-02 04:52:34 Last Seen2024-04-19 11:40:41 Times Seen1021 Hash 8b64d7f1101a038da057d91d76e7c399 cb0bf5f00b9cab9e22c40e72e205e95d8ebae4f5 05c8880951777257ff152b12d45a4e5ee89c2ecb4612cd8d4dfea5ce14d3a936 Loading...

	unknown	1.2 kB	2024-03-26	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-26 03:11:34 Last Seen2024-04-30 07:01:57 Times Seen60 Hash ee646e35ebbc9bd466dc9062a74fd58b 45a8c52c93a03b6168c5ee5b09b094abb806bf11 758ec5664b5ca249f77ec460c4d766c407c398349107dee67a324e40170a53f9 Loading...

	unknown	335 B	2024-04-19	2024-04-19
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:34 Times Seen1 Hash d156f05f2229f25bad3c5ecc9c8babf9 736ca6fd89e12cb28a0d4750ed65dbdafc863cb2 d92699fc3a0228ddafebd28f6fcec317a11dcb7166955ae494f6494685871440 Loading...

	unknown	233 B	2024-03-17	2024-04-19
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-17 19:34:49 Last Seen2024-04-19 11:40:38 Times Seen34 Hash c4ab0900770da725449f73c21d5fb7b7 3f8f7fb083fb6e45f2d16caa43fb6f013a188215 25e0f4343c51ade7ca5e56c3dedca7a526bd3d3e3ca57f9b203d82dc2c98a3ca Loading...

	hm.baidu.com/hm.js?ad094474b0add3e56ee49f061c87f9d0	30 kB	2024-04-19	2024-04-19
Pretty URL hm.baidu.com/hm.js?ad094474b0add3e56ee49f061c87f9d0 IP 14.215.182.140 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:34 Times Seen2 Hash a8037d0f92350bfddc3db19855bc78f2 404cdd16d2b8eea6b2cd805e63526f5bc61ce033 67b7cec69b26dd903515bc95e32d180ea34ef6df0b9d0b11647728355c4e0572 Loading...

	hm.baidu.com/hm.js?bc574eeaf3496a6ecd996d09b14f4533	30 kB	2024-04-19	2024-04-19
Pretty URL hm.baidu.com/hm.js?bc574eeaf3496a6ecd996d09b14f4533 IP 14.215.182.140 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:34 Times Seen2 Hash a71f21d4327448e41d37d164cdd24d24 f74c4228c6a3730840713bbd21f4c7e3b4250a6d 77b31a54e5f20845a8358947d798fb0bd1e4bcd75e0580be05dc52d8a319f7e9 Loading...

		Size	First Seen	Last Seen
	#1 Write - 75a6d666f1bfcf7ff304b685fd15a4c0	3.8 kB	2024-04-19	2024-04-19
Pretty Observations First Seen2024-04-19 11:40:34 Last Seen2024-04-19 11:40:38 Times Seen2 Hash 75a6d666f1bfcf7ff304b685fd15a4c0 3f7ae297f1b24493f63fabacfdfd852d189ccae1 e57acbc63d14281d9a3b526506bc597b395d19a7a543e4ff6e7b74db480f5c9b Loading...

HTTP Transactions (36)

URL IP Response Size

www.18dd.net/new/5.exe

38.173.90.56

200 OK

369 B

URL User Request GET HTTP/1.1
www.18dd.net/new/5.exe
IP
38.173.90.56:80
ASN
#398993 PEG-TY

File type
HTML document, ISO-8859 text, with CRLF line terminators
Size
369 B (369 bytes)
Hash
037349014eca3b55d0ec7945015e3291
426cc6472132f8cac0497988af6e728e93bbb31a
69c255e8fc6e97f7f2a0ecae27a821cf8e348a4afbc4f42a5f7227056ed3cbd4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	high	ET MALWARE Single char EXE direct download likely trojan (multiple families)

HTTP Headers

GET /new/5.exe HTTP/1.1
Host: www.18dd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 19 Apr 2024 09:40:02 GMT
Content-Type: text/html
Content-Length: 369
Connection: keep-alive

www.18dd.net/tj.js

38.173.90.56

200 OK

258 B

URL GET HTTP/1.1
www.18dd.net/tj.js
IP
38.173.90.56:80
ASN
#398993 PEG-TY

Requested by
http://www.18dd.net/new/5.exe

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
258 B (258 bytes)
Hash
8b64d7f1101a038da057d91d76e7c399
cb0bf5f00b9cab9e22c40e72e205e95d8ebae4f5
05c8880951777257ff152b12d45a4e5ee89c2ecb4612cd8d4dfea5ce14d3a936

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /tj.js HTTP/1.1
Host: www.18dd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.18dd.net/new/5.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 19 Apr 2024 09:40:02 GMT
Content-Type: application/x-javascript
Content-Length: 258
Connection: keep-alive

www.18dd.net/favicon.ico

38.173.90.56

200 OK

1.2 kB

URL GET HTTP/1.1
www.18dd.net/favicon.ico
IP
38.173.90.56:80
ASN
#398993 PEG-TY

Requested by
http://www.18dd.net/new/5.exe

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
7ef1f0a0093460fe46bb691578c07c95
2da3ffbbf4737ce4dae9488359de34034d1ebfbd
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.18dd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.18dd.net/new/5.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 19 Apr 2024 09:40:03 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT
Connection: keep-alive
ETag: "4e0d81df-47e"
Expires: Wed, 24 Apr 2024 09:40:03 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes

0b30a3.com/index.php

107.148.62.239

200 OK

1.7 kB

URL GET HTTP/1.1
0b30a3.com/index.php
IP
107.148.62.239:443
ASN
#398478 PEG-HK

Requested by
http://www.18dd.net/new/5.exe
Certificate
IssuerLet's Encrypt
Subject0a12a2.com
FingerprintEC:C8:FA:DE:DB:6A:D2:5C:F9:BA:69:57:34:DF:58:07:25:A4:2A:D9
ValidityThu, 11 Apr 2024 15:21:02 GMT - Wed, 10 Jul 2024 15:21:01 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (1817)
Size
1.7 kB (1745 bytes)
Hash
5a399c7519392183bded42dfc389b4f6
70ff7592b2d541b7298c965ba41f0f7b59f7d1b4
a208f68dc83652ff93f317ee3e60b2117a47454f42be1e9a640e21de35f2e8e5

HTTP Headers

GET /index.php HTTP/1.1
Host: 0b30a3.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.18dd.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Apr 2024 09:40:03 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

hm.baidu.com/hm.js?bc574eeaf3496a6ecd996d09b14f4533

14.215.182.140

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?bc574eeaf3496a6ecd996d09b14f4533
IP
14.215.182.140:443
ASN
#4134 Chinanet

Requested by
http://www.18dd.net/new/5.exe
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (628)
Size
11 kB (11266 bytes)
Hash
a71f21d4327448e41d37d164cdd24d24
f74c4228c6a3730840713bbd21f4c7e3b4250a6d
77b31a54e5f20845a8358947d798fb0bd1e4bcd75e0580be05dc52d8a319f7e9

HTTP Headers

GET /hm.js?bc574eeaf3496a6ecd996d09b14f4533 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.18dd.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11266
Content-Type: application/javascript
Date: Fri, 19 Apr 2024 09:40:04 GMT
Etag: c38ec91389969c28234ecb654c771f78
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=78D5A53BA9664915; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2098649892&si=bc574eeaf3496a6ecd996d09b14f4533&v=1.3.0&lv=1&sn=41495&r=0&ww=1280&u=http%3A%2F%2Fwww.18dd.net%2Fnew%2F5.exe&tt=%E8%AF%B7%E7%89%A2%E8%AE%B0%E5%9F%9F%E5%90%8D%E6%B0%B8%E4%B8%8D%E5%A4%B1%E8%81%94

14.215.182.140

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2098649892&si=bc574eeaf3496a6ecd996d09b14f4533&v=1.3.0&lv=1&sn=41495&r=0&ww=1280&u=http%3A%2F%2Fwww.18dd.net%2Fnew%2F5.exe&tt=%E8%AF%B7%E7%89%A2%E8%AE%B0%E5%9F%9F%E5%90%8D%E6%B0%B8%E4%B8%8D%E5%A4%B1%E8%81%94
IP
14.215.182.140:443
ASN
#4134 Chinanet

Requested by
http://www.18dd.net/new/5.exe
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2098649892&si=bc574eeaf3496a6ecd996d09b14f4533&v=1.3.0&lv=1&sn=41495&r=0&ww=1280&u=http%3A%2F%2Fwww.18dd.net%2Fnew%2F5.exe&tt=%E8%AF%B7%E7%89%A2%E8%AE%B0%E5%9F%9F%E5%90%8D%E6%B0%B8%E4%B8%8D%E5%A4%B1%E8%81%94 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.18dd.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 19 Apr 2024 09:40:05 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=6D2D48601B11BDEC; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

hm.baidu.com/hm.js?ebd9eb6eb74c869329e88d370899aa4e

14.215.183.79

11 kB

URL
hm.baidu.com/hm.js?ebd9eb6eb74c869329e88d370899aa4e
IP
14.215.183.79:0
ASN
#4134 Chinanet

Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (623)
Size
11 kB (11261 bytes)
Hash
9a2f0a7566cc1271f1b243a7be5c47ef
28c323a961a74d5fcc3a5449dea0701e2aeb077a
1c781677715e9468a3ef6b87b456e5a8580c5f16c013522defe7514ff8f5deb8

HTTP Headers

GET /hm.js?ebd9eb6eb74c869329e88d370899aa4e HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://0b30a3.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11261
Content-Type: application/javascript
Date: Fri, 19 Apr 2024 09:40:05 GMT
Etag: a643c1f9e5c2f4ef444173dec9ab1e15
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=6FB71FA32F94BC05; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=905400212&si=ebd9eb6eb74c869329e88d370899aa4e&su=http%3A%2F%2Fwww.18dd.net%2F&v=1.3.0&lv=1&sn=41496&r=0&ww=1280&u=https%3A%2F%2F0b30a3.com%2Findex.php&tt=%E7%B2%BE%E5%BD%A9%E5%86%85%E5%AE%B9%E5%8D%B3%E5%B0%86%E5%91%88%E7%8E%B0

14.215.182.140

43 B

URL
hm.baidu.com/hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=905400212&si=ebd9eb6eb74c869329e88d370899aa4e&su=http%3A%2F%2Fwww.18dd.net%2F&v=1.3.0&lv=1&sn=41496&r=0&ww=1280&u=https%3A%2F%2F0b30a3.com%2Findex.php&tt=%E7%B2%BE%E5%BD%A9%E5%86%85%E5%AE%B9%E5%8D%B3%E5%B0%86%E5%91%88%E7%8E%B0
IP
14.215.182.140:0
ASN
#4134 Chinanet

Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=905400212&si=ebd9eb6eb74c869329e88d370899aa4e&su=http%3A%2F%2Fwww.18dd.net%2F&v=1.3.0&lv=1&sn=41496&r=0&ww=1280&u=https%3A%2F%2F0b30a3.com%2Findex.php&tt=%E7%B2%BE%E5%BD%A9%E5%86%85%E5%AE%B9%E5%8D%B3%E5%B0%86%E5%91%88%E7%8E%B0 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://0b30a3.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 19 Apr 2024 09:40:05 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=72B7A10EE3F08FEE; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/main.js

47.246.2.229

200 OK

4.8 kB

URL GET HTTP/2
registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/main.js
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (7234)
Size
4.8 kB (4761 bytes)
Hash
dd58f6728ed059921c19dacabb9dfa9b
632b3575fdcb11f1ad899f73f482eafe17b3c1ba
db795e95c1f8005e0ddb09270fac54d28739def33e123a3988fa543973e4e5b5

