flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
188.114.96.1200 OK 161 kB URL GET HTTP/2 flowhot.cc/wp-content/uploads/2019/11/promo.jpeg
IP 188.114.96.1:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Macintosh), datetime=2019:11:21 20:13:11], progressive, precision 8, 900x250, components 3
- data
Size 161 kB (160863 bytes)
Hash f66cbb86803abd9d9f37a1588f14d5fd
c38f678cea2edc798d223b0c57f3b6c6b4acb008
ee089d909a7461ab0f483151883331e191c18f0a1db138a4bba12d82330287a1
GET /wp-content/uploads/2019/11/promo.jpeg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: image/jpeg
content-length: 160863
cache-control: public, max-age=31536000
expires: Sun, 07 Jan 2024 23:56:47 GMT
last-modified: Fri, 22 Nov 2019 02:34:58 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 105267
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x1DiDNnOvcu16pNP7tSDhTDep2Jso9evAi%2F4mssEHnIy8jl6hnCZvfze4SVtNQ%2B7XwVWPgg%2FA7dFOBzezSZaNCNtbWu0ErwiHvv7%2B0FaXcwYvjZUhbKwARSYfO%2FY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc744ce0b518-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
code.jquery.com/jquery-3.4.1.js
151.101.66.137200 OK 83 kB URL GET HTTP/2 code.jquery.com/jquery-3.4.1.js
IP 151.101.66.137:443
Requested by https://635425.flowhot.cc/
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
Hash 11c05eb286ed576526bf4543760785b9
7faa15a054093f3b5d674e63b6567c835a6fa217
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
GET /jquery-3.4.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4472c"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sun, 10 Dec 2023 05:11:15 GMT
age: 7382874
x-served-by: cache-lga21923-LGA, cache-bma1640-BMA
x-cache: HIT, HIT
x-cache-hits: 18, 28846
x-timer: S1702185076.934918,VS0,VE0
vary: Accept-Encoding
content-length: 82889
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=UA-922266-5
142.250.74.168200 OK 69 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-922266-5
IP 142.250.74.168:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintC1:58:7C:BF:5A:61:79:08:CB:C2:00:63:60:07:86:BD:EA:0A:45:8A
ValidityMon, 20 Nov 2023 08:02:50 GMT - Mon, 12 Feb 2024 08:02:49 GMT
File type ASCII text, with very long lines (4179)
Hash 0f80325ec190517d9fbf319aa73af86a
4088b7d030ed0b890feda2bb674798079acb160b
0dfaf5331a0f47e608af682c214bcc89723ccd8a4c7608ffe29bf7624446cac9
GET /gtag/js?id=UA-922266-5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 10 Dec 2023 05:11:15 GMT
expires: Sun, 10 Dec 2023 05:11:15 GMT
cache-control: private, max-age=900
last-modified: Sun, 10 Dec 2023 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 68982
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
flowhot.cc/wp-content/uploads/2022/11/Anuel%20AA%20%E2%80%93%20LLNM2%20(2022)-300x300.jpg
188.114.96.1200 OK 13 kB URL GET HTTP/2 flowhot.cc/wp-content/uploads/2022/11/Anuel%20AA%20%E2%80%93%20LLNM2%20(2022)-300x300.jpg
IP 188.114.96.1:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 300x300, components 3
- data
Hash b4e686348ce1824a6f407519503f8e4e
a34c8e53d548d87ac48cb750598908ae16eb964d
623fc38dca1cdded53614ee471e5966553c2d00db9a1e6224cafa70a3a3385cd
GET /wp-content/uploads/2022/11/Anuel%20AA%20%E2%80%93%20LLNM2%20(2022)-300x300.jpg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: image/jpeg
content-length: 13391
cache-control: public, max-age=31536000
expires: Tue, 09 Jan 2024 05:11:15 GMT
last-modified: Sat, 26 Nov 2022 22:14:25 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UEXTLfc02gt7mnp4LDyICjYi4PtPzhpDMQmS%2FCiiROOlNGxeSyGI6%2BR6L0WK9c3VuFC4DPw%2BUABprKzptmmg5TvkVJBD6OyOWU5idz57L%2F6vlaDLUp0Tem%2Famojd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc744cdeb518-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
173.233.137.36200 OK 15 kB URL GET HTTP/1.1 finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js
IP 173.233.137.36:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectfinallytrained.com
Fingerprint8F:A1:2B:2D:3A:32:A7:71:00:73:CC:06:43:01:E1:62:6F:57:F2:4F
ValiditySat, 04 Nov 2023 06:34:02 GMT - Fri, 02 Feb 2024 06:34:01 GMT
File type ASCII text, with very long lines (42321), with no line terminators
Hash a5513c40c663312679c7c27033fd61f2
b0be0a6d979856ed141c65d3085b755234ecba92
d6699e74a1c7b6a46a947c6f8530b458e0341bb32a2af0dd1be852291a91b9ee
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /06/33/56/0633569b5e7b7ced877cf02d43663712.js HTTP/1.1
Host: finallytrained.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 10 Dec 2023 05:11:16 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ea1d93ed786dd41a53a4dff98855ebb1
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
142.250.74.168200 OK 81 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c
IP 142.250.74.168:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintC1:58:7C:BF:5A:61:79:08:CB:C2:00:63:60:07:86:BD:EA:0A:45:8A
ValidityMon, 20 Nov 2023 08:02:50 GMT - Mon, 12 Feb 2024 08:02:49 GMT
File type ASCII text, with very long lines (5955)
