clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
36 kB URL clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (29179), with CRLF, LF line terminators
Hash 6e78babfa1f10a110f4cb9dd90691260
240f3d2f09767646a5e2ece5c3ab30d9b89df08f
ec05947a554f7272356317519104d8ae2ed301ae70b2f9aa16911d4582a74c52
GET /Qio8n652eeee9d36d1AMVHdkKtBC0nf?r= HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: cookies-enable=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.6.40-0+deb8u16
Set-Cookie: PHPSESSID=thdod6sbh85bshbmuva8vifce0; expires=Tue, 17-Oct-2023 21:31:04 GMT; Max-Age=3600; path=/; domain=.shorte.st; HttpOnly
hl=en; expires=Wed, 16-Oct-2024 20:31:04 GMT; Max-Age=31536000; path=/
referrer_url=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; httponly
cookies-enable=1; path=/; httponly
Cache-Control: no-cache
X-Frame-Options: DENY
X-Server-ID: shn09
X-UA-Compatible: IE=Edge
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zIc3W6Zkt6P%2FLYX0ieH1qmuaGPO4AdSZiCC3BfCIpNS0mPGDawf%2FyRt2HgFDpytvKsXcnpjk96cM%2FtKwz3jtw99978PscgpAc3EZiriEBhg6HKx8JUqdMVcyN0Ch"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 817b4d9339565687-OSL
Content-Encoding: gzip
static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
25 kB URL static.sh.st/js/packed/interstitial-page.js?2022-06-29.0
IP
File type Unicode text, UTF-8 text, with very long lines (20454)
Hash 06eb8d871dccb0da41b67abac7022ba9
dbe95283dcf49fac294a7d3445efad665c2ee790
88bb3be0111402f5ca81aaa36cbf7c4a2755099c5d0446831331e1d1d8e7a1ef
GET /js/packed/interstitial-page.js?2022-06-29.0 HTTP/1.1
Host: static.sh.st
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=86400
Cf-Bgj: minify
Cf-Polished: origSize=102880
ETag: W/"62bc140d-191e0"
Expires: Wed, 18 Oct 2023 14:48:39 GMT
Last-Modified: Wed, 29 Jun 2022 08:57:49 GMT
Vary: Accept-Encoding
X-Server-ID: shn09
X-UA-Compatible: IE=Edge
CF-Cache-Status: HIT
Age: 20545
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZQbp%2FYvmxdl7HaXic7GfnxJ%2Fxla7LZvWybzgWSleUR7EdGr3%2BkRiLCkM4cU8G0sCqfqJUd%2FEyq8PWTjbEyyXXdukzEG8D%2FbJR1LtZ2EW10PDczbZ0ufnsArl40KeIw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 817b4d96383856af-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
ocsp.pki.goog/gts1c3
472 B IP
Hash 87d874e16161e60b13bd34c9dbb4fcf1
a4dbc700e79aa715720a7e7d3973c2c0a7f67fcf
2a2d26e9e4f8fb4e385cf21e3973474c876611b1ca3378d8fefe736b3f86323e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
static.sh.st/b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2022-06-29.0
200 OK 6.2 kB URL GET HTTP/1.1 static.sh.st/b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2022-06-29.0
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type PNG image data, 249 x 62, 8-bit/color RGBA, non-interlaced\012- data
Hash 9ca44d211b1779ef13c1f7406a76c1ff
8b5ab1222409a144c8f1d3bd2a098985bd0bcba7
fd7607ab554a8c5af9aed32593ae99aaf0682198dbbd277372e8b663bd98b001
GET /b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2022-06-29.0 HTTP/1.1
Host: static.sh.st
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: image/png
Content-Length: 6226
Connection: keep-alive
Last-Modified: Fri, 17 Jul 2015 13:29:04 GMT
ETag: "55a90320-1852"
X-Server-ID: shn05
X-UA-Compatible: IE=Edge
Expires: Wed, 18 Oct 2023 14:48:39 GMT
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 20545
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RQTOTB5HH4q9ubHC89gc3flbQgyUGKSStfw6HMJOcwXzOnbhGhJhBBVZVq3osU2ZOD2wbfIkN1ueRmMS94ksTtWVlXOaU%2FgNGZf8eBRt9aaOmKO9BPtAahDKo6MKUg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d96d8e156af-OSL
alt-svc: h2=":443"; ma=60
clkmein.com/bundles/smeweb/img/tracking-437868.gif?t=1697574664
43 B URL clkmein.com/bundles/smeweb/img/tracking-437868.gif?t=1697574664
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /bundles/smeweb/img/tracking-437868.gif?t=1697574664 HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Cookie: cookies-enable=1; hl=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
X-Server-ID: shn08
X-UA-Compatible: IE=Edge
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BY9Go4TEAUcYVUVyyFd%2BMEhlJarbr%2Bng5%2FUArh1ihlpriTZJvdIrP%2B7rVKIF%2B6gMrP6%2FGS8ihQrTxaG%2FIGFjp%2ByXf6Yd%2BOJpZJvxGpNdM9gJ7MC6v2VoasPxj%2Fxc"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d96dcf55687-OSL
clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
202 kB URL clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size 202 kB (201593 bytes)
Hash 9efa6803901d2972d56396278a37e83f
d025de80cc651f7a0851d2a97f029dc85b0ebf01
7e2fbac92e8e9475ffafc09270e1fc4fb115869e3f4c5c98520fa368d0325d84
GET /Qio8n652eeee9d36d1AMVHdkKtBC0nf?r= HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
date: Tue, 17 Oct 2023 20:31:03 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/5.6.40-0+deb8u16
set-cookie: PHPSESSID=od7fs2l2k02ule4860q6dvcpr3; expires=Tue, 17-Oct-2023 21:31:03 GMT; Max-Age=3600; path=/; domain=.shorte.st; HttpOnly
cookies-enable=1; path=/; httponly
cache-control: no-cache
x-server-id: shn03
x-ua-compatible: IE=Edge
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SCwPu2WlRnYCO%2Fux7QQA5T6TkZPVGtngu8QmheZ54gO3tc8NzkI0Vj2g8y0hvoF5QERmp%2B7PsT4Yxfw3vDHtJLHjnsoKDgdk%2FLuKztmrv4I%2B7vAbuSX4gquRG8CF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 817b4d913b9f5689-OSL
content-encoding: br
X-Firefox-Spdy: h2
clkmein.com/bundles/smeweb/img/advertisement-tracking-437868.gif?t=1697574664
43 B URL clkmein.com/bundles/smeweb/img/advertisement-tracking-437868.gif?t=1697574664
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /bundles/smeweb/img/advertisement-tracking-437868.gif?t=1697574664 HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Cookie: cookies-enable=1; hl=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
X-Server-ID: shn09
X-UA-Compatible: IE=Edge
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8d%2F93sdBA82dxnp605qKyUqgPu0mpH%2FWCurdUea3IaU1dx8EQemDlKeubsiAytDE4Cg3VbGzuy13wQ%2BfGgzw%2B0HsrfPHccPTtyMUNlVQKYphlru3fsh%2FVvIT7BGr"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d96dd1b569f-OSL
ja.rewashwudu.com/fmwhVStpL4dxap/46223
26 B URL ja.rewashwudu.com/fmwhVStpL4dxap/46223
IP
File type ASCII text, with no line terminators
Hash 4fc71bf68a1d477bd1523733e34d1e90
15119105cffbe108b6cf290146ab02c9aa8517ba
74c1971a5c7f3f1cfb81b7a0a8717cee5a45841844104566e00bbfca271943ce
GET /fmwhVStpL4dxap/46223 HTTP/1.1