HTTP Headers

GET /htmxskyjs/1.0.52/files/editors/web2/js/main.js HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: application/javascript; charset=utf-8
content-length: 4761
strict-transport-security: max-age=5184000
date: Wed, 17 Apr 2024 20:54:23 GMT
vary: Origin, Accept, Accept-Encoding
request-id: ab4a1060-fcfc-11ee-865c-710f04ecfd97
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 46.846
via: ru3.l1, cache9.ru3, l2us1.l2, cache21.l2us1, npmmirror-x86-2022012802003, cache21.l2us1[355,355,200-0,M], cache26.l2us1[357,0], cache9.ru3[0,0,200-0,H], cache4.ru3[1,0]
content-encoding: gzip
ali-swift-global-savetime: 1713387263
age: 132344
x-cache: HIT TCP_MEM_HIT dirn:9:294758157
x-swift-savetime: Wed, 17 Apr 2024 20:54:23 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196076695493e
X-Firefox-Spdy: h2

registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/style.css

47.246.2.229

200 OK

5.6 kB

URL GET HTTP/2
registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/style.css
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (23054)
Size
5.6 kB (5631 bytes)
Hash
581e19ae5009774a82d34da33582a621
e64d6a4527851b343e44ca5db4192f3963decea9
c1f9f3cfe223533082faf3184767922d1d40a1f9799d7e76b1375c5f13286dec

HTTP Headers

GET /htmxskyjs/1.0.52/files/editors/web2/css/style.css HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: text/css; charset=utf-8
content-length: 5631
strict-transport-security: max-age=5184000
date: Fri, 19 Apr 2024 04:43:42 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 65b98fb0-fe07-11ee-865c-710f04ecfd97
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 67.486
via: ru3.l1, cache7.ru3, l2de2.l2, cache8.l2de2, npmmirror-x86-2022012802003, cache8.l2de2[866,866,200-0,M], cache21.l2de2[868,0], cache7.ru3[0,0,200-0,H], cache4.ru3[2,0]
content-encoding: gzip
ali-swift-global-savetime: 1713501822
age: 17785
x-cache: HIT TCP_MEM_HIT dirn:10:327353812
x-swift-savetime: Fri, 19 Apr 2024 04:43:42 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196076725506e
X-Firefox-Spdy: h2

registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/icon.css

47.246.2.229

200 OK

7.9 kB

URL GET HTTP/2
registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/icon.css
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (14170)
Size
7.9 kB (7924 bytes)
Hash
07054d1ac5f3df37363a4628b1469f30
42aad1bd6c35cc21440daf82afc04eecd8ce6213
af85fcdc0ffe18f2b68d0f0188d8122ee6e2cb8e81fa4247d7f9f4bdf9ca6e29

HTTP Headers

GET /htmxskyjs/1.0.52/files/editors/web2/css/icon.css HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/style.css
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: text/css; charset=utf-8
content-length: 7924
strict-transport-security: max-age=5184000
date: Wed, 17 Apr 2024 20:54:24 GMT
vary: Origin, Accept, Accept-Encoding
request-id: abd2a150-fcfc-11ee-ae38-f7421f58ed4d
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 38.836
via: ru3.l1, cache6.ru3, l2us1.l2, cache29.l2us1, registry.npmmirror.com-07, cache29.l2us1[332,332,200-0,M], cache37.l2us1[334,0], cache6.ru3[0,0,200-0,H], cache4.ru3[1,0]
content-encoding: gzip
ali-swift-global-savetime: 1713387264
age: 132343
x-cache: HIT TCP_MEM_HIT dirn:9:118592544
x-swift-savetime: Wed, 17 Apr 2024 20:54:24 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196077365658e
X-Firefox-Spdy: h2

registry.npmmirror.com/validaterick/1.0.21/files/logo/wg_logo.png

47.246.2.229

200 OK

6.6 kB

URL GET HTTP/2
registry.npmmirror.com/validaterick/1.0.21/files/logo/wg_logo.png
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit colormap, non-interlaced
Size
6.6 kB (6619 bytes)
Hash
8ad1401aae92e8a3e98167317ba4ea04
843dfafd95aaccac879feb2f9ae3d1cca82013e6
394d2c4e9b2789f74830d4ebd6be6a1a53a7b5d0386e8bc6346b4e08f784e67c

HTTP Headers

GET /validaterick/1.0.21/files/logo/wg_logo.png HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: image/png
content-length: 6619
strict-transport-security: max-age=5184000
date: Thu, 18 Apr 2024 17:02:49 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 7c312210-fda5-11ee-b841-1303d1c65cf1
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 136.448
via: ru3.l1, cache15.ru3, l2fr1.l2, cache32.l2fr1, registry.npmmirror.com-06, cache32.l2fr1[389,389,200-0,M], cache3.l2fr1[391,0], cache15.ru3[0,0,200-0,H], cache4.ru3[0,0]
ali-swift-global-savetime: 1713459769
age: 59838
x-cache: HIT TCP_HIT dirn:9:175010115
x-swift-savetime: Thu, 18 Apr 2024 17:02:49 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196077985808e
X-Firefox-Spdy: h2

registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/index.js

47.246.2.229

200 OK

1.2 kB

URL GET HTTP/2
registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/js/index.js
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (3274), with no line terminators
Size
1.2 kB (1231 bytes)
Hash
d88b09cfdfb50f1d610f99e29f29b4f5
af7ba9c6685658946a056dfd7c71e31c10bf1d8d
f3fa47d90201ed6b5db62ffe7315616b16032476c8cedb863f5c065a5275bac1