Hash 7c4b313d3c9cb487bcdd78e0f7879ce5
bd0e87fbb50ca6469b05eb6cf154784b621ca11a
d237817570deac01937a8204bc2981f8d73538a18671e8b197fddaddb8c2e1b0
GET /gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 10 Dec 2023 05:11:16 GMT
expires: Sun, 10 Dec 2023 05:11:16 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 81200
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
proftrafficcounter.com/stats
18.157.140.81200 OK 40 B URL GET HTTP/2 proftrafficcounter.com/stats
IP 18.157.140.81:443
Requested by https://635425.flowhot.cc/
Certificate IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash d84610f826bcd64fce41dc49e8f6108c
95d535eae64a98619d0a36262fa0630d5e854846
425ef44ba1277705959625bd6b1abf5eae942fa3c07f648aef4b83301ea4fb86
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://635425.flowhot.cc
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=53e8f738-ee40-4eed-bdae-a5f9c039608d:3:1; expires=Wed, 07 Dec 2033 05:11:16 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
104.18.11.207200 OK 18 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
IP 104.18.11.207:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 18028, version 1.589
- data
Hash 448c34a56d699c29117adc64c43affeb
ca35b697d99cae4d1b60f2d60fcd37771987eb07
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
GET /bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: font/woff2
content-length: 18028
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "448c34a56d699c29117adc64c43affeb"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 09/21/2023 16:48:19
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1053
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 303fbb4d3d58287858d3a74ceb09c8fa
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8332fc7a7c8b56c5-OSL
alt-svc: h3=":443"; ma=86400
notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0
139.45.240.92200 OK 318 B URL GET HTTP/2 notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0
IP 139.45.240.92:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type JSON data
- , ASCII text, with very long lines (318), with no line terminators
Hash 82b0c0f76512e60ea030da09ee18febf
2c4b11e5713c2f7e6a3da2ef87a1c0c78c3da195
a8ca49249ca90a131bba14405671cb243da2849145a3d8074b0b5c232c2b57d1
GET /settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.0 HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://635425.flowhot.cc/
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: application/json; charset=utf-8
content-length: 318
access-control-allow-origin: https://635425.flowhot.cc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
104.21.234.32200 OK 104 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP 104.21.234.32:443
Requested by https://635425.flowhot.cc/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Size 104 kB (104282 bytes)
Hash 924e967bca1d599992556a8d139b1c5a
222b09dbf164ddc03d39100fd0524a22018d28b2
ac84c2f8288b59f8e04ba77287ce696052bfeee0d462a566d94dc305df646c95
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: cd7801f8d3e37c3f45ad939fee555b26
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sun, 10 Dec 2023 05:11:16 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FcicDLJ6saCzBf9eL2UyS5TxEinI2vFII%2F7ezeD1rX%2B%2FaX1dQESlj8HZATdFMQrgTb2keHbdEtx6PlgHYba9jOsqdGLD3AQGupJgVEH0Vuz65Ex0S2jbEtHJPDuAlT6atvoIqcI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc780d7dd947-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
guiltjadechances.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
173.233.137.52200 OK 25 kB URL GET HTTP/1.1 guiltjadechances.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js
IP 173.233.137.52:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectguiltjadechances.com
Fingerprint3A:ED:6D:08:9E:E4:8A:F1:85:AA:C0:6A:10:B9:CB:78:38:E1:5B:BD
ValidityMon, 27 Nov 2023 07:55:00 GMT - Sun, 25 Feb 2024 07:54:59 GMT
File type ASCII text, with very long lines (62901)
Hash ce8203f70d12d742729333edd927299c
2028fe4df528d4c70ac020d6d2d26852e7a757e3
29c1fba48672c88043ad220be43488d33e9d48586c12aea48fe04e36e4bd6281
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js HTTP/1.1
Host: guiltjadechances.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 10 Dec 2023 05:11:16 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_CF-2805_1=1; expires=Wed, 13 Dec 2023 13:11:16 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6bd3fe1aa4c4f173e42cbb9592ac2b85
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
interbasevideopregnant.com/pixel/purst?dl=0&th=0&sc=0&rs=1868&rd=1868&fd=693&bv=23.12.v.2&tmpl=136
173.233.137.52200 OK 0 B URL GET HTTP/1.1 interbasevideopregnant.com/pixel/purst?dl=0&th=0&sc=0&rs=1868&rd=1868&fd=693&bv=23.12.v.2&tmpl=136
IP 173.233.137.52:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectinterbasevideopregnant.com
Fingerprint05:CE:54:0F:E3:69:0F:FA:81:8B:E1:49:7E:A8:C7:B9:AD:FA:67:8F
