| t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6354547c1baa8900012b3d41&s=503 |  51.161.115.163 | 302 Found | 0 B |
URL User Request GET HTTP/1.1t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6354547c1baa8900012b3d41&s=503 IP51.161.115.163:443
CertificateIssuerLet's Encrypt Subjectburned-koala.landingtrack.com Fingerprint91:B6:AD:9E:E8:97:86:A6:0C:A4:61:94:F7:82:C7:31:F6:CE:57:69 ValidityMon, 15 May 2023 22:21:45 GMT - Sun, 13 Aug 2023 22:21:44 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6354547c1baa8900012b3d41&s=503 HTTP/1.1
Host: t2.blowingwnd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 09 Jun 2023 18:32:23 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 12rj77ltcq
Raund: 2fm
Location: https://t2.hightid.com/s.php?p=c:8pnojh5wxi7l11j14&d=63208671784bc04a7b5b1ad6&s=503&pid=64837037dc61fa3e1b34c75e
|
|
| t2.hightid.com/s.php?p=c:8pnojh5wxi7l11j14&d=63208671784bc04a7b5b1ad6&s=503&pid=64837037dc61fa3e1b34c75e | 51.161.115.163 | 302 Found | 0 B |
URL User Request GET HTTP/1.1t2.hightid.com/s.php?p=c:8pnojh5wxi7l11j14&d=63208671784bc04a7b5b1ad6&s=503&pid=64837037dc61fa3e1b34c75e IP51.161.115.163:443
CertificateIssuerLet's Encrypt Subjectburned-koala.landingtrack.com Fingerprint91:B6:AD:9E:E8:97:86:A6:0C:A4:61:94:F7:82:C7:31:F6:CE:57:69 ValidityMon, 15 May 2023 22:21:45 GMT - Sun, 13 Aug 2023 22:21:44 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s.php?p=c:8pnojh5wxi7l11j14&d=63208671784bc04a7b5b1ad6&s=503&pid=64837037dc61fa3e1b34c75e HTTP/1.1
Host: t2.hightid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 09 Jun 2023 18:32:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 11l3mda7a9
Raund: 1jv
Location: https://track.gositego.live/sl?id=61b9db328bff280d95069d29&pid=1106&sub1=648370386d0004734c6b3fba&sub2=503
|
|
| track.gositego.live/sl?id=61b9db328bff280d95069d29&pid=1106&sub1=648370386d0004734c6b3fba&sub2=503 |  34.91.234.242 | 302 Found | 0 B |
URL User Request GET HTTP/1.1track.gositego.live/sl?id=61b9db328bff280d95069d29&pid=1106&sub1=648370386d0004734c6b3fba&sub2=503 IP34.91.234.242:80 ASN#396982 GOOGLE-CLOUD-PLATFORM
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=61b9db328bff280d95069d29&pid=1106&sub1=648370386d0004734c6b3fba&sub2=503 HTTP/1.1
Host: track.gositego.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 09 Jun 2023 18:32:24 GMT
Content-Length: 0
Connection: keep-alive
X-Adjust-Use-Original-Forwarded-For: 1
Location: https://t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=64837038ae2cdb000140d6c6&s=1106_503
Set-Cookie: afclick=64837038ae2cdb000140d6c6; expires=Sat, 08 Jun 2024 18:32:24 GMT; secure; SameSite=None
Access-Control-Allow-Origin: *
|
|
| t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=64837038ae2cdb000140d6c6&s=1106_503 | 51.161.115.163 | 302 Found | 0 B |
URL User Request GET HTTP/1.1t3.blowingwnd.com/p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=64837038ae2cdb000140d6c6&s=1106_503 IP51.161.115.163:443
CertificateIssuerLet's Encrypt Subjectburned-koala.landingtrack.com Fingerprint91:B6:AD:9E:E8:97:86:A6:0C:A4:61:94:F7:82:C7:31:F6:CE:57:69 ValidityMon, 15 May 2023 22:21:45 GMT - Sun, 13 Aug 2023 22:21:44 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /p.php?p=c:8pnojh5wwryg9ycmq&d=61b86bb2caff0c3520644fec&pid=CLICKID&s=SUBID&pid=64837038ae2cdb000140d6c6&s=1106_503 HTTP/1.1
Host: t3.blowingwnd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 09 Jun 2023 18:32:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 133kvcaevl
Raund: 2ro
Location: https://go.savethereef.xyz/redirect?feed=488122&url=https%3A%2F%2Fwww.gamblingnews.xyz%2F&subid=1106_503.no.linux.firefox&query=&pub_clickid=6483703895e9c56e862f06b9&default_url=https%3A%2F%2Ft5.lowtid.com%2Fe.php%3Fp%3Dc%3A0hfgb_xonhgyz4t58%26d%3D62ff3f1db72852774702f44e%26s%3Ddu.%7Bpubfeed%7D%26d2%3D%7Breferrer_domain%7D
|
|
| go.savethereef.xyz/redirect?feed=488122&url=https%3A%2F%2Fwww.gamblingnews.xyz%2F&subid=1106_503.no.linux.firefox&query=&pub_clickid=6483703895e9c56e862f06b9&default_url=https%3A%2F%2Ft5.lowtid.com%2Fe.php%3Fp%3Dc%3A0hfgb_xonhgyz4t58%26d%3D62ff3f1db72852774702f44e%26s%3Ddu.%7Bpubfeed%7D%26d2%3D%7Breferrer_domain%7D |  198.134.116.30 | 302 Found | 0 B |
URL User Request GET HTTP/1.1go.savethereef.xyz/redirect?feed=488122&url=https%3A%2F%2Fwww.gamblingnews.xyz%2F&subid=1106_503.no.linux.firefox&query=&pub_clickid=6483703895e9c56e862f06b9&default_url=https%3A%2F%2Ft5.lowtid.com%2Fe.php%3Fp%3Dc%3A0hfgb_xonhgyz4t58%26d%3D62ff3f1db72852774702f44e%26s%3Ddu.%7Bpubfeed%7D%26d2%3D%7Breferrer_domain%7D IP198.134.116.30:443 ASN#27257 WEBAIR-INTERNET
CertificateIssuerLet's Encrypt Subjectsavethereef.xyz Fingerprint9A:F6:3F:91:4F:B8:EC:01:A3:A1:80:FC:7E:8F:05:96:71:A6:97:87 ValiditySat, 03 Jun 2023 06:39:14 GMT - Fri, 01 Sep 2023 06:39:13 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?feed=488122&url=https%3A%2F%2Fwww.gamblingnews.xyz%2F&subid=1106_503.no.linux.firefox&query=&pub_clickid=6483703895e9c56e862f06b9&default_url=https%3A%2F%2Ft5.lowtid.com%2Fe.php%3Fp%3Dc%3A0hfgb_xonhgyz4t58%26d%3D62ff3f1db72852774702f44e%26s%3Ddu.%7Bpubfeed%7D%26d2%3D%7Breferrer_domain%7D HTTP/1.1
Host: go.savethereef.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 09 Jun 2023 18:32:25 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Age: 0
Location: https://www.yofaurls.com/webroot/bts/index.html
Pragma: no-cache
|
|
| www.yofaurls.com/webroot/bts/index.html |  51.89.87.113 | 200 OK | 899 B |
URL User Request GET HTTP/2www.yofaurls.com/webroot/bts/index.html IP51.89.87.113:443
CertificateIssuerLet's Encrypt Subjectyofaurls.com Fingerprint84:1A:6F:77:0E:6F:B7:6F:59:EE:0B:DA:93:D7:14:87:20:9F:28:2C ValidityFri, 02 Jun 2023 14:07:25 GMT - Thu, 31 Aug 2023 14:07:24 GMT
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with CRLF line terminators Hash697b81566960ce6ace298cd88541ddc2 7a82218eb16b31385aa2a0570b480bfaa2bfee02 b84dc9a5e10e709bbfc4f61cdb47f457ebaed639ea2e19c492257631b55a1ae9
GET /webroot/bts/index.html HTTP/1.1
Host: www.yofaurls.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
last-modified: Wed, 31 May 2023 14:34:04 GMT
accept-ranges: bytes
cache-control: max-age=600
expires: Fri, 09 Jun 2023 18:42:25 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-length: 899
content-type: text/html
date: Fri, 09 Jun 2023 18:32:25 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| www.yofaurls.com/favicon.ico | 51.89.87.113 | 200 OK | 61 B |
URL GET HTTP/2www.yofaurls.com/favicon.ico IP51.89.87.113:443
Requested byhttps://www.yofaurls.com/webroot/bts/index.html CertificateIssuerLet's Encrypt Subjectyofaurls.com Fingerprint84:1A:6F:77:0E:6F:B7:6F:59:EE:0B:DA:93:D7:14:87:20:9F:28:2C ValidityFri, 02 Jun 2023 14:07:25 GMT - Thu, 31 Aug 2023 14:07:24 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 2 colors\012- data Hashc6acedaff906029fc5455d9ec52c7f42 92cbd806ca421aa2c9ff5e1ff76bbc20913a2f81 9deb629637088856fe61dc868bf40a7d21ed942e4117659f3d6c3408f59b906b
GET /favicon.ico HTTP/1.1
Host: www.yofaurls.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.yofaurls.com/webroot/bts/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
last-modified: Tue, 31 Jan 2023 14:59:25 GMT
accept-ranges: bytes
cache-control: max-age=31536000
expires: Sat, 08 Jun 2024 18:32:26 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-length: 61
content-type: image/x-icon
date: Fri, 09 Jun 2023 18:32:26 GMT
server: Apache
X-Firefox-Spdy: h2
|
|