HTTP Headers

GET /htmxskyjs/1.0.52/files/editors/web2/js/index.js HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: application/javascript; charset=utf-8
content-length: 1231
strict-transport-security: max-age=5184000
date: Wed, 17 Apr 2024 21:09:59 GMT
vary: Origin, Accept, Accept-Encoding
request-id: d962af00-fcfe-11ee-abec-d5c7b78dfcc6
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 21.184
via: ru3.l1, cache6.ru3, l2fr1.l2, cache8.l2fr1, npmmirror-x86-20220823001, cache8.l2fr1[267,267,200-0,M], cache12.l2fr1[268,0], cache6.ru3[0,0,200-0,H], cache4.ru3[1,0]
content-encoding: gzip
ali-swift-global-savetime: 1713388199
age: 131408
x-cache: HIT TCP_MEM_HIT dirn:9:121774498
x-swift-savetime: Wed, 17 Apr 2024 21:09:59 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196078055832e
X-Firefox-Spdy: h2

registry.npmmirror.com/pickadatejs/1.0.7/files/lib/static/sexygirl.gif

47.246.2.229

200 OK

15 kB

URL GET HTTP/2
registry.npmmirror.com/pickadatejs/1.0.7/files/lib/static/sexygirl.gif
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
GIF image data, version 89a, 90 x 107
Size
15 kB (14773 bytes)
Hash
08cd02b15e6b509430265d6b2d524b33
0aac054ce3169c2ee96647354b3f3f3c4cc749de
34548ea196b54a72899bbedf294bcc3b0ac732ad983a35d0748366a2d7d8cea5

HTTP Headers

GET /pickadatejs/1.0.7/files/lib/static/sexygirl.gif HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://registry.npmmirror.com/htmxskyjs/1.0.52/files/editors/web2/css/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: image/gif
content-length: 14773
strict-transport-security: max-age=5184000
date: Fri, 12 Apr 2024 14:00:35 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 08af6920-f8d5-11ee-9905-c105ec2207aa
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 68.825
via: ru3.l1, cache15.ru3, l2de2.l2, cache12.l2de2, registry.npmmirror.com-07, cache12.l2de2[881,881,200-0,M], cache23.l2de2[883,0], cache15.ru3[0,0,200-0,H], cache4.ru3[0,0]
ali-swift-global-savetime: 1712930435
age: 589172
x-cache: HIT TCP_MEM_HIT dirn:10:419168100
x-swift-savetime: Fri, 12 Apr 2024 14:00:35 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196078095837e
X-Firefox-Spdy: h2

registry.npmmirror.com/validaterick/1.0.18/files/logo/cg_logo.png

47.246.2.229

200 OK

8.2 kB

URL GET HTTP/2
registry.npmmirror.com/validaterick/1.0.18/files/logo/cg_logo.png
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit colormap, non-interlaced
Size
8.2 kB (8242 bytes)
Hash
a72d1f0779d96ac3546b2896279230c7
8881150c2ae7804b077364f2c873ec9346164107
7f8aa268ad52a15b2539d1322bb2952395fc239458113f28311baf3a55847fa6

HTTP Headers

GET /validaterick/1.0.18/files/logo/cg_logo.png HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: image/png
content-length: 8242
strict-transport-security: max-age=5184000
date: Fri, 12 Apr 2024 14:00:35 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 089614c0-f8d5-11ee-9905-c105ec2207aa
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 37.384
via: ru3.l1, cache2.ru3, l2de2.l2, cache26.l2de2, registry.npmmirror.com-07, cache26.l2de2[241,241,200-0,M], cache11.l2de2[244,0], cache2.ru3[0,0,200-0,H], cache4.ru3[1,0]
ali-swift-global-savetime: 1712930435
age: 589172
x-cache: HIT TCP_MEM_HIT dirn:10:327655482
x-swift-savetime: Fri, 12 Apr 2024 14:00:35 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196078836003e
X-Firefox-Spdy: h2

ndj189.wwpv0nkp90yqz5034j2s.top/home.html

107.148.199.130

200 OK

42 kB

URL GET HTTP/2
ndj189.wwpv0nkp90yqz5034j2s.top/home.html
IP
107.148.199.130:443
ASN
#54600 PEG-SV

Requested by
http://www.18dd.net/new/5.exe
Certificate
IssuerLet's Encrypt
Subjectwyjg6mrb48jn4misytm3.top
FingerprintD5:91:35:69:2C:D5:20:DC:81:83:87:DC:E8:FD:CE:D7:C1:95:4A:3B
ValidityFri, 08 Mar 2024 07:16:07 GMT - Thu, 06 Jun 2024 07:16:06 GMT

File type
gzip compressed data, from Unix
Size
42 kB (42432 bytes)
Hash
eda3300aa0503600b39d413e339653b0
2fc5e8d3ac5fc4c65285ebb05fe5a10c8f169a4f
7e5db84328f90b0bbb6a3b012f121dc1f2bf99f91652f656271a86ec7454bdd3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /home.html HTTP/1.1
Host: ndj189.wwpv0nkp90yqz5034j2s.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000
bytedace: PaoPao
vary: Accept-Encoding
cache-control: public, max-age=3600
content-encoding: gzip
server: nginx
x-cache-status: HIT
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: *
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 1728000
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003413C0Qj.webp

104.19.88.56

200 OK

67 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003413C0Qj.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1380x800, Scaling: [none]x[none], YUV color, decoders should clamp
Size
67 kB (66744 bytes)
Hash
7cb8b5e29b6a3357a83f5c0fa6939948
911f3d525689f1c07a2b54604866870c3384b4b8
b01f056af0e940bc93880eff756fefeba34bb5e5f03a3c6e91c8b30bac7693fe

HTTP Headers

GET /vod/240326/VR2024032607003413C0Qj.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 66744
last-modified: Tue, 26 Mar 2024 16:30:32 GMT
etag: "6602f828-104b8"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O%2BIcdr75r9FAoKWfci3Ndi4aMNbY7LFLkTqbmdm8YNpwvnz7OsccFdJRA9jt69TQNJkKrTQsZ%2BcgRmvOcFu52LMyac0u0y36UmglpREWDaROb%2BcObXEMVf0FKGejxwDV4PwnGldYV98%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec256b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003458NGbL.webp