ValidityTue, 28 Nov 2023 10:51:51 GMT - Mon, 26 Feb 2024 10:51:50 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=1868&rd=1868&fd=693&bv=23.12.v.2&tmpl=136 HTTP/1.1
Host: interbasevideopregnant.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 10 Dec 2023 05:11:17 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
guiltjadechances.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712
192.243.59.12200 OK 4.3 kB URL GET HTTP/1.1 guiltjadechances.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712
IP 192.243.59.12:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectguiltjadechances.com
Fingerprint3A:ED:6D:08:9E:E4:8A:F1:85:AA:C0:6A:10:B9:CB:78:38:E1:5B:BD
ValidityMon, 27 Nov 2023 07:55:00 GMT - Sun, 25 Feb 2024 07:54:59 GMT
File type JSON data
- , ASCII text, with very long lines (6100), with no line terminators
Hash 29ded110c14aa876ecdf232f0bbf482b
d7daa0322b74bab1d8b1187b920526bdf6fc9b14
e464cc776198d5530c64090b01b7836233019bcc1c1aa152a37a316da19b4284
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=0633569b5e7b7ced877cf02d43663712 HTTP/1.1
Host: guiltjadechances.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 10 Dec 2023 05:11:17 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://635425.flowhot.cc
Access-Control-Allow-Origin: https://635425.flowhot.cc
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=19408177; expires=Mon, 11 Dec 2023 05:11:17 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 11 Dec 2023 05:11:17 GMT; secure; SameSite=None
uncs=1; expires=Mon, 11 Dec 2023 05:11:17 GMT; secure; SameSite=None
pdhtkv29=true; expires=Mon, 11 Dec 2023 05:11:17 GMT; secure; SameSite=None
uncs29=1; expires=Mon, 11 Dec 2023 05:11:17 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: dc803701abc2ec38efc5f2424806998b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
guiltjadechances.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS5iBJl0z8%2BMe1iMazQYk7gbybm6qnpSprqqqeqanswpuCB7HG8eO59JNuguYq6CIBMvEhB2PEgO5uJ%2FoLBnmcnA6IOq9159HtTn89778thfkwieXu18YgZSKbrSrIaV5T2puSlcZWu3EoXV8E5lT%2BpW406lP71s790obFbDtysfCnZgVmphFIZRGFXWpRWJ6a%2FMUMjsaSeqdsJqo1aNmg307X9z5wM4GoD3rslLkHzyv%2F1fziHZGDr9%2Fp5wB7nJ3vkg9YrmxqLHzz7TB9oUGukiTGyARJ%2FNq2HchJCvb8Hos7kCmN7JVAFiOSHB7xFifTanibh3esM0VhAaMf8%2Fit4YQo0h6RjMPITkzwjAOLa2odPHW8YW9PAGpVN0Qpae%2Fw1ZTMjSH69Ap9%2BtKdmvPDDK59Joh35SQvbHkN0xMn%2BBfBBAFhdg%2BReQ%2FFey8nwTOj3ZdspA8nKmXsoxZDKGEkNQF8BPjwzgkwA%2BC5DyqwptdpIwbCdxUq%2BvNhhj9TpjzdUWb%2FJ6YzUJ4dmU3hB5NgRTQzB7hMwe4UAOYf1PcPslHA%2Fg8gkJPj1Cj5coBEHhCApKUEiCIicoeuUpV67mysdcOR9Hc1%2Bb%2B3o5Mnn3mJ6avCs0AbXD4%2ByavDjtTbD8ZoQDcVUJW%2FV6s9WJm6Idt5ngq%2B02S8Iab9RbrXo7qsHJEtLdmskdyAl56%2FUlZPLZyxoxvYBTF2AyAPVvgBajdi0E3R81VkMM9BM6yISSrspMCm5KZPkS8sPgWF2TV2cD2tg%2Bh2CXd%2F%2BszwzMlshsic%2FlzwRd9Wh03xTk5L4pHDnfznKZygGdDu9BTnNx%2B9uPxWFhLN%2B454bfvMemwDR8uitcvkk1l7rryJM1ybmw68YyQX7ccHsi3vFuf81b7bPNnffXN9LMCuek0WPQ6SL%2BZcHkhLzw2u5sMZd%2F2IG0Y1hfIvWXZG6QZgyWHcFlC%2F7OEFi1qImzAIUvR7YWLx6VJFBikdO4hPtXHi%2FiY%2FcIXRuA5g%2Bh0xI9W6KnSlA1hPO3R3lmL%2B%2F%2BNv88VsEoVjY4iZVVX90018mrimgmYSLCmoiTTpy0acg7SaMT004k2nGTRsjdRPiP%2FD8AAAD%2F%2FwEAAP%2F%2FtT1manAEAAA%3D
173.233.137.52200 OK 7 B URL GET HTTP/1.1 guiltjadechances.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS5iBJl0z8%2BMe1iMazQYk7gbybm6qnpSprqqqeqanswpuCB7HG8eO59JNuguYq6CIBMvEhB2PEgO5uJ%2FoLBnmcnA6IOq9159HtTn89778thfkwieXu18YgZSKbrSrIaV5T2puSlcZWu3EoXV8E5lT%2BpW406lP71s790obFbDtysfCnZgVmphFIZRGFXWpRWJ6a%2FMUMjsaSeqdsJqo1aNmg307X9z5wM4GoD3rslLkHzyv%2F1fziHZGDr9%2Fp5wB7nJ3vkg9YrmxqLHzz7TB9oUGukiTGyARJ%2FNq2HchJCvb8Hos7kCmN7JVAFiOSHB7xFifTanibh3esM0VhAaMf8%2Fit4YQo0h6RjMPITkzwjAOLa2odPHW8YW9PAGpVN0Qpae%2Fw1ZTMjSH69Ap9%2BtKdmvPDDK59Joh35SQvbHkN0xMn%2BBfBBAFhdg%2BReQ%2FFey8nwTOj3ZdspA8nKmXsoxZDKGEkNQF8BPjwzgkwA%2BC5DyqwptdpIwbCdxUq%2BvNhhj9TpjzdUWb%2FJ6YzUJ4dmU3hB5NgRTQzB7hMwe4UAOYf1PcPslHA%2Fg8gkJPj1Cj5coBEHhCApKUEiCIicoeuUpV67mysdcOR9Hc1%2Bb%2B3o5Mnn3mJ6avCs0AbXD4%2ByavDjtTbD8ZoQDcVUJW%2FV6s9WJm6Idt5ngq%2B02S8Iab9RbrXo7qsHJEtLdmskdyAl56%2FUlZPLZyxoxvYBTF2AyAPVvgBajdi0E3R81VkMM9BM6yISSrspMCm5KZPkS8sPgWF2TV2cD2tg%2Bh2CXd%2F%2BszwzMlshsic%2FlzwRd9Wh03xTk5L4pHDnfznKZygGdDu9BTnNx%2B9uPxWFhLN%2B454bfvMemwDR8uitcvkk1l7rryJM1ybmw68YyQX7ccHsi3vFuf81b7bPNnffXN9LMCuek0WPQ6SL%2BZcHkhLzw2u5sMZd%2F2IG0Y1hfIvWXZG6QZgyWHcFlC%2F7OEFi1qImzAIUvR7YWLx6VJFBikdO4hPtXHi%2FiY%2FcIXRuA5g%2Bh0xI9W6KnSlA1hPO3R3lmL%2B%2F%2BNv88VsEoVjY4iZVVX90018mrimgmYSLCmoiTTpy0acg7SaMT004k2nGTRsjdRPiP%2FD8AAAD%2F%2FwEAAP%2F%2FtT1manAEAAA%3D
IP 173.233.137.52:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectguiltjadechances.com
Fingerprint3A:ED:6D:08:9E:E4:8A:F1:85:AA:C0:6A:10:B9:CB:78:38:E1:5B:BD