Host: ja.rewashwudu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://clkmein.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jU1Sg0AQhSH8RQ1oV3EAj8AQMcnSTVbegZphGhwD06lmQuLtHa3S3fteffVeEASr8hHCJY0husgGnl8aXe97Ve31tsZq34vda9UoIbp6u1PycIA7M7dOqhFdDOt5kuxat8SwGdAim67tSGMOT976a06WrjaGRLG0Oodk8saYQ6aYrjNyGUFs5YSQHQ1jTzdvyE9iiIQQPhvrc1jBiuYyKu4heTf2cis2aVAUaQAP51G6nnhqjfaYDCw1QvgG6046HIi%2FINM4nxydAWjU7b%2F%2Fe5qMP2uQalxM55HcB%2FI3ouZOdQ%3D%3D; expires=Wed, 18-Oct-2023 20:31:04 GMT; Max-Age=86400; path=/
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjCC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7B3R; expires=Wed, 18-Oct-2023 20:31:04 GMT; Max-Age=86400; path=/
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
clkmein.com/bundles/advertisement/img/tracking.gif?test=7e82778a205986d6e8b21245366900e3ac502879
0 B URL clkmein.com/bundles/advertisement/img/tracking.gif?test=7e82778a205986d6e8b21245366900e3ac502879
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bundles/advertisement/img/tracking.gif?test=7e82778a205986d6e8b21245366900e3ac502879 HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Cookie: cookies-enable=1; hl=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Last-Modified: Wed, 29 Jun 2022 08:56:54 GMT
ETag: "62bc13d6-0"
X-Server-ID: shn01
X-UA-Compatible: IE=Edge
Access-Control-Allow-Origin: *
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mchLP%2BCx%2FvzcAe3VhBw0u5LVQ3RWTLrkcfdw3Y%2BderMuYzFCIVspKQRmjVZYoJYZrrJBFjlL5z0CpMvR%2B5WN8kMxBPigE%2Fn3APNt%2F6mAjgbZRaygk%2BdurmRZY7Rg"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d96dc5156bf-OSL
ocsp.pki.goog/gts1c3
472 B IP
Hash f057e7c2876f8d7a66dd7ae5665cfae6
e15404d3eb7ffb069c08309d7985ce648aa0aa6f
9019fedb4e1d2375d256463b8a04655899aff7c91aa147e5cee808df795e5d82
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
static.sh.st/bundles/smeweb/img/widget-sprite.png?2022-06-29.0
200 OK 84 kB URL GET HTTP/1.1 static.sh.st/bundles/smeweb/img/widget-sprite.png?2022-06-29.0
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type PNG image data, 1000 x 2704, 8-bit colormap, non-interlaced\012- data
Hash 0eb6767d5ee6d6e7b3884a01b7730c80
4bc5d39918bcea70e852e0fb7b3d15caf0993434
8146dfca511f063c33c05e13e151ed3d3456441590a4b1358bbc99b320a02b8d
GET /bundles/smeweb/img/widget-sprite.png?2022-06-29.0 HTTP/1.1
Host: static.sh.st
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: image/png
Content-Length: 84545
Connection: keep-alive
Last-Modified: Wed, 29 Jun 2022 08:56:53 GMT
ETag: "62bc13d5-14a41"
X-Server-ID: shn05
X-UA-Compatible: IE=Edge
Expires: Wed, 18 Oct 2023 14:52:04 GMT
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 20340
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z9y9IDljl1ckeUwbCaUtnyjSI5of8PEYYyAMUa4H4GS7f8eJ3EUlHSxgDGp%2BJS3mNmz3W7V1AhdBN9KRmIfLxdPrkezcYzOC15jQBXATUpBinXELvZraOwRIKiY89w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d981a8356af-OSL
alt-svc: h2=":443"; ma=60
ocsp.pki.goog/gts1c3
471 B IP
Hash 4e3d632834f367982e02547ed01f3c2e
e6de16d3f26695de5e45b6aed6bce1f0c8504fef
5af172e50ca188e53368a2b368ef9b1c69fe0ca984d46d0993ec663ae1251d83
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 4e3d632834f367982e02547ed01f3c2e
e6de16d3f26695de5e45b6aed6bce1f0c8504fef
5af172e50ca188e53368a2b368ef9b1c69fe0ca984d46d0993ec663ae1251d83
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2
200 OK 48 kB URL GET HTTP/2 fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint24:E0:20:DC:DE:E3:A8:D9:A8:17:BA:26:F5:41:32:19:98:D0:30:F3
ValidityMon, 18 Sep 2023 08:25:05 GMT - Mon, 11 Dec 2023 08:25:04 GMT
File type Web Open Font Format (Version 2), TrueType, length 48208, version 1.0\012- data
Hash c49b7c3643f781d71645c5a40a78b5bf
e71138026b38afc443fb60da5ffc2244c4f5eb11
8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808
GET /s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48208
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 13 Oct 2023 16:08:41 GMT
expires: Sat, 12 Oct 2024 16:08:41 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:24:45 GMT
content-type: font/woff2
age: 361344
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2
200 OK 48 kB URL GET HTTP/2 fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint24:E0:20:DC:DE:E3:A8:D9:A8:17:BA:26:F5:41:32:19:98:D0:30:F3
ValidityMon, 18 Sep 2023 08:25:05 GMT - Mon, 11 Dec 2023 08:25:04 GMT
File type Web Open Font Format (Version 2), TrueType, length 48208, version 1.0\012- data
Hash c49b7c3643f781d71645c5a40a78b5bf
e71138026b38afc443fb60da5ffc2244c4f5eb11
8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808
GET /s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48208
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 13 Oct 2023 16:08:41 GMT
expires: Sat, 12 Oct 2024 16:08:41 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:24:45 GMT
content-type: font/woff2
age: 361344
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 4e3d632834f367982e02547ed01f3c2e
e6de16d3f26695de5e45b6aed6bce1f0c8504fef
5af172e50ca188e53368a2b368ef9b1c69fe0ca984d46d0993ec663ae1251d83
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash 779882817f8804aebd79fcce0967e23b
436652deaf877d1391da5cd61e53d1966ef9e2b0
236468f865699350e2f2ab76b1a226c1b24b8099527dcf661eccbdca3375ef82
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtm.js?id=GTM-5SFMWPJ
58 kB URL www.googletagmanager.com/gtm.js?id=GTM-5SFMWPJ
IP
File type ASCII text, with very long lines (2952)
Hash 1277798d16ba532469851e9bc51269fb
65a4a27749fc6c2461cc7597f3100dbbbe7fa706
c5ba625e14a6c503e56a2339b0ba1239060d57ace8bd189eb0cf61ace5ba8c24
GET /gtm.js?id=GTM-5SFMWPJ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 17 Oct 2023 20:31:05 GMT
expires: Tue, 17 Oct 2023 20:31:05 GMT
cache-control: private, max-age=900
last-modified: Tue, 17 Oct 2023 19:34:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 58040
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js
200 OK 18 kB URL GET HTTP/1.1 endangersquarereducing.com/34/c6/b3/34c6b37755370ea4318f4ff4946df449.js
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type ASCII text, with very long lines (43215), with no line terminators
Hash 9f21211587737b853ed7ab49e51437af
bc548d9d28698c6ee3d891ea45871b5da8c6ddb4
e4821dfb61004e4b3ca409a60c3c8e26c53a902b22bb6acc16a318a0fa9c1c9c
GET /34/c6/b3/34c6b37755370ea4318f4ff4946df449.js HTTP/1.1
Host: endangersquarereducing.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:05 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_CF-2814-l=0; expires=Thu, 19 Oct 2023 20:31:05 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0940a73a0d8dede389f356ace1e56da0
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
471 B IP
Hash 39dd09184e5d5383e6470268e098a292