104.19.88.56

200 OK

8.3 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003458NGbL.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 509x354, Scaling: [none]x[none], YUV color, decoders should clamp
Size
8.3 kB (8302 bytes)
Hash
f3432c34f882b55bc9c478286c9a0c20
8c4d617f5046f9df55cca0f2456c1cc380d4fdc0
966cdccfa6bde245946947cff6b44bf4c8ffad738517bc4a76cd5dd9d0729b8f

HTTP Headers

GET /vod/240326/VR2024032607003458NGbL.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 8302
last-modified: Tue, 26 Mar 2024 16:30:35 GMT
etag: "6602f82b-206e"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2BvoGuHnyfVwQKM0qLrmhk84IlicfGGK93Tmfyo8aZCxxuZZWQ90dhmg%2BxSDSHgsSN%2FbiSZ1CpoNGSIShlYLRBXAQul8yTVou3JmgH%2FTwk628%2FxWcq2xpfeshBsTp2kT0sb55ialP9A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec156b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003553in6v.webp

104.19.88.56

200 OK

13 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003553in6v.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 906x687, Scaling: [none]x[none], YUV color, decoders should clamp
Size
13 kB (13266 bytes)
Hash
4cc40deffcf3538cc437efc584459669
84c241d62993d2b8a5420292c614ffb52fda7e2f
3b2636357fdbac35d6c0739bf89a8c63de1412ac897fe68b2566b20ef562b6f0

HTTP Headers

GET /vod/240326/VR2024032607003553in6v.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 13266
last-modified: Tue, 26 Mar 2024 16:30:38 GMT
etag: "6602f82e-33d2"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qFczKwvmv8XvIDq1HX1%2Bf%2BK05%2B2PkFC0H4%2FsP3%2Bsw8CP5jGYw6iqvcsbiVJl8U7asL3Zdv54T0u1Ie%2F6Yk3K6iGM2NbdbbhE7DVgxuIqY0aupba%2FfWhpAXMbkbxqZMCmCw5zDhTu5s%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddeca56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003416OZXA.webp

104.19.88.56

200 OK

62 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003416OZXA.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1280x720, Scaling: [none]x[none], YUV color, decoders should clamp
Size
62 kB (62214 bytes)
Hash
a671e7e10cf82155a1e250125d240df3
adb578dbd2f7905e938b3622b6bdc6a779e29697
a0ed1972088f7910dfeff5c1089d6b0136d6e296b430e074c9e8d60365ef7efe

HTTP Headers

GET /vod/240326/VR2024032607003416OZXA.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 62214
last-modified: Tue, 26 Mar 2024 16:30:37 GMT
etag: "6602f82d-f306"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aLkCe%2Bxa7ICU1nkPPJcfOTcQnYs%2BIssPsFpUXnMBwjO3uQmSzB2X6kmITEfDbt21SOdoYq1C8RwscXH%2BRQLwPF%2BrJfZWI5kf8ykXqujrvv63F1PtDcyU4xYJ24HqUuyt42lMEIn3jsE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec456b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003498Rxpf.webp

104.19.88.56

200 OK

62 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003498Rxpf.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1371x792, Scaling: [none]x[none], YUV color, decoders should clamp
Size
62 kB (61682 bytes)
Hash
81deaaf0f8cb24348d997ceef7799ae8
51f3f365ff30d97485fbe8ebdfd006ebcbbde10e
831813e3b126c2a5aca6ef6630ab4565ff12b7000fae3601d52c32f65ae0275a

HTTP Headers

GET /vod/240326/VR2024032607003498Rxpf.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 61682
last-modified: Tue, 26 Mar 2024 16:30:36 GMT
etag: "6602f82c-f0f2"
expires: Fri, 10 May 2024 08:34:05 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 781562
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jorZzUktTZH02%2F3Dc2ZyiY9Eum4ijQdOsF0KK392n%2FU95%2B6XXdpBjao7y%2F5MYyRbpjq9wBEUJyXLurrkFRqoKb4aRpoy5bVMVyg5ZGep%2BJ7JrhZ9h6Gmt9tgUtJXbSIOE5aeNGk4HDk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec956b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240416/VR20240416140005496VOZ.webp

104.19.88.56

200 OK

36 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240416/VR20240416140005496VOZ.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 917x516, Scaling: [none]x[none], YUV color, decoders should clamp
Size
36 kB (35480 bytes)
Hash
836f35d7f5781d2ad59623e5bb9ea45e
eeba4cc4694245e95eae23ca509a91ad50eb9b8a
7f8caf262744e6f2564748902b927d75c93c8940f56c2dfdd16ee2c73bbc2b0f

HTTP Headers

GET /vod/240416/VR20240416140005496VOZ.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 35480
last-modified: Tue, 16 Apr 2024 16:30:03 GMT
etag: "661ea78b-8a98"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Du1BEgGIAK%2FlZMu2ZEUjEwGrLZyO32tvWXQEyV98dijtmiDQyhK17l7FR%2FgniYALLQLpgYXVdWSmmfBuYnth599%2FT6R%2FqUnlwmj3JU4hB%2FDiSnoZNydDDolRW37LX4BycGf0sjO0MnQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddebf56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR20240326070033268vkI.webp

104.19.88.56

200 OK

51 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR20240326070033268vkI.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1280x720, Scaling: [none]x[none], YUV color, decoders should clamp
Size
51 kB (51438 bytes)
Hash
0074ae464572bd4f0d91064792e055ce
b413ed9482fb51fd971ce24b7b16eea4693f2d3a
9196940c4caf81892d4a059a598b28759c3b82e4161674c214c0ddcb8ab007d6