ValidityMon, 27 Nov 2023 07:55:00 GMT - Sun, 25 Feb 2024 07:54:59 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS5iBJl0z8%2BMe1iMazQYk7gbybm6qnpSprqqqeqanswpuCB7HG8eO59JNuguYq6CIBMvEhB2PEgO5uJ%2FoLBnmcnA6IOq9159HtTn89778thfkwieXu18YgZSKbrSrIaV5T2puSlcZWu3EoXV8E5lT%2BpW406lP71s790obFbDtysfCnZgVmphFIZRGFXWpRWJ6a%2FMUMjsaSeqdsJqo1aNmg307X9z5wM4GoD3rslLkHzyv%2F1fziHZGDr9%2Fp5wB7nJ3vkg9YrmxqLHzz7TB9oUGukiTGyARJ%2FNq2HchJCvb8Hos7kCmN7JVAFiOSHB7xFifTanibh3esM0VhAaMf8%2Fit4YQo0h6RjMPITkzwjAOLa2odPHW8YW9PAGpVN0Qpae%2Fw1ZTMjSH69Ap9%2BtKdmvPDDK59Joh35SQvbHkN0xMn%2BBfBBAFhdg%2BReQ%2FFey8nwTOj3ZdspA8nKmXsoxZDKGEkNQF8BPjwzgkwA%2BC5DyqwptdpIwbCdxUq%2BvNhhj9TpjzdUWb%2FJ6YzUJ4dmU3hB5NgRTQzB7hMwe4UAOYf1PcPslHA%2Fg8gkJPj1Cj5coBEHhCApKUEiCIicoeuUpV67mysdcOR9Hc1%2Bb%2B3o5Mnn3mJ6avCs0AbXD4%2ByavDjtTbD8ZoQDcVUJW%2FV6s9WJm6Idt5ngq%2B02S8Iab9RbrXo7qsHJEtLdmskdyAl56%2FUlZPLZyxoxvYBTF2AyAPVvgBajdi0E3R81VkMM9BM6yISSrspMCm5KZPkS8sPgWF2TV2cD2tg%2Bh2CXd%2F%2BszwzMlshsic%2FlzwRd9Wh03xTk5L4pHDnfznKZygGdDu9BTnNx%2B9uPxWFhLN%2B454bfvMemwDR8uitcvkk1l7rryJM1ybmw68YyQX7ccHsi3vFuf81b7bPNnffXN9LMCuek0WPQ6SL%2BZcHkhLzw2u5sMZd%2F2IG0Y1hfIvWXZG6QZgyWHcFlC%2F7OEFi1qImzAIUvR7YWLx6VJFBikdO4hPtXHi%2FiY%2FcIXRuA5g%2Bh0xI9W6KnSlA1hPO3R3lmL%2B%2F%2BNv88VsEoVjY4iZVVX90018mrimgmYSLCmoiTTpy0acg7SaMT004k2nGTRsjdRPiP%2FD8AAAD%2F%2FwEAAP%2F%2FtT1manAEAAA%3D HTTP/1.1
Host: guiltjadechances.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Cookie: u_pl=19408177; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 10 Dec 2023 05:11:17 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1596deff269a212d8ff9acd88c32084d
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/img/close.png
172.64.109.10200 OK 591 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/img/close.png
IP 172.64.109.10:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
- data
Hash 9fd5bcb6103d86e317bd1eb019bcbe71
6b5a52ea669dcb74946f2bed4bdd7ec985026113
0ddd3be104ac7945fb062096df62034a6a24ecc76ba92493c35c62c3c25982ae
GET /sb/ssp/vpn/classic-push/small/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: image/png
content-length: 591
last-modified: Tue, 21 Sep 2021 12:03:43 GMT
etag: "6149ca1f-24f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 3278559
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LUoFqYA77o3C91k5ZcgDg0haJmjRojs3OhLcW6%2F1Jsye4ICDOi4mZigZgVKvbxawFzsg4BUSTfgbpItq9kz4HmCYqdEClX1h0zX7v%2FGvNyAKbXQAcRcB0LyKX3si4EntuVCcdHSaYvxU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc81ae287741-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png
45.133.44.9200 OK 16 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png
IP 45.133.44.9:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint71:EC:C0:22:20:76:60:90:92:4C:5C:F3:AD:17:3C:41:B5:00:25:AF
ValidityThu, 23 Nov 2023 05:00:53 GMT - Wed, 21 Feb 2024 05:00:52 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
- data
Hash 14cf262fabfd850855c42847d14fe775
2fafa28f167f018a0fb1f261f47380c8810803c9
972004ebada4077c3a4d03dcb45175ea467faf54da72be727a1c5c75e688b8af
GET /si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: image/png
content-length: 16093
server: nginx/1.21.6
last-modified: Mon, 04 Dec 2023 01:06:35 GMT
etag: "656d261b-3edd"
expires: Tue, 12 Dec 2023 05:11:18 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5
192.243.59.12200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5
IP 192.243.59.12:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 10 Dec 2023 05:11:18 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5f28d4a5cbaba02854b534aa605ddbe9
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.barscreative1.com/sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html
45.133.44.3200 OK 5.3 kB URL GET HTTP/2 cdn.barscreative1.com/sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html
IP 45.133.44.3:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type gzip compressed data, from Unix
- data
Hash 10712012a626065fb1da5cb35b24998e
f5dd7cf83e2c6995d90fb8f1cf26102471709c1b
7040832145395a2420ab0efaeb4d71ea0743ff60f5fc5709d059df90fc9ab2f8
GET /sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:17 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Mon, 27 Sep 2021 07:43:24 GMT
etag: W/"6151761c-52d"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sun, 10 Dec 2023 06:11:17 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
216.58.207.227200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP 216.58.207.227:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:46:25 GMT
expires: Fri, 06 Dec 2024 15:46:25 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 221093
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
142.250.74.106200 OK 17 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP 142.250.74.106:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint10:D0:ED:9A:F4:53:C8:99:DE:B6:5E:5C:04:E6:20:0B:68:7D:46:EC
ValidityMon, 20 Nov 2023 08:08:50 GMT - Mon, 12 Feb 2024 08:08:49 GMT
File type gzip compressed data, max compression
- data
Hash 6d617e953307c9b759b09a57f87844f5
07d7edc3f52b7a2d67bc108e51369f8fd84aed9a
79e203a64773e6956e5c1d7c2b501d55eb5c656ce9c36a6b66777f747c7ec897
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 10 Dec 2023 05:11:18 GMT
date: Sun, 10 Dec 2023 05:11:18 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
guiltjadechances.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS7iCjLpnp6f7mFxXaPBmMTdSM7VVTWTMtVVTVXX9GROwQXZ43jz2PlMskF3EXMVBJl4kYCw40FyMBf%2FA4U9y0wGRh9Uvffq86A%2Bn%2Ffel0f%2BikTw9HL7EzOUStHVRjWs3NqVmpvCVTZ3KlFYDW9XdqVu1m9XBrPL9t%2BNwkY1fLvyoWD7ZrUWRmEYhVFlTVrRNYPVOQqZPe1E1U5YrdeqUaOOgf1v7nwARwPw%2FhV5CZJP%2F7f3yxkkm0Cn398Tbj832TsfpF7R3Fj0%2Belnel%2BbQiNdhl0boKtPF9UwbkrI1zdg9OlCAUz%2FeKYAiZyS4PcIiT5d0ETSP7lmmigIjYT%2FH0V%2FAqEmkHQCZh5C8mcEYBybW9Dp401jC3pwjdIZOiUrz%2F%2BGLKZk5Y9XoNPv7io5qDwwyufSaIdBt4QcTCB7E2T%2BHPkwgCzOwfIvIPmvZPX5BnR6vOWUgeTlXL2UE8juBEqMQF0APzsygO8G8FmAlF9WaKPTDcNWN%2BnGcbvOGItjxhrtJm%2FwuN7uhvBsRm%2BEPBuBqRGYPURmD7EvR7D%2BJ7i9Eo4HcPmUBJ8eos9LFIKgcAQFJSgkQZETFP3yhCtXc%2BVjrpxPooWvLXxcjk3eO6InJu8JTUDt6Ci7Ii%2FOehPcejPCvrishM04bjQ7SUO0khYTvN1qsW5Y4%2FW42YxbUQ1OlpDuxlzuUE7JW6%2BvIJPPXtZI6DmcOgeTAah%2FA7QYt2oh6N643g4x1E%2FoMBNKuiozKbgpkeUryA%2BCI3VFXp0PaH3rDIJd3PkznhuYLZHZEp%2FLnwl66tH4vinI8X1TOHK2leUylUM6G96DnObi5rcfi4PCWL5%2Bz42%2BeY%2FNgFn4dEe4fINqLnXPkSd3JefCrhnLBPlx3e2KZNu7vbveap9tbL%2B%2Ftp5mVjgnjZ6AzhbxLwsmp%2BSF13bmi3nrh21IO4H1JVJ%2FQRYGaSZg2SFctuTvDIFVy5okC1D4cmxryfJRSQIlljlNSrh%2F5ckyPnKP0LMBaP4QOi3RtyX6qgRVIzh%2Fc5xn9uLOb4vPExWME2WD40RZ9dV1c528rDSiumgn7RbjPBGMR61a3I7DsMZ5vdURUQe5mwr%2Fkf8HAAD%2F%2FwEAAP%2F%2FoTXojHAEAAA%3D
173.233.137.52200 OK 7 B URL GET HTTP/1.1 guiltjadechances.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS7iCjLpnp6f7mFxXaPBmMTdSM7VVTWTMtVVTVXX9GROwQXZ43jz2PlMskF3EXMVBJl4kYCw40FyMBf%2FA4U9y0wGRh9Uvffq86A%2Bn%2Ffel0f%2BikTw9HL7EzOUStHVRjWs3NqVmpvCVTZ3KlFYDW9XdqVu1m9XBrPL9t%2BNwkY1fLvyoWD7ZrUWRmEYhVFlTVrRNYPVOQqZPe1E1U5YrdeqUaOOgf1v7nwARwPw%2FhV5CZJP%2F7f3yxkkm0Cn398Tbj832TsfpF7R3Fj0%2Belnel%2BbQiNdhl0boKtPF9UwbkrI1zdg9OlCAUz%2FeKYAiZyS4PcIiT5d0ETSP7lmmigIjYT%2FH0V%2FAqEmkHQCZh5C8mcEYBybW9Dp401jC3pwjdIZOiUrz%2F%2BGLKZk5Y9XoNPv7io5qDwwyufSaIdBt4QcTCB7E2T%2BHPkwgCzOwfIvIPmvZPX5BnR6vOWUgeTlXL2UE8juBEqMQF0APzsygO8G8FmAlF9WaKPTDcNWN%2BnGcbvOGItjxhrtJm%2FwuN7uhvBsRm%2BEPBuBqRGYPURmD7EvR7D%2BJ7i9Eo4HcPmUBJ8eos9LFIKgcAQFJSgkQZETFP3yhCtXc%2BVjrpxPooWvLXxcjk3eO6InJu8JTUDt6Ci7Ii%2FOehPcejPCvrishM04bjQ7SUO0khYTvN1qsW5Y4%2FW42YxbUQ1OlpDuxlzuUE7JW6%2BvIJPPXtZI6DmcOgeTAah%2FA7QYt2oh6N643g4x1E%2FoMBNKuiozKbgpkeUryA%2BCI3VFXp0PaH3rDIJd3PkznhuYLZHZEp%2FLnwl66tH4vinI8X1TOHK2leUylUM6G96DnObi5rcfi4PCWL5%2Bz42%2BeY%2FNgFn4dEe4fINqLnXPkSd3JefCrhnLBPlx3e2KZNu7vbveap9tbL%2B%2Ftp5mVjgnjZ6AzhbxLwsmp%2BSF13bmi3nrh21IO4H1JVJ%2FQRYGaSZg2SFctuTvDIFVy5okC1D4cmxryfJRSQIlljlNSrh%2F5ckyPnKP0LMBaP4QOi3RtyX6qgRVIzh%2Fc5xn9uLOb4vPExWME2WD40RZ9dV1c528rDSiumgn7RbjPBGMR61a3I7DsMZ5vdURUQe5mwr%2Fkf8HAAD%2F%2FwEAAP%2F%2FoTXojHAEAAA%3D
IP 173.233.137.52:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectguiltjadechances.com
Fingerprint3A:ED:6D:08:9E:E4:8A:F1:85:AA:C0:6A:10:B9:CB:78:38:E1:5B:BD
ValidityMon, 27 Nov 2023 07:55:00 GMT - Sun, 25 Feb 2024 07:54:59 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skxRev3s339AXBHxdRYS7iCjLpnp6f7mFxXaPBmMTdSM7VVTWTMtVVTVXX9GROwQXZ43jz2PlMskF3EXMVBJl4kYCw40FyMBf%2FA4U9y0wGRh9Uvffq86A%2Bn%2Ffel0f%2BikTw9HL7EzOUStHVRjWs3NqVmpvCVTZ3KlFYDW9XdqVu1m9XBrPL9t%2BNwkY1fLvyoWD7ZrUWRmEYhVFlTVrRNYPVOQqZPe1E1U5YrdeqUaOOgf1v7nwARwPw%2FhV5CZJP%2F7f3yxkkm0Cn398Tbj832TsfpF7R3Fj0%2Belnel%2BbQiNdhl0boKtPF9UwbkrI1zdg9OlCAUz%2FeKYAiZyS4PcIiT5d0ETSP7lmmigIjYT%2FH0V%2FAqEmkHQCZh5C8mcEYBybW9Dp401jC3pwjdIZOiUrz%2F%2BGLKZk5Y9XoNPv7io5qDwwyufSaIdBt4QcTCB7E2T%2BHPkwgCzOwfIvIPmvZPX5BnR6vOWUgeTlXL2UE8juBEqMQF0APzsygO8G8FmAlF9WaKPTDcNWN%2BnGcbvOGItjxhrtJm%2FwuN7uhvBsRm%2BEPBuBqRGYPURmD7EvR7D%2BJ7i9Eo4HcPmUBJ8eos9LFIKgcAQFJSgkQZETFP3yhCtXc%2BVjrpxPooWvLXxcjk3eO6InJu8JTUDt6Ci7Ii%2FOehPcejPCvrishM04bjQ7SUO0khYTvN1qsW5Y4%2FW42YxbUQ1OlpDuxlzuUE7JW6%2BvIJPPXtZI6DmcOgeTAah%2FA7QYt2oh6N643g4x1E%2FoMBNKuiozKbgpkeUryA%2BCI3VFXp0PaH3rDIJd3PkznhuYLZHZEp%2FLnwl66tH4vinI8X1TOHK2leUylUM6G96DnObi5rcfi4PCWL5%2Bz42%2BeY%2FNgFn4dEe4fINqLnXPkSd3JefCrhnLBPlx3e2KZNu7vbveap9tbL%2B%2Ftp5mVjgnjZ6AzhbxLwsmp%2BSF13bmi3nrh21IO4H1JVJ%2FQRYGaSZg2SFctuTvDIFVy5okC1D4cmxryfJRSQIlljlNSrh%2F5ckyPnKP0LMBaP4QOi3RtyX6qgRVIzh%2Fc5xn9uLOb4vPExWME2WD40RZ9dV1c528rDSiumgn7RbjPBGMR61a3I7DsMZ5vdURUQe5mwr%2Fkf8HAAD%2F%2FwEAAP%2F%2FoTXojHAEAAA%3D HTTP/1.1
Host: guiltjadechances.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Cookie: u_pl=19408177; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 10 Dec 2023 05:11:18 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 71285b1ca0e6332799463105e31c411f
Strict-Transport-Security: max-age=0; includeSubdomains
guiltjadechances.com/pixel/sbs?c=1
192.243.59.12200 OK 0 B URL GET HTTP/1.1 guiltjadechances.com/pixel/sbs?c=1
IP 192.243.59.12:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectguiltjadechances.com
Fingerprint3A:ED:6D:08:9E:E4:8A:F1:85:AA:C0:6A:10:B9:CB:78:38:E1:5B:BD
ValidityMon, 27 Nov 2023 07:55:00 GMT - Sun, 25 Feb 2024 07:54:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: guiltjadechances.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Cookie: u_pl=19408177; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 10 Dec 2023 05:11:18 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
635425.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
104.21.58.228200 OK 6.4 kB URL GET HTTP/3 635425.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js
IP 104.21.58.228:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (6543), with no line terminators
Hash e3adfa7305baa9b772b751a386ab07cb
dd4ca881327917117a02882f9cb9bd10d3afb859
3840f06ccbae438e3bff75651db3d99affb440fb3932e69036da9290317815ef
GET /cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: application/javascript; charset=utf-8
x-amz-id-2: 7NP6it7Xp3tHuGnec6TEPpV8tGAeKRK9m//ZUtc9Ss3NvfwqQ4eZ9t/0H3T4DaUVMI4ozArOGVk=
x-amz-request-id: R3X7Z937D2JMDG5T
cache-control: public, max-age=31536000
last-modified: Wed, 11 Dec 2019 13:31:58 GMT
x-amz-version-id: ESUrlvQQwNmPgiI2n2eMDNt6te85sX_N
etag: W/"ceb291a94a4e29bc8fe20512e46d29e3"
cf-cache-status: HIT
age: 9296
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BadFu%2FwZutIhezLjTyLapwNIgAoQnpb6pKYzNXH2GIVZw1Nw2FtBqwdsHYYOXlNwkjVHY2G1gx8FJ4dJMGRa%2FiHxBaqPXkCDrh5Ga%2FgRZK4pRtaGDwdHMf2J5jWuDAbU870haA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc73fa62b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
188.114.96.1200 OK 110 kB URL GET HTTP/2 flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
IP 188.114.96.1:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 110 kB (110035 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /wp-includes/css/dist/block-library/style.min.css?ver=6.4.2 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Sat, 06 Jan 2024 00:13:36 GMT
last-modified: Wed, 08 Nov 2023 14:55:17 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 277059
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qf795YxPqQ7VR12cGMvaikai8sOVX3YKryA4mdYNFgvGqO7QLreR1J5ulC77h%2FKoiC6VBwPmjih4U8NbZPLDEKq0WSTsGO5YE%2F5r31aIbdJpawnOgbATmx%2B5qr7f"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8332fc744cddb518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
104.21.58.228200 OK 532 kB URL User Request GET HTTP/2 IP 104.21.58.228:443
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
Size 532 kB (532155 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jSoXTH4ytUoBHGBMS%2Fb1Nl9u7wAEPgErV%2FeL1lqRsiYcKOTBGHhhWU8yj5tjIKpb7qJYzTGYnCyc1oMt2igNUikenMkl9hG3pc93ip4cOLEpKZARkCuRG%2FgHCg3JfoBorUlzDg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8332fc706d3156c3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
flowhot.cc/wp-content/themes/flowhot/style.css?ver=1702184704
188.114.96.1200 OK 20 kB URL GET HTTP/2 flowhot.cc/wp-content/themes/flowhot/style.css?ver=1702184704
IP 188.114.96.1:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with very long lines (4468)
Hash 4c1717ce0a000bdbf8af2b620be2b465
9398d9ac4a1f37374cc187f5a1e3d6dc69f2a208
25f469c98011ebbf04fe876c4a5732b88c74bf48dfc6b03f8fa7d68b34657404
GET /wp-content/themes/flowhot/style.css?ver=1702184704 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Tue, 09 Jan 2024 05:11:15 GMT
last-modified: Fri, 19 Jun 2020 18:37:30 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AFaEWGtMD0ThkEwrWI%2BgvSuXVB6D92kV9Swb8k80AeFMwFC9k3S5467tAjm4N4y9n6799Bws5BeILhb%2FD4RWieZiHk8IsJEHTagSE9a49BX0ajT1KKoq%2F5iooIP2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8332fc744ce2b518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
635425.flowhot.cc/dectector.js
104.21.58.228404 Not Found 1.3 kB URL GET HTTP/3 635425.flowhot.cc/dectector.js
IP 104.21.58.228:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- exported SGML document, ASCII text, with very long lines (1336), with no line terminators
Hash f524e65bd054ef4645f2613feecd62ba
8f40c58021af38e48ca8cf873f8fc33016b8191f
519829523d799cdcf97fc3e589c7b8c0d21316df097951cf4108b95ff0a037cc
GET /dectector.js HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ymANNpnS2eYYXCCtTrq40Wr4%2F%2BSYnhrryXGu1vzct%2BjVRoe1SFmwS8HuBYjcyJ2xW2V0YUtDQdjQwrGALXswi8V29Mmr%2Bv%2FOzfFgr%2FOI4s%2F3Z28tb%2BPZhEhIXAjOnzGYe0Pb8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc740a67b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/animate.css
172.64.109.10200 OK 79 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/animate.css
IP 172.64.109.10:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash 80047eaa13ebd50c50e8a9753621e430
9c503e07d130572a0eaf51f7c02cbd4cf6213fe3
3f831a59615f8d5d40b4340b2836f91438c876f8dbce75f78e38360d6fe0f429
GET /sb/ssp/vpn/classic-push/small/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: text/css
last-modified: Tue, 21 Sep 2021 12:03:42 GMT
etag: W/"6149ca1e-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2FpHMnPpgRoWK0N%2FYnh2WhqMjESGkUfJx%2FJ%2F7y5qUYilLEl8Zb35KK2SwjH2aZSIszaRnSpDw7WDUZvIbxrcvZnY4JsktI%2B%2BiN5ShSXifuHhLeBiSbkWprhg4hev%2BtmtDlbI%2BcsXGtt8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc812dcc7741-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
635425.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
104.21.58.228200 OK 1.2 kB URL GET HTTP/3 635425.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP 104.21.58.228:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document, ASCII text, with very long lines (1271), with no line terminators
Hash 40d981045a7516cdadd00e8dccc9c58d
8b8d9a48c6b9d2fba596034ef5db3dd0f2f781c3
71c7d5fc630ff38080f71945be1e8b0c43140d8c25338056b752495e18739c0c
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: application/javascript
last-modified: Fri, 01 Dec 2023 15:04:24 GMT
etag: W/"6569f5f8-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UbbAd4J8RU8cpS4bqZLItfoOX%2FHbTnv%2FUKKBQIB0W6G8COm9Rzod3ULMFTcCnlUfehw7SzPiMgEt%2FxG51QdPDjtDocnVLKllyjZ5gCEnKXJiRJaN8tQtqxflVDX%2BAJ2V4FuLHA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc740a66b4fa-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Tue, 12 Dec 2023 05:11:15 GMT
cache-control: max-age=172800, public
content-encoding: gzip
635425.flowhot.cc/dectector.js
104.21.58.228404 Not Found 1.3 kB URL GET HTTP/3 635425.flowhot.cc/dectector.js
IP 104.21.58.228:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- exported SGML document, ASCII text, with very long lines (1336), with no line terminators
Hash f524e65bd054ef4645f2613feecd62ba
8f40c58021af38e48ca8cf873f8fc33016b8191f
519829523d799cdcf97fc3e589c7b8c0d21316df097951cf4108b95ff0a037cc
GET /dectector.js HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j9m4RtbQyvdhTtq%2BJSonZQfTzHp%2FhRlI2rbfEh3Qyij%2FsSKZ2oEh16o820F%2Fq0yPX4B3JVunrN5z6g4r4cGcdLfLWVn%2BrkzAJa156PwW8aXp0HM1xsSZP0QnlR0PRvNXvrJcOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc786bb2b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
104.18.11.207200 OK 77 kB URL GET HTTP/3 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
IP 104.18.11.207:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type Web Open Font Format (Version 2), TrueType, length 77160, version 4.459
- data
Hash af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
GET /font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://maxcdn.bootstrapcdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: font/woff2
content-length: 77160
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "af7ae505a9eed503f8b8e6982036873e"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 19:08:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 12c5447cacbf3c587b1916c2cb612911
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8332fc7a7c8c56c5-OSL
alt-svc: h3=":443"; ma=86400
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/style.css
172.64.109.10200 OK 3.4 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/style.css
IP 172.64.109.10:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (3581), with no line terminators
Hash c8ded4b141a8ede34abfc377901ea757
30364a88fa583f523e856948395f7c7185e01067
2465381b1c22f14274b8d5c154ac8e0cc5afca013d326e0742c36c08dcb3df04
GET /sb/ssp/vpn/classic-push/small/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: text/css
last-modified: Tue, 21 Sep 2021 12:03:42 GMT
etag: W/"6149ca1e-d31"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tEskTVHg72730PF1tf6YoDqV%2BARi5r%2Bh9aRLOPfuFOFzTmVl69USOZIwhdDMXXGwEHAR7mrJrmg%2F%2FhvAyZC%2BztO0hCPdnaKKzEDj8YEAO9jjQ6qIBbvfYaB0tebc%2FujC%2BP1ns8P4rheh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc813dd97741-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js
172.64.109.10200 OK 84 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js
IP 172.64.109.10:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /sb/ssp/vpn/classic-push/small/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: application/javascript
last-modified: Tue, 21 Sep 2021 12:03:44 GMT
etag: W/"6149ca20-1499c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1032823
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fg%2Bg0dpMibJhuXGIhuwKBIzabWMYgILf6bx1eUOLK0VhFIBpTP5IOWPJUv1kXkGRsjqi5YH0gBetKOb6T4zwSUAWOYx4eM06tgSlA637JMT4RPZvDYhSAO5Qxw5FxEpUYC9DqyetfmWI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc81ae2c7741-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/script.js
172.64.109.10200 OK 962 B URL GET HTTP/2 cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/script.js
IP 172.64.109.10:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (1015), with no line terminators
Hash 88523e22d10f0cbad31aa1d8276764fa
9238cd9499e01abdbeb33e68c550d26cfb6eaba5
d553390acb639c765cb6aaa4fbb72529e4005227d190f53108aec87ccec411c2
GET /sb/ssp/vpn/classic-push/small/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:18 GMT
content-type: application/javascript
last-modified: Tue, 21 Sep 2021 12:03:44 GMT
etag: W/"6149ca20-3c2"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e0eltknL%2FGu0USyVuw2yogNWoh%2BzJ3UZrPw7MfCUfrLpwF%2FRQgrholH0hVigXQRz5k6ddflbBMr4KB2C3EgQ5K9XYiiM7jJuSLZsYcSV7PQjbcr0WD0rVOoLPehLeaSBrKrFZaSNUj0B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc837f4a7741-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
635425.flowhot.cc/favicon.ico
104.21.58.228404 Not Found 1.3 kB URL GET HTTP/3 635425.flowhot.cc/favicon.ico
IP 104.21.58.228:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document text
- exported SGML document, ASCII text, with very long lines (1336), with no line terminators
Hash f524e65bd054ef4645f2613feecd62ba
8f40c58021af38e48ca8cf873f8fc33016b8191f
519829523d799cdcf97fc3e589c7b8c0d21316df097951cf4108b95ff0a037cc
GET /favicon.ico HTTP/1.1
Host: 635425.flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1702185083.1.0.1702185083.0.0.0; _ga=GA1.1.1006580517.1702185084; sb_main_0633569b5e7b7ced877cf02d43663712=1; sb_count_0633569b5e7b7ced877cf02d43663712=1; dom3ic8zudi28v8lr6fgphwffqoz0j6c=53e8f738-ee40-4eed-bdae-a5f9c039608d%3A3%3A1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sun, 10 Dec 2023 05:11:17 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tK%2Br4pxV4KPrTtGsbT1%2Fv7gRP1kzIHU%2F9oeuAGramSF%2FVuLmafeT%2BDbJlgerR9dIcZ5SB0Jys4RbAEE4D7b4nRVHDXILRkR3ScSN4HWPMCj5JRKKQkzufjvPBsTrIMWD5%2F7pRg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8332fc7e6db0b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
flowhot.cc/wp-content/themes/flowhot/views.php?id=635425
188.114.96.1200 OK 6 B URL GET HTTP/3 flowhot.cc/wp-content/themes/flowhot/views.php?id=635425
IP 188.114.96.1:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectflowhot.cc
FingerprintCD:8B:0B:C8:A6:57:11:77:4E:2E:BE:0E:93:82:51:03:F4:15:BE:C7
ValidityFri, 20 Oct 2023 08:03:26 GMT - Thu, 18 Jan 2024 08:03:25 GMT
File type ASCII text, with no line terminators
Hash 8dfd5b65e0c8cbe5b5ff625cfc867e82
3af1738c874f9f7fd99904b615a1fa9d75a40464
abcae02275eb11b0d09e6c4c010ab6a7a83cbce5adb8cd489d632cddaf5307f4
GET /wp-content/themes/flowhot/views.php?id=635425 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 05:11:17 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eHbhv3wK69kLR%2FpaDA8BnZStF%2BPhFl45tMOuxSx8C4%2FTxBKgw5PtRB2%2BYH%2FdVU7H2HuaE%2B8LD7%2Fe9SIFMZb7F3QFDI%2BwN6axaXL1LUGtBZmeCuvTiPxXbk%2BCL4W1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8332fc7a8c9156c5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
216.58.207.227200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 216.58.207.227:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://635425.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 04:57:34 GMT
expires: Fri, 06 Dec 2024 04:57:34 GMT
cache-control: public, max-age=31536000
age: 260024
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
104.18.11.207200 OK 31 kB URL GET HTTP/2 maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP 104.18.11.207:443
Requested by https://635425.flowhot.cc/
Certificate IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT
File type ASCII text, with very long lines (30837)
Hash 269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Dec 2023 05:11:15 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 18:48:06
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 9e61a4e37a75208649ae6b63a0cb4f72
cdn-cache: HIT
cf-cache-status: HIT
age: 1125345
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8332fc747d4d5693-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5
192.243.59.12200 OK 0 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5
IP 192.243.59.12:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
Fingerprint79:45:7F:58:D5:82:45:0A:7D:1E:FF:7A:98:05:26:E9:D6:FE:91:14
ValidityWed, 22 Nov 2023 07:56:28 GMT - Tue, 20 Feb 2024 07:56:27 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=53e8f738-ee40-4eed-bdae-a5f9c039608d&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.3095&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=5 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 10 Dec 2023 05:11:18 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0ddbbadc67adabb44bf8bc83e884bd07
Strict-Transport-Security: max-age=0; includeSubdomains
notix.io/ent/current/enot.min.js
139.45.240.92200 OK 145 kB URL GET HTTP/2 notix.io/ent/current/enot.min.js
IP 139.45.240.92:443
Requested by https://635425.flowhot.cc/
Certificate IssuerLet's Encrypt
Subjectnotix.io
Fingerprint68:78:0C:AA:A6:75:6F:E2:65:2D:3B:7E:5B:8A:2B:6B:F6:1A:BF:1D
ValidityFri, 15 Sep 2023 11:38:16 GMT - Thu, 14 Dec 2023 11:38:15 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 145 kB (145050 bytes)
Hash 92b38f6d9fc417ca26ce303b35c4a8a7
ac43be3c7b02b0ea8e9234290c88d617ae99b889
932b6fbd6e590cb895e40347965b2d02412c54e0198d07ffc2226661b28c62dd
Analyzer Verdict Alert Public Nextron YARA rules malware Unique code from Jetriz, Swid & Jeniva of the Tetris framework
GET /ent/current/enot.min.js HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://635425.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 05:11:16 GMT
content-type: application/javascript
last-modified: Fri, 08 Dec 2023 09:06:51 GMT
etag: W/"6572dcab-2369a"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2