9b3238b72a3808d9247189a6b52a2563a822a941
3fc2093bf3b7c521a55c2a42708957c872751257455628e2630c04afaa5f9d2f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 17 Oct 2023 20:31:05 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 3f4808370559f2b7bcd6376f4b9a0504
82c5ce802df173c8fddad801bbd3099d2388f48d
e597d981f645a5f1d7037e4457396177d54846c18d73411ad10aeb8a086a5439
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Tue, 17 Oct 2023 20:31:05 GMT
Last-Modified: Tue, 17 Oct 2023 19:29:19 GMT
Server: ECAcc (ska/F7B4)
X-Cache: Miss from cloudfront
Via: 1.1 6259d2cd8a5947ad41a420527bbed7a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 0JCaCwPd5und94En-x7SKopeD9drRrFaPu7Ow-MVgnSSoRqXgnsdzQ==
Age: 3706
professionalswebcheck.com/stats
40 B URL professionalswebcheck.com/stats
IP
File type ASCII text, with no line terminators
Hash bb4bb2141680db6c215e74774ed4daed
a40f3df8011df7103a17d21008854f2fb27cabfd
4846d7a8063ac84bb948888bccda282bfee9cc20ce69b8438659bfbf3c9ce0cc
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:05 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: http://clkmein.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=8d1393d6-7c1b-4183-84df-cad1a026641b:1:1; expires=Fri, 14 Oct 2033 20:31:05 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
ptauxofi.net/pfe/current/tag.min.js?z=4157053
33 kB URL ptauxofi.net/pfe/current/tag.min.js?z=4157053
IP
File type C source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash a9d1dcb7dcfa5be50e0cfda6c0665e38
ca2968b68e49a9e426dde6760adb84acc81371ca
5824881edfbce570eb3ccb31489c1710c3a8f2b4055fcaa9f9085a8adc4a742d
GET /pfe/current/tag.min.js?z=4157053 HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:04 GMT
content-type: application/javascript
last-modified: Tue, 17 Oct 2023 12:19:39 GMT
etag: W/"652e7bdb-33d2"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-997869120&l=dataLayer&cx=c
200 OK 71 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=AW-997869120&l=dataLayer&cx=c
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint54:FD:04:1B:2E:C7:46:95:DD:15:A3:A0:3F:CE:7F:03:02:53:36:8F
ValidityMon, 18 Sep 2023 08:19:25 GMT - Mon, 11 Dec 2023 08:19:24 GMT
File type ASCII text, with very long lines (2952)
Hash 8e06bd4da69d3929d02aa8b4b4fbe916
390979887b5761ae7f6a6fd7c404f7d0ce290316
cbce7d1154f95fa4946b6e91ec1e0bb5f8c07550d90915957d18e467cb6aff00
GET /gtag/js?id=AW-997869120&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 17 Oct 2023 20:31:05 GMT
expires: Tue, 17 Oct 2023 20:31:05 GMT
cache-control: private, max-age=900
last-modified: Tue, 17 Oct 2023 19:34:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 71175
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ptauxofi.net/zone?pub=0&zone_id=4157053&is_mobile=false&domain=clkmein.com&var=&ymid=&var_3=&tg=0
908 B URL ptauxofi.net/zone?pub=0&zone_id=4157053&is_mobile=false&domain=clkmein.com&var=&ymid=&var_3=&tg=0
IP
File type JSON data\012- , ASCII text, with very long lines (907)
Hash 4a475681dd3fdb63073f740f13b06977
256ac9df787776671076d19900878722c4e3eacc
e59808a0236875606d894a1ad2e85c83ebb1f19effd57746de46dee7d71e60a0
GET /zone?pub=0&zone_id=4157053&is_mobile=false&domain=clkmein.com&var=&ymid=&var_3=&tg=0 HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:05 GMT
content-type: application/json; charset=utf-8
content-length: 908
x-trace-id: 06e42fb22b8cbff284787938be56deb2
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
xngqoc.com/cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0MzMzNDAsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY=
0 B URL xngqoc.com/cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0MzMzNDAsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY=
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0MzMzNDAsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY= HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx/1.18.0
date: Tue, 17 Oct 2023 20:31:05 GMT
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2
xngqoc.com/er?a=1
200 OK 0 B IP
ASN #39572 DataWeb Global Group B.V.
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectxngqoc.com
Fingerprint72:3D:8C:DE:14:53:13:4C:23:00:B1:8D:16:EC:18:3F:17:95:FC:09
ValidityTue, 29 Aug 2023 01:02:29 GMT - Mon, 27 Nov 2023 01:02:28 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /er?a=1 HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 17 Oct 2023 20:31:05 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
X-Firefox-Spdy: h2
vigorouslyflamboyant.com/pixel/purst?dl=0&th=0&sc=0&rs=1256&rd=1256&fd=709&bv=23.10.v.1&tmpl=70
0 B URL vigorouslyflamboyant.com/pixel/purst?dl=0&th=0&sc=0&rs=1256&rd=1256&fd=709&bv=23.10.v.1&tmpl=70
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=1256&rd=1256&fd=709&bv=23.10.v.1&tmpl=70 HTTP/1.1
Host: vigorouslyflamboyant.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:05 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
vigorouslyflamboyant.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
14 kB URL vigorouslyflamboyant.com/08/26/66/0826667673c6afa9f85340ed4fc8ef57.js
IP
File type ASCII text, with very long lines (40537), with no line terminators
Hash b486d6c098d1fbb6a92a297e894bfe06
5ba77035d1e2f8daf1c8ae001bba6f6129cca58c
35d09e8594a23aa5ba2bb8f2fc13193156ea35a9353576f87eac9c46a8df5240
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /08/26/66/0826667673c6afa9f85340ed4fc8ef57.js HTTP/1.1
Host: vigorouslyflamboyant.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:05 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0ebcfbc8ade0c038c10046763a8e59bf
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ptauxofi.net/pfe/current/universal.min.js?v=3.1.463
33 kB URL ptauxofi.net/pfe/current/universal.min.js?v=3.1.463
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 04e9b4d8f2059537274b960f49504fcd
8f321d78501388cc1e54a0be673e71d232b41e93
34a0f6eaadbfed520a5df4a1182befb6aa744b0c01137f2a01faad98622f025a
GET /pfe/current/universal.min.js?v=3.1.463 HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:05 GMT
content-type: application/javascript
last-modified: Tue, 17 Oct 2023 12:19:39 GMT
etag: W/"652e7bdb-155a7"
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
prhzxq.com/wnload?a=1&e=aeyJwaWQiOjExMDIzNjAsInNpZCI6MTE5NDYyMywid2lkIjo0Mzk2MzQsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY=&inc=1
586 B URL prhzxq.com/wnload?a=1&e=aeyJwaWQiOjExMDIzNjAsInNpZCI6MTE5NDYyMywid2lkIjo0Mzk2MzQsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY=&inc=1
IP
ASN #39572 DataWeb Global Group B.V.
File type gzip compressed data, from Unix\012- data
Hash 6d669599578f729c20bdac7c90caf4ac
40442375e841aa45285ad7649a3e3e0d893735f8
b776398a58fa051eaf3ebafe1391103c37a3055388935632a2bf3e4551d67001
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wnload?a=1&e=aeyJwaWQiOjExMDIzNjAsInNpZCI6MTE5NDYyMywid2lkIjo0Mzk2MzQsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cDovL2Nsa21laW4uY29tL1FpbzhuNjUyZWVlZTlkMzZkMUFNVkhka0t0QkMwbmY=&inc=1 HTTP/1.1
Host: prhzxq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 17 Oct 2023 20:31:05 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
content-encoding: gzip
X-Firefox-Spdy: h2
my.rtmark.net/gid.js?pub=0&userId=44d62ffd7dfb4868931d0d7f22e73d22&zoneId=4157053&checkDuplicate=true&ymid=&var=
65 B URL my.rtmark.net/gid.js?pub=0&userId=44d62ffd7dfb4868931d0d7f22e73d22&zoneId=4157053&checkDuplicate=true&ymid=&var=
IP
File type JSON data\012- , ASCII text
Hash a39ddc3e612c87bd8502ede9438ec926
dfee394d00b0fccbab98dfb0a747b7345c07c934
2841211da14124018da58bbe4baf43dd547c6104bc4f0616e6d15ee2083e0d2d
GET /gid.js?pub=0&userId=44d62ffd7dfb4868931d0d7f22e73d22&zoneId=4157053&checkDuplicate=true&ymid=&var= HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:05 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: http://clkmein.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=44d62ffd7dfb4868931d0d7f22e73d22; expires=Wed, 16 Oct 2024 20:31:05 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
200 OK 28 kB URL GET HTTP/1.1 friendshipmale.com/sfp.js
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash 2d0450888479d4ddda305bd96206b240
5b4595aab1cd3f854718e05db9be0c65a12ab2f6
44de073e74ff24c6b1c0fe1f3ac5b33d793560e85ef24fb6ce89e76c2cf90af6
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:05 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: max-age=14400
X-Request-ID: 951bf1752847d022c75b3f4ff1e1bfb6
Strict-Transport-Security: max-age=0; includeSubdomains
CF-Cache-Status: EXPIRED
Last-Modified: Tue, 17 Oct 2023 20:31:05 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CNf36lA7BiW71pFShpFZJfLzIgjqtkKvqmkJb4RQZrG8irAmEH8cPRowSFwKJduHzBEmy9Ajd%2FI%2BNBV0QiEvhEiluDnBfV%2F%2FxqQNyvZI23Xt26lfUwNsRRufFN99%2FfafcRguCEQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d9daa774189-LHR
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
xngqoc.com/trt?a=1&t=435
0 B IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /trt?a=1&t=435 HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 17 Oct 2023 20:31:06 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
X-Firefox-Spdy: h2
banquetunarmedgrater.com/advertisers.js
200 OK 0 B URL GET HTTP/1.1 banquetunarmedgrater.com/advertisers.js
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertisers.js HTTP/1.1
Host: banquetunarmedgrater.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:06 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: max-age=172800
X-Request-ID: 4b1d65488c7126c62e3c32d242c4998a
Strict-Transport-Security: max-age=0; includeSubdomains
CF-Cache-Status: EXPIRED
Last-Modified: Tue, 17 Oct 2023 20:31:05 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vd1GtMtJyIYED9mNF7renSDMCIXNLwtkwMibnyiEUQq8jVIynN0jcH124vR%2BJ9RoUzwF9Tp0Xo3tNMstaqgddV%2FntSthr7GOAf0ZhHtpHZMVQrdDrK7SP7J8N6S70gFpA3%2FiDGGcr%2BPko1U%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 817b4d9d7c284885-LHR
alt-svc: h2=":443"; ma=60
amunfezanttor.com/event
200 OK 0 B IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2
amunfezanttor.com/event
200 OK 0 B IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2
amunfezanttor.com/event
200 OK 94 B IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectamunfezanttor.com
FingerprintD6:54:A1:23:39:A0:9A:41:5A:CC:0B:F2:C1:7C:6A:FA:F0:E8:C1:52
ValidityWed, 06 Sep 2023 01:33:39 GMT - Tue, 05 Dec 2023 01:33:38 GMT
File type JSON data\012- , ASCII text
Hash a08119211fc26d7a511a1cc7c5a7f022
2a8491787a95c162fd3f76086966d447500d1fb2
08cf207eccc3a98e8a2e0207fb057daee8a2112091d1c113a2e81c82a32ee5b3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: amunfezanttor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Content-Type: application/json
Content-Length: 529
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: application/json; charset=utf-8
content-length: 94
x-trace-id: 65526a2f5526b636965d896094ea1d67
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ptauxofi.net/pfe/current/defaultSkin.min.js
200 OK 20 kB URL GET HTTP/2 ptauxofi.net/pfe/current/defaultSkin.min.js
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectptauxofi.net
Fingerprint14:7A:67:00:65:9F:07:2C:77:F8:8B:02:7F:40:D7:92:5F:C2:5E:19
ValidityMon, 28 Aug 2023 05:08:25 GMT - Sun, 26 Nov 2023 05:08:24 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash 8fa0bb202b70b67e0ca5f867b6f42ec3
c078c096dfffef910d4eb7515e1ee91d1ed78abd
b118d6d392f011202a331934b71cc73415f22714b20802a5bcd8abd4c1be3835
GET /pfe/current/defaultSkin.min.js HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: application/javascript
last-modified: Tue, 17 Oct 2023 12:19:39 GMT
etag: W/"652e7bdb-df63"
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
ptauxofi.net/custom
200 OK 39 B IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectptauxofi.net
Fingerprint14:7A:67:00:65:9F:07:2C:77:F8:8B:02:7F:40:D7:92:5F:C2:5E:19
ValidityMon, 28 Aug 2023 05:08:25 GMT - Sun, 26 Nov 2023 05:08:24 GMT
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Content-Type: application/json
Content-Length: 722
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 08c91fefc3d695026913bb62ae7591bd
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ptauxofi.net/custom
200 OK 39 B IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectptauxofi.net
Fingerprint14:7A:67:00:65:9F:07:2C:77:F8:8B:02:7F:40:D7:92:5F:C2:5E:19
ValidityMon, 28 Aug 2023 05:08:25 GMT - Sun, 26 Nov 2023 05:08:24 GMT
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: ptauxofi.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Content-Type: application/json
Content-Length: 389
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 4fb2baef6ef028ef48a2c4455c11f85d
access-control-allow-origin: http://clkmein.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
prhzxq.com/wnrw?aid=51061172392575401&t=1697574665&a=1
0 B URL prhzxq.com/wnrw?aid=51061172392575401&t=1697574665&a=1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wnrw?aid=51061172392575401&t=1697574665&a=1 HTTP/1.1
Host: prhzxq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 17 Oct 2023 20:31:06 GMT
content-length: 0
access-control-allow-origin: http://clkmein.com
X-Firefox-Spdy: h2
img.cdn.house/i/1/lugYMbrvEbEj4av7heWjX-rbVXyCbI7ho2xclPbXlJxg8h4OsS56sF82XdL1aSHamL0aeER9VMMpfIm3g-jze__gB1ByDTKOE5QnU58bpUxlPS86FGMsGLRRYxCwiQVEndF1ZliqenWT1bxLjtDIevoFm6OAcYlcZ0S7UAc0zDMYYUGI
3.1 kB URL img.cdn.house/i/1/lugYMbrvEbEj4av7heWjX-rbVXyCbI7ho2xclPbXlJxg8h4OsS56sF82XdL1aSHamL0aeER9VMMpfIm3g-jze__gB1ByDTKOE5QnU58bpUxlPS86FGMsGLRRYxCwiQVEndF1ZliqenWT1bxLjtDIevoFm6OAcYlcZ0S7UAc0zDMYYUGI
IP
ASN #24940 Hetzner Online GmbH
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 6c4e96dfd8513607c6deeb3b743592f8
81361195e398cdb09619f05e4552782442623fbf
8887be4aa7cb3a603553c425688c989eadc63fa14a2edd6f43a24c58d59bfb6d
GET /i/1/lugYMbrvEbEj4av7heWjX-rbVXyCbI7ho2xclPbXlJxg8h4OsS56sF82XdL1aSHamL0aeER9VMMpfIm3g-jze__gB1ByDTKOE5QnU58bpUxlPS86FGMsGLRRYxCwiQVEndF1ZliqenWT1bxLjtDIevoFm6OAcYlcZ0S7UAc0zDMYYUGI HTTP/1.1
Host: img.cdn.house
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: image/webp
content-length: 3118
last-modified: Sun, 04 Dec 2022 00:41:43 GMT
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
accept-ranges: bytes
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=0826667673c6afa9f85340ed4fc8ef57&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
1 B URL unseenreport.com/pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=0826667673c6afa9f85340ed4fc8ef57&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=0826667673c6afa9f85340ed4fc8ef57&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:06 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 704960a1aff26b1a2006cabbbe4d2c11
Strict-Transport-Security: max-age=0; includeSubdomains
unseenreport.com/pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=34c6b37755370ea4318f4ff4946df449&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
1 B URL unseenreport.com/pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=34c6b37755370ea4318f4ff4946df449&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=8d1393d6-7c1b-4183-84df-cad1a026641b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2077&b_frame=0&pk=34c6b37755370ea4318f4ff4946df449&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=20 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:06 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 73baef5ff20727994e91630ac48f1510
Strict-Transport-Security: max-age=0; includeSubdomains
rabblespidersrenaissance.com/sbar.json?key=0826667673c6afa9f85340ed4fc8ef57&uuid=8d1393d6-7c1b-4183-84df-cad1a026641b%3A1%3A1
4.0 kB URL rabblespidersrenaissance.com/sbar.json?key=0826667673c6afa9f85340ed4fc8ef57&uuid=8d1393d6-7c1b-4183-84df-cad1a026641b%3A1%3A1
IP
ASN #39572 DataWeb Global Group B.V.
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (6320), with no line terminators
Hash f5eb82e6dda8ee75a4a89ee0c018c010
9b60c86e8ed74e645aa983b084b15d25eb77d948
03445c831d21c31af95cac72cc0f66c513ed86a5f5dc57a6ba43dabd098f0b06
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=0826667673c6afa9f85340ed4fc8ef57&uuid=8d1393d6-7c1b-4183-84df-cad1a026641b%3A1%3A1 HTTP/1.1
Host: rabblespidersrenaissance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:12 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: http://clkmein.com
Access-Control-Allow-Origin: http://clkmein.com
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=17078832; expires=Wed, 18 Oct 2023 20:31:11 GMT; secure; SameSite=None
uid_id2=8d1393d6-7c1b-4183-84df-cad1a026641b:1:1; expires=Tue, 24 Oct 2023 20:31:11 GMT; secure; SameSite=None
pdhtkv=true; expires=Wed, 18 Oct 2023 20:31:12 GMT; secure; SameSite=None
uncs=1; expires=Wed, 18 Oct 2023 20:31:12 GMT; secure; SameSite=None
pdhtkv29=true; expires=Wed, 18 Oct 2023 20:31:12 GMT; secure; SameSite=None
uncs29=1; expires=Wed, 18 Oct 2023 20:31:12 GMT; secure; SameSite=None
slec0826667673c6afa9f85340ed4fc8ef57=[4663322]; expires=Tue, 17 Oct 2023 20:31:17 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: dc6ce90ae908dee63745a6439285e98a
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
rabblespidersrenaissance.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAsIljBbGZmZ2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TFyU9Gjpfb0plaIL7abbuPix511qrMisHDQGUfhJGFxqmP6bntttuq83rgq2rhd813Ndz%2FUaS9KIRA8WPM9rupD5ftdrdt1m4De9doCB%2Bf9sSweWOuD9Y%2FICJJ88s38%2FgGRjZOmDK8KuFzp%2F4920VLTQBn2%2B92G2nukqQ3rWJsZBku2dqqHto6UfoLPdmWHo%2Fn%2FCWE6I88fviLO9U5eI%2B7snRmMFkSHmz6LqjyHUGJKOwfQtSP6IAIzj2iqy9O41bSq6ccLSKTshc08eQ1YTMvfbi8jS%2B4tKDho3tSoLqTOLQVJDDsaQvTHy8gDF5jnI6gCs%2BByS%2F0IWnqwgS3dWrdKQ%2FOjViHutbouH8x3mxfOBF7Xmo4An84xyj7p%2BGAZePEtIyjFkMoYSQ1DroJx%2B0kGZOChzByk%2FanRYEEU8anMqGPPjxIuSIAm6lLkJc1tdHyWb7jBEkQ%2FB1BDMbCE3W1iXQ5jyIexaDcsd2IKgz2tUgqCyBBUlqCRBVRBU%2FXqXK%2Bvb%2Bi5Xtoy90%2Bqf1lY90kVvm%2B7qoicysp0fk%2BenwTlzX7lYF0cNN%2FLDMOyEnRYLaUK7SdRuBa7gQcIikbQ7sLKGtOdma27KCbkweohcTsjT3%2F2DmB7AqgMw%2BQpo%2BTJoNer4LujaKIhcbGb37Jo2hWjaAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmQeNnMFMjNzU%2Bkz8R9NTt0Q1dkZ0burLk29W8kKncpNPL3ixoIea%2Bfk9sVNrw5St2eO9tNiWm7f4HwhYrNOMy61nyzaLkXJglbZgg3y%2Fbj0R8vbRri6XJynzl%2BjtLy2luhLVSZ2NQOSFk9BhMTsj5Lz%2BdvdrXkvOQZgxT1kjLQ3IKSH0Alm%2FB5oeX%2F0xmgNUERp1p4txBVdYj48dnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaedQQHRF2u4EbdLjrxgH3fa8tGG0FtEt9P%2BmgsBPR%2FOu5fwEAAP%2F%2FAQAA%2F%2F%2FoQ%2Bp8ggQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 rabblespidersrenaissance.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAsIljBbGZmZ2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TFyU9Gjpfb0plaIL7abbuPix511qrMisHDQGUfhJGFxqmP6bntttuq83rgq2rhd813Ndz%2FUaS9KIRA8WPM9rupD5ftdrdt1m4De9doCB%2Bf9sSweWOuD9Y%2FICJJ88s38%2FgGRjZOmDK8KuFzp%2F4920VLTQBn2%2B92G2nukqQ3rWJsZBku2dqqHto6UfoLPdmWHo%2Fn%2FCWE6I88fviLO9U5eI%2B7snRmMFkSHmz6LqjyHUGJKOwfQtSP6IAIzj2iqy9O41bSq6ccLSKTshc08eQ1YTMvfbi8jS%2B4tKDho3tSoLqTOLQVJDDsaQvTHy8gDF5jnI6gCs%2BByS%2F0IWnqwgS3dWrdKQ%2FOjViHutbouH8x3mxfOBF7Xmo4An84xyj7p%2BGAZePEtIyjFkMoYSQ1DroJx%2B0kGZOChzByk%2FanRYEEU8anMqGPPjxIuSIAm6lLkJc1tdHyWb7jBEkQ%2FB1BDMbCE3W1iXQ5jyIexaDcsd2IKgz2tUgqCyBBUlqCRBVRBU%2FXqXK%2Bvb%2Bi5Xtoy90%2Bqf1lY90kVvm%2B7qoicysp0fk%2BenwTlzX7lYF0cNN%2FLDMOyEnRYLaUK7SdRuBa7gQcIikbQ7sLKGtOdma27KCbkweohcTsjT3%2F2DmB7AqgMw%2BQpo%2BTJoNer4LujaKIhcbGb37Jo2hWjaAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmQeNnMFMjNzU%2Bkz8R9NTt0Q1dkZ0burLk29W8kKncpNPL3ixoIea%2Bfk9sVNrw5St2eO9tNiWm7f4HwhYrNOMy61nyzaLkXJglbZgg3y%2Fbj0R8vbRri6XJynzl%2BjtLy2luhLVSZ2NQOSFk9BhMTsj5Lz%2BdvdrXkvOQZgxT1kjLQ3IKSH0Alm%2FB5oeX%2F0xmgNUERp1p4txBVdYj48dnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaedQQHRF2u4EbdLjrxgH3fa8tGG0FtEt9P%2BmgsBPR%2FOu5fwEAAP%2F%2FAQAA%2F%2F%2FoQ%2Bp8ggQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectrabblespidersrenaissance.com
Fingerprint73:4E:26:17:C1:CF:AC:01:11:05:12:E6:14:6C:C3:91:DE:DB:06:DE
ValidityWed, 27 Sep 2023 00:59:44 GMT - Tue, 26 Dec 2023 00:59:43 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAsIljBbGZmZ2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TFyU9Gjpfb0plaIL7abbuPix511qrMisHDQGUfhJGFxqmP6bntttuq83rgq2rhd813Ndz%2FUaS9KIRA8WPM9rupD5ftdrdt1m4De9doCB%2Bf9sSweWOuD9Y%2FICJJ88s38%2FgGRjZOmDK8KuFzp%2F4920VLTQBn2%2B92G2nukqQ3rWJsZBku2dqqHto6UfoLPdmWHo%2Fn%2FCWE6I88fviLO9U5eI%2B7snRmMFkSHmz6LqjyHUGJKOwfQtSP6IAIzj2iqy9O41bSq6ccLSKTshc08eQ1YTMvfbi8jS%2B4tKDho3tSoLqTOLQVJDDsaQvTHy8gDF5jnI6gCs%2BByS%2F0IWnqwgS3dWrdKQ%2FOjViHutbouH8x3mxfOBF7Xmo4An84xyj7p%2BGAZePEtIyjFkMoYSQ1DroJx%2B0kGZOChzByk%2FanRYEEU8anMqGPPjxIuSIAm6lLkJc1tdHyWb7jBEkQ%2FB1BDMbCE3W1iXQ5jyIexaDcsd2IKgz2tUgqCyBBUlqCRBVRBU%2FXqXK%2Bvb%2Bi5Xtoy90%2Bqf1lY90kVvm%2B7qoicysp0fk%2BenwTlzX7lYF0cNN%2FLDMOyEnRYLaUK7SdRuBa7gQcIikbQ7sLKGtOdma27KCbkweohcTsjT3%2F2DmB7AqgMw%2BQpo%2BTJoNer4LujaKIhcbGb37Jo2hWjaAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmQeNnMFMjNzU%2Bkz8R9NTt0Q1dkZ0burLk29W8kKncpNPL3ixoIea%2Bfk9sVNrw5St2eO9tNiWm7f4HwhYrNOMy61nyzaLkXJglbZgg3y%2Fbj0R8vbRri6XJynzl%2BjtLy2luhLVSZ2NQOSFk9BhMTsj5Lz%2BdvdrXkvOQZgxT1kjLQ3IKSH0Alm%2FB5oeX%2F0xmgNUERp1p4txBVdYj48dnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaedQQHRF2u4EbdLjrxgH3fa8tGG0FtEt9P%2BmgsBPR%2FOu5fwEAAP%2F%2FAQAA%2F%2F%2FoQ%2Bp8ggQAAA%3D%3D HTTP/1.1
Host: rabblespidersrenaissance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Cookie: u_pl=17078832; uid_id2=8d1393d6-7c1b-4183-84df-cad1a026641b:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; slec0826667673c6afa9f85340ed4fc8ef57=[4663322]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:12 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2348ed8daec3b410ebf729d8186615df
Strict-Transport-Security: max-age=0; includeSubdomains
clkmein.com/shortest-url/end-adsession?adSessionId=7e82778a205986d6e8b21245366900e3ac502879&adbd=0&callback=reqwest_1697574665547
125 B URL clkmein.com/shortest-url/end-adsession?adSessionId=7e82778a205986d6e8b21245366900e3ac502879&adbd=0&callback=reqwest_1697574665547
IP
File type ASCII text, with no line terminators
Hash a23659c52854ef135d9a26f83bec9b5f
117a2a132f1e300481646829787f71858eb9973e
b4c0193e1e806ef13da617643baf2aa77d82d982c815637e15f7889925501bcb
GET /shortest-url/end-adsession?adSessionId=7e82778a205986d6e8b21245366900e3ac502879&adbd=0&callback=reqwest_1697574665547 HTTP/1.1
Host: clkmein.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Cookie: cookies-enable=1; hl=en; dom3ic8zudi28v8lr6fgphwffqoz0j6c=8d1393d6-7c1b-4183-84df-cad1a026641b%3A1%3A1; _gcl_au=1.1.1175278278.1697574666; ppu_main_34c6b37755370ea4318f4ff4946df449=1; sb_main_0826667673c6afa9f85340ed4fc8ef57=1; sb_count_0826667673c6afa9f85340ed4fc8ef57=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=rabblespidersrenaissance.com
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 17 Oct 2023 20:31:12 GMT
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.40-0+deb8u16
Set-Cookie: PHPSESSID=dfjlnbija361ckd6qgjmvq69f0; expires=Tue, 17-Oct-2023 21:31:12 GMT; Max-Age=3600; path=/; domain=.shorte.st; HttpOnly
referrer_url=http%3A%2F%2Fclkmein.com%2FQio8n652eeee9d36d1AMVHdkKtBC0nf%3Fr%3D; expires=Wed, 18-Oct-2023 20:31:12 GMT; Max-Age=86400; path=/; httponly
cookies-enable=1; path=/; httponly
Cache-Control: no-cache
X-Server-ID: shn08
X-UA-Compatible: IE=Edge
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hPsrXyBkM9F6LLMPJ2JFiyBW1q9a955NquUvwchQAzgurjy0SMPxQ19odp3bL9snVPgAYJf%2BAQWQ6%2F8Ps7mhVrebieHMEwKXKBMwKwDybZXbx2nqOIpE4WK1OZdz"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 817b4dc4fb89569f-OSL
Content-Encoding: gzip
xdiwbc.com/template/social.html
2.2 kB URL xdiwbc.com/template/social.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4579), with no line terminators
Hash 56d978d63c451d50308e9730f97673e4
72bf07d65dc53fa6d4e27aced10ce40e9549a456
e4aaa8b864033f10089ecbbc1023817b1968fe72fb17398564429c7f07796c80
GET /template/social.html HTTP/1.1
Host: xdiwbc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://clkmein.com/
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: http://clkmein.com
cache-control: max-age=14400
cf-cache-status: EXPIRED
last-modified: Tue, 17 Oct 2023 15:09:58 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qxa3syIMQh%2BB7cQY%2BzvuLlv6vZlOjZvCDMRe4J7QfAB%2FpxMHkayIfPgj6jU8Qoyojf%2F4degKWssK29O8OT1bftO%2BAilwoNX2f%2FeLDuPJUIAeCMFMeYpWJWWBD9Fa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 817b4d9eabecb4f7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/img/close.png
200 OK 591 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/img/close.png
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced\012- data
Hash 9fd5bcb6103d86e317bd1eb019bcbe71
6b5a52ea669dcb74946f2bed4bdd7ec985026113
0ddd3be104ac7945fb062096df62034a6a24ecc76ba92493c35c62c3c25982ae
GET /sb/ssp/vpn/classic-push/big1/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: image/png
content-length: 591
last-modified: Mon, 21 Feb 2022 10:06:44 GMT
etag: "62136434-24f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 4593591
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M1QO5lgbtBSSP67OYrKS3w1Ow4XOrkviCOY9XJwhmOdzCCNYJfuJKmSX2ohcdIlhkWJwFuZFE5eunh0tjB4Qp0QaFkbb1eAyQsaPeHaVKo3CR4herkL2KElpo1khLYqAjyqVDTOgKyc9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 817b4dc70e7571ea-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html
200 OK 478 B URL GET HTTP/2 cdn.barscreative1.com/sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
FingerprintCB:0F:87:85:B0:83:8B:5C:86:E5:81:91:9D:F5:ED:C4:A2:B6:B1:BE
ValidityTue, 12 Sep 2023 01:01:21 GMT - Mon, 11 Dec 2023 01:01:20 GMT
File type HTML document text\012- HTML document, ASCII text
Hash 5a7df8dcac4cde2aeadb9f07a622d3fa
4044f12fce935458c93ef71de58ac6bf97b28bba
ccec003eccd7e299f825c7e48ba721d529f1c110bb5b60c60a18dca61cb6b45a
GET /sb/au/48/48/eb/4848ebd6f7295875a5d388ec2488aba3/1648542421.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Tue, 29 Mar 2022 08:27:10 GMT
etag: W/"6242c2de-602"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Tue, 17 Oct 2023 21:31:12 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/bb/8f/55/bb8f559a2bb12d6d6e7d67f443176e76/1686846286.png
11 kB URL cdn.cloudimagesb.com/si/bb/8f/55/bb8f559a2bb12d6d6e7d67f443176e76/1686846286.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash f0ccba8be07296564ea5c3ce0a3dc8e1
e6f83b5be04683c793055718a59666268c98a77f
9e77cb37b2774c2ed298366221a67bbc0e01eb7e32fb6d93cedbb6a334337366
GET /si/bb/8f/55/bb8f559a2bb12d6d6e7d67f443176e76/1686846286.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: image/png
content-length: 11192
server: nginx/1.21.6
last-modified: Thu, 15 Jun 2023 16:24:54 GMT
etag: "648b3b56-2bb8"
expires: Thu, 19 Oct 2023 20:31:12 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/d2/37/65/d23765ffe89ea2849f1cc1ac5370c439/1697199722.png
200 OK 36 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/d2/37/65/d23765ffe89ea2849f1cc1ac5370c439/1697199722.png
IP
ASN #39572 DataWeb Global Group B.V.
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint62:DE:BA:BA:30:E9:EE:15:E9:24:B9:C5:BF:E1:7E:39:8B:20:E5:42
ValiditySun, 24 Sep 2023 23:04:02 GMT - Sat, 23 Dec 2023 23:04:01 GMT
File type PNG image data, 320 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash 393c8e39211e41c25bb34edc1bce3d22
b0970d5bd74d77e040736ec9a69e6d2e721aee21
1b803a9cc659ab634aca26cfd069bafe7b62fe395e9927233fff30c598312743
GET /si/d2/37/65/d23765ffe89ea2849f1cc1ac5370c439/1697199722.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: image/png
content-length: 36072
server: nginx/1.21.6
last-modified: Fri, 13 Oct 2023 12:22:10 GMT
etag: "65293672-8ce8"
expires: Thu, 19 Oct 2023 20:31:12 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
16 kB URL fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint24:E0:20:DC:DE:E3:A8:D9:A8:17:BA:26:F5:41:32:19:98:D0:30:F3
ValidityMon, 18 Sep 2023 08:25:05 GMT - Mon, 11 Dec 2023 08:25:04 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15860
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 14 Oct 2023 11:01:13 GMT
Expires: Sun, 13 Oct 2024 11:01:13 GMT
Cache-Control: public, max-age=31536000
Age: 293400
Last-Modified: Wed, 11 May 2022 19:24:42 GMT
Content-Type: font/woff2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/1.1 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15744
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 12 Oct 2023 15:28:52 GMT
Expires: Fri, 11 Oct 2024 15:28:52 GMT
Cache-Control: public, max-age=31536000
Age: 450141
Last-Modified: Wed, 11 May 2022 19:24:48 GMT
Content-Type: font/woff2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/animate.css
4.9 kB URL cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/css/animate.css
IP
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
Hash e1d8acd5ee9d1a90ea09313cbd8f2b02
8a8327b115d1356715e63270d1ce6d46124c7b1a
3028c87fc798ac3741f02079034e6c23462afc0c5e6c8d321188ce3716c8472a
GET /sb/ssp/vpn/classic-push/big1/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://clkmein.com
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: text/css
last-modified: Mon, 21 Feb 2022 10:06:42 GMT
etag: W/"62136432-13591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fJLSiby3WKR5ksj5xVroCZ7COSxSq3Q9Q2rQMuYoNFh1PFR08Mn5pgwdcDwZEDUeJuRYDeoHzUj05K%2BMyl9jRZ15gNApOohpxQr9CIhznD0mXdnfLpM5Bd%2BXhPVbK4erEmjhUPqEuY4p"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 817b4dc6de3571ea-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
rabblespidersrenaissance.com/pixel/sbs?c=1
200 OK 0 B URL GET HTTP/1.1 rabblespidersrenaissance.com/pixel/sbs?c=1
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectrabblespidersrenaissance.com
Fingerprint73:4E:26:17:C1:CF:AC:01:11:05:12:E6:14:6C:C3:91:DE:DB:06:DE
ValidityWed, 27 Sep 2023 00:59:44 GMT - Tue, 26 Dec 2023 00:59:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: rabblespidersrenaissance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Cookie: u_pl=17078832; uid_id2=8d1393d6-7c1b-4183-84df-cad1a026641b:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; slec0826667673c6afa9f85340ed4fc8ef57=[4663322]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:13 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 6.8 kB URL GET HTTP/1.1 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
File type ASCII text, with very long lines (6992), with no line terminators
Hash ec5129b372c275aa9bf89c50f312613d
8e75535bebc8e2ec4579424b4e9505500300eac9
91a09ee6f5574dc9630b63e8d1e8e1ae26442cb7ce32b1576c4c20af5d6f858d
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Tue, 17 Oct 2023 20:31:12 GMT
Date: Tue, 17 Oct 2023 20:31:12 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/jquery.min.js
200 OK 84 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/big1/js/jquery.min.js
IP
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /sb/ssp/vpn/classic-push/big1/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Oct 2023 20:31:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Feb 2022 10:06:46 GMT
etag: W/"62136436-1499c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 21040752
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WyRgSCsruH5oqfiQv2cf22OYhZAv8G0uR2slk%2F83B%2B7DOAGJQESqLp9nY%2FF0mw8aaBd2fwiM0vErD3OKwna%2B5DJ6P0Mbojry4HexmDOhQb3k7YsQHNMpwcBuirhO%2FqdkDbrrQbuaRxLx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 817b4dc71e8071ea-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ubbfpm.com/ms/1102360/inpage.js
200 OK 201 kB URL GET HTTP/1.1 ubbfpm.com/ms/1102360/inpage.js
IP
ASN #24940 Hetzner Online GmbH
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectubbfpm.com
Fingerprint1E:4B:A4:8C:E2:91:80:43:6C:B3:50:65:93:46:BA:28:2C:C9:3F:8E
ValidityTue, 26 Sep 2023 10:15:34 GMT - Mon, 25 Dec 2023 10:15:33 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 201 kB (200738 bytes)
Hash af413834dffb762ffcfa6c20ce98ad42
1cc019785a20cf05f8804da008409a6ed8ba4a72
37800f9f2bb9d6543c17667dca9695da535d5b01fcf095db9d20d9782f1d22d0
GET /ms/1102360/inpage.js HTTP/1.1
Host: ubbfpm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 17 Oct 2023 20:31:04 GMT
Content-Type: application/javascript
Content-Length: 200738
Last-Modified: Fri, 21 Apr 2023 15:45:14 GMT
Connection: keep-alive
ETag: "6442af8a-31022"
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Referrer-Policy: strict-origin
Accept-Ranges: bytes
rabblespidersrenaissance.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAMIljBbGZ2Z2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TDyU9Gjpfb0plaIL7YbnXvzY9y%2B5KzIrB%2B4gCj8Jg0uu6b%2Fpe92G97p7VbB1vdD0fM%2FzPd9dkkYkerDg%2B37Dg8z3u36j6zWCZsNvBxiY%2F8%2B2dGCpA94%2FJi9A8skz%2B%2FcDSDZGlj64Iux6ofM33k1LRQtt0Od7H2brma4ypGdtYhwk2d6pGto%2BWvoBOtudGYbu%2FyeM5YQ4f%2FyOONs7dYm4v3tiNFYQGWL%2BLKr%2BGEKNIekYTN%2BC5I8IwDiurSJL717TpqIbJyydshMy9%2BQxZDUhc7%2B9iCy9v6jkwL2pVVlInVkMkhpyMIbsjZGXByg2z0FWB2DF55D8F7LwZAVZurNqlYbkR69G3G91Wzyc7zA%2Fng%2F8qDUfBTyZZ5T71GuGYeDHs4SkHEMmYygxBLUOyuknHZSJgzJ3kPIjt8OCKOJRm1PBWDNO%2FCgJkqBLmZcwr9VtomTTHYYo8iGYGoKZLeRmC%2BtyCFM%2BhF2rYbkDWxD0eY1KEFSWoKIElSSoCoKqX%2B9yZZu2vsuVLWP%2FtDZPa6se6aK3TXd10RMZ2c6PyfPT4Jy5rzysiyPXi5phGHbCTouFNKHdJGq3Ak%2FwIGGRSNodWFlD2nOzNTflhFwYPUQuJ%2BTp7%2F5BTA9g1QGYfAW0fBm0GnWaHujaKIg8bGb37Jo2hWjYAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmgfszmKmRmxqfyZ8Ieur26IauyM4NXVny7WpeyFRu0ullbxa0EHNfvyc2Km348hU7vPc2mxLTdv8DYYsVmnGZ9Sz5ZlFyLsySNkyQ75ftRyK%2BXtq1xdJkZb5y%2FZ2l5TQ3wlqpszGonBAyegwmJ%2BT8l5%2FOXu1ryXlIM4Ypa6TlITkFpD4Ay7dg88PLfyYzwGoCo840ce6gKuuRacZnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaeeQy5gnqxx1fCC7aLcaCkEVxmLSCjojavI3CTkTjr%2Bf%2BBQAA%2F%2F8BAAD%2F%2FxdkQmyCBAAA
200 OK 0 B URL GET HTTP/1.1 rabblespidersrenaissance.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAMIljBbGZ2Z2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TDyU9Gjpfb0plaIL7YbnXvzY9y%2B5KzIrB%2B4gCj8Jg0uu6b%2Fpe92G97p7VbB1vdD0fM%2FzPd9dkkYkerDg%2B37Dg8z3u36j6zWCZsNvBxiY%2F8%2B2dGCpA94%2FJi9A8skz%2B%2FcDSDZGlj64Iux6ofM33k1LRQtt0Od7H2brma4ypGdtYhwk2d6pGto%2BWvoBOtudGYbu%2FyeM5YQ4f%2FyOONs7dYm4v3tiNFYQGWL%2BLKr%2BGEKNIekYTN%2BC5I8IwDiurSJL717TpqIbJyydshMy9%2BQxZDUhc7%2B9iCy9v6jkwL2pVVlInVkMkhpyMIbsjZGXByg2z0FWB2DF55D8F7LwZAVZurNqlYbkR69G3G91Wzyc7zA%2Fng%2F8qDUfBTyZZ5T71GuGYeDHs4SkHEMmYygxBLUOyuknHZSJgzJ3kPIjt8OCKOJRm1PBWDNO%2FCgJkqBLmZcwr9VtomTTHYYo8iGYGoKZLeRmC%2BtyCFM%2BhF2rYbkDWxD0eY1KEFSWoKIElSSoCoKqX%2B9yZZu2vsuVLWP%2FtDZPa6se6aK3TXd10RMZ2c6PyfPT4Jy5rzysiyPXi5phGHbCTouFNKHdJGq3Ak%2FwIGGRSNodWFlD2nOzNTflhFwYPUQuJ%2BTp7%2F5BTA9g1QGYfAW0fBm0GnWaHujaKIg8bGb37Jo2hWjYAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmgfszmKmRmxqfyZ8Ieur26IauyM4NXVny7WpeyFRu0ullbxa0EHNfvyc2Km348hU7vPc2mxLTdv8DYYsVmnGZ9Sz5ZlFyLsySNkyQ75ftRyK%2BXtq1xdJkZb5y%2FZ2l5TQ3wlqpszGonBAyegwmJ%2BT8l5%2FOXu1ryXlIM4Ypa6TlITkFpD4Ay7dg88PLfyYzwGoCo840ce6gKuuRacZnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaeeQy5gnqxx1fCC7aLcaCkEVxmLSCjojavI3CTkTjr%2Bf%2BBQAA%2F%2F8BAAD%2F%2FxdkQmyCBAAA
IP
ASN #39572 DataWeb Global Group B.V.
Requested by http://clkmein.com/Qio8n652eeee9d36d1AMVHdkKtBC0nf?r=
Certificate IssuerLet's Encrypt
Subjectrabblespidersrenaissance.com
Fingerprint73:4E:26:17:C1:CF:AC:01:11:05:12:E6:14:6C:C3:91:DE:DB:06:DE
ValidityWed, 27 Sep 2023 00:59:44 GMT - Tue, 26 Dec 2023 00:59:43 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSQWgcVRh%2BU%2BNFKah4qSAMIljBbGZ2Z2dn7aEaa0owNqVV9KZv3nuzeebNvOG9mZ1NTsGCFLxsr54m3yYN1VDqzYtaNnoKCF1POZiDoFeFQk8eZDfB4AfD%2F%2F%2FzfYfv%2F%2F73xXZ5TDyU9Gjpfb0plaIL7YbnXvzY9y%2B5KzIrB%2B4gCj8Jg0uu6b%2Fpe92G97p7VbB1vdD0fM%2FzPd9dkkYkerDg%2B37Dg8z3u36j6zWCZsNvBxiY%2F8%2B2dGCpA94%2FJi9A8skz%2B%2FcDSDZGlj64Iux6ofM33k1LRQtt0Od7H2brma4ypGdtYhwk2d6pGto%2BWvoBOtudGYbu%2FyeM5YQ4f%2FyOONs7dYm4v3tiNFYQGWL%2BLKr%2BGEKNIekYTN%2BC5I8IwDiurSJL717TpqIbJyydshMy9%2BQxZDUhc7%2B9iCy9v6jkwL2pVVlInVkMkhpyMIbsjZGXByg2z0FWB2DF55D8F7LwZAVZurNqlYbkR69G3G91Wzyc7zA%2Fng%2F8qDUfBTyZZ5T71GuGYeDHs4SkHEMmYygxBLUOyuknHZSJgzJ3kPIjt8OCKOJRm1PBWDNO%2FCgJkqBLmZcwr9VtomTTHYYo8iGYGoKZLeRmC%2BtyCFM%2BhF2rYbkDWxD0eY1KEFSWoKIElSSoCoKqX%2B9yZZu2vsuVLWP%2FtDZPa6se6aK3TXd10RMZ2c6PyfPT4Jy5rzysiyPXi5phGHbCTouFNKHdJGq3Ak%2FwIGGRSNodWFlD2nOzNTflhFwYPUQuJ%2BTp7%2F5BTA9g1QGYfAW0fBm0GnWaHujaKIg8bGb37Jo2hWjYAlzXyIs5FBvOtjomF2bXu3rxJQh2%2BNa5O2vmgfszmKmRmxqfyZ8Ieur26IauyM4NXVny7WpeyFRu0ullbxa0EHNfvyc2Km348hU7vPc2mxLTdv8DYYsVmnGZ9Sz5ZlFyLsySNkyQ75ftRyK%2BXtq1xdJkZb5y%2FZ2l5TQ3wlqpszGonBAyegwmJ%2BT8l5%2FOXu1ryXlIM4Ypa6TlITkFpD4Ay7dg88PLfyYzwGoCo840ce6gKuuRacZnP5UkUOJspnENK85CiMXhj3%2BfcNv2NnrGAS1uIUtr9E2NvqpB1RC2fGpU5Obw8q%2BtGRArZxQr4%2BzEyqg7J%2BFaeeQy5gnqxx1fCC7aLcaCkEVxmLSCjojavI3CTkTjr%2Bf%2BBQAA%2F%2F8BAAD%2F%2FxdkQmyCBAAA HTTP/1.1
Host: rabblespidersrenaissance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://clkmein.com/
Cookie: u_pl=17078832; uid_id2=8d1393d6-7c1b-4183-84df-cad1a026641b:1:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; slec0826667673c6afa9f85340ed4fc8ef57=[4663322]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Tue, 17 Oct 2023 20:31:13 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 359fc46094c2f1c55d629dbd5b4830a1
Strict-Transport-Security: max-age=0; includeSubdomains
172.67.74.33
172.255.6.145
185.162.85.3
3.73.202.184
95.216.206.230
0.0.0.0