HTTP Headers

GET /vod/240326/VR20240326070033268vkI.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 51438
last-modified: Tue, 26 Mar 2024 16:30:33 GMT
etag: "6602f829-c8ee"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zsOQotsjnrzfjOckp8Kssq20HmjgPTLs3Zcz7XR7%2F3syDngUed4xZmtGzM8QIKH%2FMsoHHWtYjtu73wWh1IT%2BEmBKmK07HZzZj1w9ejxSMsu%2FLBp7IQsTZl7m6ngZAKtoNEmxD20DJ6Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec556b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003312BNQC.webp

104.19.88.56

200 OK

56 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003312BNQC.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1380x800, Scaling: [none]x[none], YUV color, decoders should clamp
Size
56 kB (56098 bytes)
Hash
065876f1068aac969babdb1afa0513e7
75a7fa2decbac0dd20472a9876f013e9b731445b
9f9376d01296dbfaa54a2a7a0a1aaa82d3f55f4616076728196d0f760acc84e4

HTTP Headers

GET /vod/240326/VR2024032607003312BNQC.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 56098
last-modified: Tue, 26 Mar 2024 16:30:32 GMT
etag: "6602f828-db22"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212317
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LlA2pSkvnW0G%2FD8icSJu67el%2Fpfc%2B%2BH4xcsq%2FQAhHu%2FQHD7RsKONfdPlteZkxSrg0UWSIdUU3sB2SA8d8F%2FrHMtAwSvbCZe3m2xdGG7TN8jjzXLCYz3147%2BqV5mioMv95IwqCpiUpe0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddec656b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240326/VR2024032607003449lqtQ.webp

104.19.88.56

200 OK

56 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240326/VR2024032607003449lqtQ.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1380x800, Scaling: [none]x[none], YUV color, decoders should clamp
Size
56 kB (56028 bytes)
Hash
a27d687c0b17bc7c9f747781dad5338c
3c4a270335d545f312130d7ae79df8bc7e8657d3
77c160b0ed95a3d763b5f6f3744d8380ed4a8bc8c7752c557b432b7a389d42e2

HTTP Headers

GET /vod/240326/VR2024032607003449lqtQ.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 56028
last-modified: Tue, 26 Mar 2024 16:30:36 GMT
etag: "6602f82c-dadc"
expires: Mon, 06 May 2024 15:00:08 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 1103998
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8mU6Ib9028lLP6UVITS68%2BZV67Xil854UY0Iikv2aFgsHp1GLJSBajFqJxRR92FelSzXwbny3fYwfxOppdtIxT7LZ16QiDt7dHqlCsPFQJMNKBN%2Fodhbg1%2FifTdj9CkMdRC03wv2w8E%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddecc56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240419/VR2024041906000433UZ9E.webp

104.19.88.56

200 OK

242 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240419/VR2024041906000433UZ9E.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 1076x852, components 3
Size
242 kB (242470 bytes)
Hash
fcdc7c224819c0092ef6d5b04db1aabe
55702db7e18c0628b875581710816fd990c406fe
a6f901d277efc6dd80b104c5690882e1b0c9665cd7213ab12fd9ec30344d26d4

HTTP Headers

GET /vod/240419/VR2024041906000433UZ9E.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 242470
last-modified: Thu, 18 Apr 2024 22:03:03 GMT
etag: "66219897-3b326"
expires: Sun, 19 May 2024 02:47:45 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 24741
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ehpbaf9cVyy3L7XSwtoZQwE4w6m4TZHPfQUdToHmNlKdBJpkVbPBHuoKonJ%2BbF%2Bq%2FaKu9kJ1ekqF2mbYiDdT%2BU9B9wjm8yO172XbkmF2%2B7Pc1BVNIfXsj4YsaSfAHxGBw5bVtK7JAfU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddebd56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240419/VR2024041914000657rexS.webp

104.19.88.56

200 OK

19 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240419/VR2024041914000657rexS.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Generated by Snipaste", baseline, precision 8, 463x282, components 3
Size
19 kB (18709 bytes)
Hash
4e0763fc9d3ed060e8145c0ade06c2fa
e9489dfc9b9e497b8e6b7a4affc439f35fea60f4
d7043fc4d70d7c05c3413f22a4f8f0bd62443330346c45c1586894b0b0607f79

HTTP Headers

GET /vod/240419/VR2024041914000657rexS.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:08 GMT
content-type: image/webp
content-length: 18709
last-modified: Fri, 19 Apr 2024 06:03:04 GMT
etag: "66220918-4915"
expires: Sun, 19 May 2024 09:39:53 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 14
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JfdcJ%2Bx9d5DmhxpSRGA%2FsN8z%2FElID0pOTNdZ8r2vRYh66MpU9gTZ%2Bqlbu48MlfaOAYhznW9%2Bus5rLtHiRjlf0jwEyf2XS2VcIiQpajFKjaJyECX07bYeXqVqi3jz%2FGpJRg70MoTI7SM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6e7f5656b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240412/VR2024041217001159gyV4.webp

104.19.88.56

200 OK

6.1 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240412/VR2024041217001159gyV4.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 554x261, Scaling: [none]x[none], YUV color, decoders should clamp
Size
6.1 kB (6118 bytes)
Hash
69b3aa139ed84024ccb5780582b827c9
cb8c0a2ed71fa5c07f1f4f0b33b528092d2c7562
7f1b6f29f605d84577843ebdb3b916c26c7739d1a6c90e8ec3efba5ef33568a1

HTTP Headers

GET /vod/240412/VR2024041217001159gyV4.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:08 GMT
content-type: image/webp
content-length: 6118
last-modified: Fri, 12 Apr 2024 16:30:05 GMT
etag: "6619618d-17e6"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212318
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUV%2FgpPgPbLQa0RfPb3%2FV%2FM0mKGdI1%2FenZrezt%2Bn0HmaOwipfTTVOcBikyuC02gpS9vWyXHJDOh6Sjq5%2BQQvklY5pBb6n4hJP5YQp0hFRWXpb95ysl6Qc9dnSqdfLliYgfwPPbjJ7fg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6e7f4f56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240412/VR2024041217001061VNsO.webp

104.19.88.56

200 OK

11 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240412/VR2024041217001061VNsO.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 487x292, Scaling: [none]x[none], YUV color, decoders should clamp
Size
11 kB (10750 bytes)
Hash
f67238280ed0a7c08fdc0f0062808dbc
b7d732fda10b04a126fc7aa55349c5643e732b3a
cd2e92536265cf1eea5546b09b69fd196ed68469cd2aa84732cbb95fad956fc7

HTTP Headers

GET /vod/240412/VR2024041217001061VNsO.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:08 GMT
content-type: image/webp
content-length: 10750
last-modified: Fri, 12 Apr 2024 16:30:05 GMT
etag: "6619618d-29fe"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212318
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pLAvMwRn6c1WUVPE8QeuRFJsHoZ8mAN04ud7ij5g2F15XWLZMOppjUyeMurScAsEziinoMdyrfW9%2B7FE8NrX0mzI9RGTHGGEvDWmz4rdBtEI9txXs6cFKfUjBr5sws9zutFSWDOLScw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6e7f5756b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240412/VR2024041217001030abPD.webp

104.19.88.56

200 OK

12 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240412/VR2024041217001030abPD.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 458x303, Scaling: [none]x[none], YUV color, decoders should clamp
Size
12 kB (11898 bytes)
Hash
ffe8c54b24a501af5a5ce62079b7803c
b0a435b223314d8bdfbab4ec23d7c36ab35327a6
bac94c95c678c639c39c0d433f8d901b70beeca38d10134848d25defc6d60173

HTTP Headers

GET /vod/240412/VR2024041217001030abPD.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:08 GMT
content-type: image/webp
content-length: 11898
last-modified: Fri, 12 Apr 2024 16:30:05 GMT
etag: "6619618d-2e7a"
expires: Mon, 13 May 2024 13:25:43 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 504865
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=elWqDqEuo2VgoHoLYR0ONeJQH5dzvIXne5PEQ%2B%2Fzj0cgyfsFyoDmQ1WQ9w4ShvPMBLl9h3HaI4oEi5XD6m8%2BBcUTcYj1iPzd8PenHwLdFJYyTSjpeK7ydW5F0Gh94DLc%2FXGOnNwVJmc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6e7f5256b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

y4video.bytedance.sbs/vod/240416/VR2024041614000636OSyh.webp

104.19.88.56

200 OK

34 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240416/VR2024041614000636OSyh.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 910x514, Scaling: [none]x[none], YUV color, decoders should clamp
Size
34 kB (34466 bytes)
Hash
d05759f471187e82b5327d48aac707f1
b698864ea5eed9920c5aa79836d4eaa93f5d4ab9
27a07764ef420006206c1e29b268549b66b1ef94420d6ffd9d34c18fe2f18716

HTTP Headers

GET /vod/240416/VR2024041614000636OSyh.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:08 GMT
content-type: image/webp
content-length: 34466
last-modified: Tue, 16 Apr 2024 16:30:03 GMT
etag: "661ea78b-86a2"
expires: Thu, 16 May 2024 22:41:30 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 212318
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5xin879e0JyO4bhITVMeImfyo7hIns9vGY6i%2FRvtEDhbrNgfgpMfzu4%2FKAdxPiIMNedRhGav7A8xcZKKQMmCVriiAEpEAXnt0TSNOBycDCVuLW7vR7C05byIJrD4Z%2BtRe4%2BN3V2shS0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6e7f5356b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

registry.npmmirror.com/validaterick/1.0.10/files/bower/1334adb7007e8648bbd4bf39f1edc15b

47.246.2.229

200 OK

311 kB

URL GET HTTP/2
registry.npmmirror.com/validaterick/1.0.10/files/bower/1334adb7007e8648bbd4bf39f1edc15b
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image
Size
311 kB (311104 bytes)
Hash
350360a3ba5bed1914c36f5ace66c97d
56096ebb7388117bc7e59a604040949486759209
93553374255807e1ed0d57e33afa739c40f14b9752e94ab511b6c4a3e00bd8ec

HTTP Headers

GET /validaterick/1.0.10/files/bower/1334adb7007e8648bbd4bf39f1edc15b HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: application/octet-stream
content-length: 311104
strict-transport-security: max-age=5184000
date: Fri, 12 Apr 2024 14:00:35 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 089e5220-f8d5-11ee-8c14-2901f4c3e4d3
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 98.538
via: ru3.l1, cache15.ru3, l2de2.l2, cache9.l2de2, npmmirror-x86-20220823002, cache9.l2de2[406,405,200-0,M], cache12.l2de2[408,0], cache15.ru3[0,0,200-0,H], cache4.ru3[3,0]
ali-swift-global-savetime: 1712930435
age: 589172
x-cache: HIT TCP_MEM_HIT dirn:11:61951167
x-swift-savetime: Fri, 12 Apr 2024 14:00:35 GMT
x-swift-cachetime: 31536000
timing-allow-origin: *
eagleid: 2ff6029817135196079806235e
X-Firefox-Spdy: h2

registry.npmmirror.com/validaterick/1.0.10/files/bower/c0da9354f744e68da3dfefa70f0881da

47.246.2.229

200 OK

627 kB

URL GET HTTP/2
registry.npmmirror.com/validaterick/1.0.10/files/bower/c0da9354f744e68da3dfefa70f0881da
IP
47.246.2.229:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerDigiCert Inc
Subjectregistry.npmmirror.com
Fingerprint0A:37:35:78:AE:E7:18:6C:F6:F9:63:3A:1A:75:61:7C:00:4E:E4:9F
ValidityThu, 14 Sep 2023 00:00:00 GMT - Sat, 14 Sep 2024 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image
Size
627 kB (627070 bytes)
Hash
068e67a00fdff0946e1c1c6b253cd08c
31640ca9515f6b2689f7141d3a98f0cbe43dbbc2
98e34e03cc3380defd4bdbd450a8e72c81f973fa94a59619cead67831f0e1b9c

HTTP Headers

GET /validaterick/1.0.10/files/bower/c0da9354f744e68da3dfefa70f0881da HTTP/1.1
Host: registry.npmmirror.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: Tengine
content-type: application/octet-stream
content-length: 627070
strict-transport-security: max-age=5184000
date: Fri, 12 Apr 2024 14:00:35 GMT
vary: Origin, Accept, Accept-Encoding
request-id: 089837a0-f8d5-11ee-bd63-8b5209de93d2
cache-control: public, max-age=31536000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-readtime: 65.433
via: ru3.l1, cache10.ru3, l2de2.l2, cache15.l2de2, npmmirror-x86-20220823001, cache15.l2de2[0,19,200-0,H], cache23.l2de2[21,0], cache16.ru3[0,0,200-0,H], cache4.ru3[2,0]
ali-swift-global-savetime: 1712930435
age: 589172
x-cache: HIT TCP_MEM_HIT dirn:10:172447485
x-swift-savetime: Mon, 15 Apr 2024 01:54:59 GMT
x-swift-cachetime: 31320336
timing-allow-origin: *
eagleid: 2ff6029817135196079816236e
X-Firefox-Spdy: h2

hm.baidu.com/hm.js?ad094474b0add3e56ee49f061c87f9d0

14.215.182.140

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?ad094474b0add3e56ee49f061c87f9d0
IP
14.215.182.140:443
ASN
#4134 Chinanet

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (617)
Size
11 kB (11255 bytes)
Hash
a8037d0f92350bfddc3db19855bc78f2
404cdd16d2b8eea6b2cd805e63526f5bc61ce033
67b7cec69b26dd903515bc95e32d180ea34ef6df0b9d0b11647728355c4e0572

HTTP Headers

GET /hm.js?ad094474b0add3e56ee49f061c87f9d0 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11255
Content-Type: application/javascript
Date: Fri, 19 Apr 2024 09:40:08 GMT
Etag: 52af6175c23f15b0a167c209036f516f
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=D6EC0DF332D8E669; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=853987182&si=ad094474b0add3e56ee49f061c87f9d0&v=1.3.0&lv=1&sn=41498&r=0&ww=1280&u=https%3A%2F%2Fndj189.wwpv0nkp90yqz5034j2s.top%2Fhome.html&tt=%E9%A6%96%E9%A1%B5%20-%20%E5%A8%81%E5%93%A5%E8%A7%86%E9%A2%91

14.215.182.140

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=853987182&si=ad094474b0add3e56ee49f061c87f9d0&v=1.3.0&lv=1&sn=41498&r=0&ww=1280&u=https%3A%2F%2Fndj189.wwpv0nkp90yqz5034j2s.top%2Fhome.html&tt=%E9%A6%96%E9%A1%B5%20-%20%E5%A8%81%E5%93%A5%E8%A7%86%E9%A2%91
IP
14.215.182.140:443
ASN
#4134 Chinanet

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=0&ck=1&cl=24-bit&ds=1280x1024&vl=23400&et=0&ja=0&ln=en-us&lo=0&rnd=853987182&si=ad094474b0add3e56ee49f061c87f9d0&v=1.3.0&lv=1&sn=41498&r=0&ww=1280&u=https%3A%2F%2Fndj189.wwpv0nkp90yqz5034j2s.top%2Fhome.html&tt=%E9%A6%96%E9%A1%B5%20-%20%E5%A8%81%E5%93%A5%E8%A7%86%E9%A2%91 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 19 Apr 2024 09:40:08 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=30CA0DBF319C9A01; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

y4video.bytedance.sbs/vod/240419/VR2024041914000759tIp3.webp

104.19.88.56

200 OK

23 kB

URL GET HTTP/2
y4video.bytedance.sbs/vod/240419/VR2024041914000759tIp3.webp
IP
104.19.88.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ndj189.wwpv0nkp90yqz5034j2s.top/home.html
Certificate
IssuerGoogle Trust Services LLC
Subjecty4video.bytedance.sbs
Fingerprint87:43:77:C8:E6:6A:6C:4F:AE:E2:5D:3F:0C:A8:05:7E:88:10:80:20
ValidityThu, 04 Apr 2024 20:22:23 GMT - Wed, 03 Jul 2024 20:22:22 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Generated by Snipaste", baseline, precision 8, 436x283, components 3
Size
23 kB (22824 bytes)
Hash
ca956ddd319f42e37acec5b8c1993353
1eb06437e3f8a39c6baee152508d4ad871ac4059
00f1a853447e777b80b816bc4905bf30aef9c06e0a80c7be09763214f61edc6b

HTTP Headers

GET /vod/240419/VR2024041914000759tIp3.webp HTTP/1.1
Host: y4video.bytedance.sbs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ndj189.wwpv0nkp90yqz5034j2s.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Apr 2024 09:40:07 GMT
content-type: image/webp
content-length: 22824
last-modified: Fri, 19 Apr 2024 06:03:04 GMT
etag: "66220918-5928"
expires: Sun, 19 May 2024 09:39:53 GMT
cache-control: max-age=2678400
cf-cache-status: HIT
age: 13
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHbeTRNUMNh%2BzljFh0mKZKDhSzTeuJSsX4DYSEyt5VOVVHH8psMB9aDx2NooAwyyGw06Qw6M4Qg66WAikJa1kA46FQd67Y7wlQoOtUDfybQagOhLZwtN3QwNtHJgBfoFRp5%2Br1grZlI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876bee6ddebe56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (13)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations