cdnjs.cloudflare.com/ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.js
104.17.25.14200 OK 1.7 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.js
IP 104.17.25.14:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
Hash eb638361f3402431eb2195f569607d91
c00d931f8738add2a738429784343ea1702b19cf
2a9c9c017aa931fb3ea3db71751ab13c8d8f7e5c4e6f785d3922ad07820443b7
GET /ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript; charset=utf-8
content-length: 1675
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb04020-18dd"
last-modified: Mon, 04 May 2020 16:17:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1959359
expires: Thu, 07 Nov 2024 21:40:39 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2R%2FiwMwzvQ3FZp3FW1CPg6%2BmrP59s85XpWRRjQ4oGiiDtl3zCHjyXTOiX99W5%2F1qxJTv2YBe%2F57IqdL5ctrC7Kmzj7iqEodMmPv5r6LYAYkOiQ4mDz0lnjoP0hCGWEPuSbx4pFWr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82835f832af7b4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
img.xxxfiles.tv/233000/233811/medium@2x/1.jpg
104.21.83.6200 OK 35 kB URL GET HTTP/3 img.xxxfiles.tv/233000/233811/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash e491260e9fc21964e2811f0db177c62d
8e7ff4bc345dd552f5b1ddfdef67a38e14b69034
49c5782fe7cc5f64c708b9d1e81ea11de503dadc5cae471db10eda8abc9fb80e
GET /233000/233811/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 34885
last-modified: Fri, 07 Feb 2020 22:43:17 GMT
etag: "5e3de805-8845"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2057836
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y8yV32GLa2tD3SDaG39rb6Fg1RKhroUmxo09nSc1sCLQMpElF4SjL7Kc6uhNyJFlx284E%2F8i3RjeM0qQSfud7U%2BoYXAVAPvQSzQkHBjkSWqNDZIL9u3N1m5PfLFf3BSxOZ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339275688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/233000/233003/medium@2x/1.jpg
104.21.83.6200 OK 34 kB URL GET HTTP/3 img.xxxfiles.tv/233000/233003/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 49e62066bffa1d5cafa63007a56b14c4
7d8345f6006ba69e6daa77fba0e14ee8554bec02
f6f961a7ff9e26fecccc9917a519fa2dea2d08ca4be1aaceee424f598415192f
GET /233000/233003/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 34211
last-modified: Fri, 07 Feb 2020 21:05:30 GMT
etag: "5e3dd11a-85a3"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1878917
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P9mamChFj8KLKW1uccI8rRl8wCu488JnVgjv2mYDIwOz5%2FXgUd%2FOH5ERMUWFx6%2BqR0X6OK7WQZx4bfclq08sLaUDCyR4vah757cjYhUb2csSdPXXSw0tBKedc68Bf00Rv%2Bg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339265688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/699000/699820/medium@2x/1.jpg
104.21.83.6200 OK 29 kB URL GET HTTP/3 img.xxxfiles.tv/699000/699820/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash fe965c166fd02279c6253a03635b3813
c7840c20991bcee024bcd3495b5660fecc6f2b26
7c09526fab8d68ba9b38e7f41f5fb2b592f54bc366e4e60ef13696360b717f76
GET /699000/699820/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 29197
last-modified: Sun, 08 Nov 2020 21:50:42 GMT
etag: "5fa86832-720d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1867851
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E4eiJZL3AbgZA8lk1A%2B6KZuSR1C%2FEYLDtaMr6sl3YEvZBbG9BJdrBhOuqzHzj0JIX19PxzloXcc9OI0M68gRjZXMMiPdJpF4x3eRpbgsnyyTpmeAoPsPeYdGlgph2QGuZpY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339295688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/235000/235313/medium@2x/1.jpg
104.21.83.6200 OK 41 kB URL GET HTTP/3 img.xxxfiles.tv/235000/235313/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash cda3e3cbee1cae281ef1e7c7e92b684f
7218c66a2ed11ab9120cb2b3fc8e35573a1af8e7
c89cfef1c4b9221e31d280e80d678fc427ca4f2e705e6d87c9ef252bc5ebd3e4
GET /235000/235313/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 40715
last-modified: Sun, 09 Feb 2020 18:49:54 GMT
etag: "5e405452-9f0b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 982361
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkgeTYl8Ff91V2HRMH8sr3iDtrdyep2JrJIOrx5E8Ycck4Mr5QcX9eJDI5XNuM9tbZQ7FMCxF4ZO9byckYprFvzsS0oe5dmDzxayGmunhyR%2BIzJcW1Odg%2BBIsggL3Y9ChJs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392a5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/55506000/55506908/medium@2x/1.jpg
104.21.83.6200 OK 43 kB URL GET HTTP/3 img.xxxfiles.tv/55506000/55506908/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash e25957d9cfa61a9edf4bdce9f237f277
ef63824dc18b743581e5921ec02f3478a1a1577b
1140bd9032ccc4cc68b68a50e59d29ac37ddbe36395bd94c500fb5b0ed518371
GET /55506000/55506908/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 42869
last-modified: Mon, 28 Nov 2022 12:12:20 GMT
etag: "6384a5a4-a775"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1862688
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LRMVLxjhK1eklxfaCPHeJRI6ZrCZcLdB3ROsMdYPn%2Fpq2lCEKe%2FThGyehZyLqmuLjh7JjOghDmwzx2HUny4Wqlw1zNPBkhoQV1k01C75ymqoLPQWUuOW0ClPnirt9OFIF0Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392b5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/341000/341235/medium@2x/1.jpg
104.21.83.6200 OK 57 kB URL GET HTTP/3 img.xxxfiles.tv/341000/341235/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 94b52d23577d98bcef21fac912549126
e85b7431582ba655d342b02e6cb226a1e37f2272
2c1ea5cd009d5ea731cfbb52fc40289f3f311631f47952017f68149b1b70b108
GET /341000/341235/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 56628
last-modified: Tue, 18 Jun 2019 21:49:38 GMT
etag: "5d095c72-dd34"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2048681
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rJ1SJNz%2FEg%2BPMJIvZGplrA1tkcdxOgtXtYNBoZdjdvqO5MZaug6q7WzFIQW9Xs9AkKQ%2BUmrrZgvAo8ahx6l5wV2boRtpBjOG60c%2Fh7UKPeGC4%2FuENYTLmGbZz29biOi%2FxjM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392c5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/152000/152275/medium@2x/1.jpg
104.21.83.6200 OK 26 kB URL GET HTTP/3 img.xxxfiles.tv/152000/152275/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 239x240, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash e9ffbc65a72c9d021f837448cc7bc848
50666d35188e1f155a782201d7ed76360e939230
5cba2540012ebe985ce1a466c2ce752a5e5ca99606e33d177ade5e16f2358c1d
GET /152000/152275/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 25576
last-modified: Sat, 28 Dec 2019 17:24:11 GMT
etag: "5e078fbb-63e8"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2131628
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8zFUUMkbUhncHOGRKPhVg%2BZEgiSr2SX%2FQFGtBAFgkfROICT3AxKT5WMmH5MMaAVQoqddf26LsoklQZDXA1T8y3rAHQ20xuthfz638DtJsdxBg%2BZiMlWcOVRWU9pqELHCZsk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392d5688-OSL
alt-svc: h3=":443"; ma=86400
cdnjs.cloudflare.com/ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.css
104.17.25.14200 OK 256 B URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.css
IP 104.17.25.14:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
Hash 39aa2ea27eb7b72cf73d0d5b4f892daf
9fa0eb7f5d30e7c54f505ffe9fa5a1fe4725279f
e425124d9e8e5674cdad309801b12fdc3804465bc30322d4515b09347a52be05
GET /ajax/libs/videojs-thumbnails/0.1.1/videojs.thumbnails.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: text/css; charset=utf-8
content-length: 256
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb04020-36a"
last-modified: Mon, 04 May 2020 16:17:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1886623
expires: Thu, 07 Nov 2024 21:40:39 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v1UKcfVmC6dc7kN%2B5ojv4bJJZnmHNlfsFTSsN6uljnsVPEaD8%2Ff0haWC%2BtQ%2F0esiaw3Z3qVTTFo01Xo0GaPJM6Rte5m2i2KBI9J4Kai0u1tTjNzEWsr8mraooT2%2FgJ%2FLwX%2F174Uu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82835f83ab6fb4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
img.xxxfiles.tv/55483000/55483442/medium@2x/1.jpg
104.21.83.6200 OK 36 kB URL GET HTTP/3 img.xxxfiles.tv/55483000/55483442/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash bfa863802968db555956e36dccf1e80e
48d3eacdde578c105b213c81fcc1ee1404fdddc3
7506841bd2d7759e110000d83ec0dfe024b5ba22f956d03af3cfeb1bd72c4a37
GET /55483000/55483442/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 36132
last-modified: Mon, 13 Jun 2022 18:03:27 GMT
etag: "62a77bef-8d24"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2138145
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qaOphnd9vVC7BnyfRAOFrh4aZjE2SvU%2Bc0WyGg9h%2BCfjTn7fACaPcN5SfoTcMU7aJfikBGB%2BK73F5V1G8hbEJKZGtz5Q20DXptD2sntbrtVNiTiCqSiswVbhzPKyTxL%2Fmzk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392f5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/341000/341548/medium@2x/1.jpg
104.21.83.6200 OK 43 kB URL GET HTTP/3 img.xxxfiles.tv/341000/341548/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 8f31bc85f3bce3d52bd8dbe51f43b58a
97a4d95fd34e63c93d42c3e05ed95eab575737c6
47caeca6f822a980fe5dc8e7215bcedad351977f4c956568b34f75988e1b85b1
GET /341000/341548/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 43006
last-modified: Mon, 27 May 2019 11:11:53 GMT
etag: "5cebc5f9-a7fe"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1952019
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dc3PtMbvjuUb0UT%2Bdx64UDdlP7NACPiXspZH33aqQVjYFAk8cPu%2FpeFlG0GtZe1ZJGp8u4LfbG1611aoX3G5U2XgfOTdt%2Fq%2B4mEpu0uQytvyrIu7XSgsBl2NVAOyGvcduAM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339305688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/829000/829114/medium@2x/1.jpg
104.21.83.6200 OK 30 kB URL GET HTTP/3 img.xxxfiles.tv/829000/829114/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash a3e91c7664b07a26c1d8abe74eebdf7c
aa79c9142afd95de150e6b391cdff615e1060a0d
2254a862e79e66daff88a126459b1c292799cf7d38067c9e78e3f109cef45b99
GET /829000/829114/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 30274
last-modified: Thu, 12 Nov 2020 20:06:12 GMT
etag: "5fad95b4-7642"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2057836
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VcR8t3eTLIoTzJA%2Ft0T72D%2Bca8f5h0lvfN1OZbz%2B%2FLTWNlnDR7C8gDAr1kHQNRKtLnKjiyWRvMu%2F4xqrYEucZqnWY11Bu9EV%2FmZnrsuUl29Qpm9zkM6CyUwzzoa2rCpjkqg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339315688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/153000/153504/medium@2x/1.jpg
104.21.83.6200 OK 33 kB URL GET HTTP/3 img.xxxfiles.tv/153000/153504/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 6b15805b80fd0d985dfce38a9726123e
27c137741274fad89d34f71337adc45df50231bf
4af066f5ad80cc7f69cef232f557f817f932121359567011321845c49448df58
GET /153000/153504/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 33415
last-modified: Sun, 29 Dec 2019 15:17:52 GMT
etag: "5e08c3a0-8287"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2044326
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OaW8Dq%2FuwbXSbiulzCf%2BtQsamwGGyI0FDF7WnoMur8hXkqGcp6lOeXbXoUjbc0Ldr9AOuWqfe89hEjqzsT%2BVIGCvSs4XvH%2FAzPjjIQE00I4d1K02odnaJUHjas3T4hxm0GE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339335688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/339000/339053/medium@2x/1.jpg
104.21.83.6200 OK 38 kB URL GET HTTP/3 img.xxxfiles.tv/339000/339053/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 90173b4a737a05c07d81e32206dbab2e
7d95f42be94074b9420f3d2469adc3b5f8991271
7d21aa428dd5198c03bd43a14a37d0821f3ee9450bb34404ee30b33bf9b40482
GET /339000/339053/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 37952
last-modified: Wed, 05 Jun 2019 05:09:01 GMT
etag: "5cf74e6d-9440"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1862764
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BxOz1e6SVc%2FZcpTh0Tn58WdQG8OHF6zG131lc0vP2CDHdMZtEB6PA3ONJlzyd29Qvnm7jFxViX00YaiX1ELfEQTaUzuGS9kIeB3Box2kOgAdRdVQv99i6R0M6KlKcza2XZI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339345688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/55504000/55504640/medium@2x/1.jpg
104.21.83.6200 OK 66 kB URL GET HTTP/3 img.xxxfiles.tv/55504000/55504640/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash f7ed0e2905099d0cf1111efa87141783
f8b17ba358de413bc10a97320b02165219cd178a
639e1c2bb19de24aa22ed14c7c1061e291c62c0a00d98453818d41a1ba32eca7
GET /55504000/55504640/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 65727
last-modified: Tue, 22 Nov 2022 09:56:28 GMT
etag: "637c9ccc-100bf"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1873153
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2vDNiEmr50uS5bQwUcuBSAOE53IOXZ%2BEy4AyC5Pz543YMIwDh7iTTPH%2Fa%2FTRi49NpCrZyM%2BRqF5%2BQGGinmZclRvNtgx0DWDLG20kABLUkbtnQxJFSVJLGo5HmhShYPsMuf0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339365688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/151000/151454/medium@2x/1.jpg
104.21.83.6200 OK 40 kB URL GET HTTP/3 img.xxxfiles.tv/151000/151454/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash eb106c3d3f9448204067499d9c60fea6
918fd190912da13a09a45cc054b3c9b8ebcae40a
e6538d94204c214c40e9afebdca8ddb1023e651ecc647da98009087035078565
GET /151000/151454/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 40263
last-modified: Fri, 27 Dec 2019 21:33:04 GMT
etag: "5e067890-9d47"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2105483
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mDkUcznTCsCFVktHLCB0t80I3hAxV95da%2Bu2irnkavq3EKePC7ukiuwSCJ3%2BOgNDEGPBPad5TfN5DiGo%2FyzwJgMjZgYURnrDi8wxP5St8wzSuWjn6I8hu0SS2q4ygZIUDNM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339375688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/779000/779364/medium@2x/1.jpg
104.21.83.6200 OK 42 kB URL GET HTTP/3 img.xxxfiles.tv/779000/779364/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash 54fc766223c80f626a9ff586ad70952a
d078c402c5fa6838ea1878297592e541e78bd4a0
227ebcdf47b4b2628cb86bdae8fa53efd9a4476832d4d18cbdce898195569057
GET /779000/779364/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 41657
last-modified: Mon, 09 Nov 2020 19:31:44 GMT
etag: "5fa99920-a2b9"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2049653
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wCB0%2BInqwtasSxTpM3QiWAZZbXIOyL05sfY3v9IW9nBywj8i%2B5gKbomFpzkA4hfosNHQFJxWnFxGb7XeewpyJqe9XwPvrHkZCGypgGkWGTE%2B06cCJkwtbvYr80e1AdA%2BVhY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339385688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/310000/310739/medium@2x/1.jpg
104.21.83.6200 OK 83 kB URL GET HTTP/3 img.xxxfiles.tv/310000/310739/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 312eb875574697443ccba02abc1e4ba8
221e0e92b9b626a02a1f5f719e431a6d8c80b1a1
ad54a37e1be921571625b4a408a7742d9f6e6ff461e7e1bdf294d3e37521ba09
GET /310000/310739/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 82663
last-modified: Tue, 11 Feb 2020 20:49:18 GMT
etag: "5e43134e-142e7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1875031
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wn6TrIOB%2FpGMQ3L0kMwrFBxbfO7Z7O%2F1%2Ftu9pURVu5E4TVHVSTOJCNj6Rpdmw5i8t3Zjbeoo8LcxDsxoFBiDvG4mAFgeQhNoRFCMdt6kRWH5rcoMV%2FbMTBWReYIAB42J8XU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8339395688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/55489000/55489000/medium@2x/1.jpg
104.21.83.6200 OK 23 kB URL GET HTTP/3 img.xxxfiles.tv/55489000/55489000/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash f10a2c74aac30e4d58e85ea173985035
99e5901d7bb3380a9efff6c3ca314d848ca42ae3
7dd89cebb214e12560e2c6837a5fac1f751b87b0e5ad66a9cae9b03ca88ce8e4
GET /55489000/55489000/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 23184
last-modified: Mon, 20 Jun 2022 21:50:16 GMT
etag: "62b0eb98-5a90"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2050900
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mGbty%2FyIzkMPtZ9NOxfULuZPar3yIyxEEa%2BUscWQAgbYjYvfCBlP1TG5aJYYTX5GQ1bcODOB%2FnKVUZG%2B9SHM%2F732giR8t2ln%2Bg7gsF2JUwzP6VDF91PZwWUFncUgarsDjmY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83393a5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/704000/704679/medium@2x/1.jpg
104.21.83.6200 OK 30 kB URL GET HTTP/3 img.xxxfiles.tv/704000/704679/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash 2011fd99e866dd40958bb1ce5493dc2d
bd3dcf950695eb41898821fb71b256f47e62be93
ea23ed7b4c1f089b4ce5b4cef38056ea78a25366a385f1f8493e0eb9c729261d
GET /704000/704679/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 30156
last-modified: Sun, 08 Nov 2020 22:38:21 GMT
etag: "5fa8735d-75cc"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2054637
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=04jIWkgjRV93X5N00pntQWsmbOB0K70TCfb4H2PgXVFsWGX9vJJLOLg1V5bJFXUpu0IB4tSno%2FCJg0J1UMRWNvPburo1uH2wMvG42HUgktQTPT5HTmzkhnsbsgMO%2B9CkHtQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8349495688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/55488000/55488820/medium@2x/1.jpg
104.21.83.6200 OK 57 kB URL GET HTTP/3 img.xxxfiles.tv/55488000/55488820/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.35.100", baseline, precision 8, 744x420, components 3\012- data
Hash 6d42a37036968bc3f4128749db2484d3
f6d38e7db04459c0bac76962952c78d308050b1a
3888bae147978a9e9a1ac5af9a6adfdbbb8a5856f342a544d17ac229917d3d2e
GET /55488000/55488820/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 56747
last-modified: Mon, 20 Jun 2022 21:45:17 GMT
etag: "62b0ea6d-ddab"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1796445
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wMRDovxVbWvNDzK6dLae7BXYauk2Lsid%2F0H6TI%2BSjjcJmeDwUw9ldSs4sjPKPyy2yI0mHCk%2F7pAalf%2F3lT5fBTyXIiXdwgex3vldnW%2FyeO%2FmXan8H656jZpYQgo6Is976uw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83494b5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/153000/153368/medium@2x/1.jpg
104.21.83.6200 OK 31 kB URL GET HTTP/3 img.xxxfiles.tv/153000/153368/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 678323dcac1db40b9b2b0d926aaa7cc4
c4db4430a136cbfcefa4e12402fd014718b8dd99
716d16a992d3f859f491342f2a8fa14a7cf69f378c3295c679db5381619ef6b5
GET /153000/153368/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 30833
last-modified: Sun, 29 Dec 2019 15:05:37 GMT
etag: "5e08c0c1-7871"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2042744
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1S99UQATDQ5p8sH7P0q2mE3cvTtDBIZB1y3obCp1uN56%2FW39z7HoU2U%2BMlt29zIz7IJOhCk5oLcLy8vgb8ebreTeGE7TOxGhogpzzzKMeddXJ3H5SG5wJQX6rDXNJkr2WwE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83696a5688-OSL
alt-svc: h3=":443"; ma=86400
img.xxxfiles.tv/218000/218473/medium@2x/1.jpg
104.21.83.6200 OK 59 kB URL GET HTTP/3 img.xxxfiles.tv/218000/218473/medium@2x/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 744x420, components 3\012- data
Hash 7551c7a2c46746b8fa5a1664a14b8358
1704c4d389cf8c1b2eb36f450103688b875a6c37
7bc0cfd3f6339cf2c759c2db5c0db461e557dc797850ec15ad87773a22fadb79
GET /218000/218473/medium@2x/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: image/jpeg
content-length: 59083
last-modified: Wed, 29 Jan 2020 19:32:22 GMT
etag: "5e31ddc6-e6cb"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIvHxZexNe7VVAIxfKfpGyCQPT%2FU86OAZQ6TfGsvpmgnKP%2BxZsAl%2FZyz8CJ%2Fr5ZHiZTVhrqU96vHhmeKobJgfinqgpDyKf3SK%2FigmndJuqpnkbHfT7HW9r%2F2YL6O%2FJwwXac%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f83392e5688-OSL
alt-svc: h3=":443"; ma=86400
vjs.zencdn.net/7.5.5/video-js.css
151.101.130.217200 OK 10 kB URL GET HTTP/2 vjs.zencdn.net/7.5.5/video-js.css
IP 151.101.130.217:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGlobalSign nv-sa
Subjectvjs.zencdn.net
FingerprintF0:70:0B:AF:84:8A:AB:25:98:72:B0:E7:EE:F8:2C:2C:6B:58:8E:4E
ValiditySat, 03 Jun 2023 21:48:23 GMT - Thu, 04 Jul 2024 21:48:22 GMT
File type ASCII text, with very long lines (5636)
Hash 29daa9b197765c0111b16939ce1264a9
d8ee7d372482beea64fc1ce2c520702f72632bf1
f53fc4c5e613265564b6bbd94ae0af0ba9cb6c31ba804193b0fa548b96f6ee08
GET /7.5.5/video-js.css HTTP/1.1
Host: vjs.zencdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Thu, 13 Jun 2019 18:18:21 GMT
etag: "29daa9b197765c0111b16939ce1264a9"
cache-control: public, max-age=31536000
content-type: text/css; charset=utf-8
content-encoding: gzip
date: Sat, 18 Nov 2023 21:40:39 GMT
x-served-by: cache-bma1670-BMA
x-cache: HIT
x-cache-hits: 192
vary: Accept-Encoding
access-control-allow-origin: *
timing-allow-origin: *
content-length: 10533
X-Firefox-Spdy: h2
cdn.jsdelivr.net/npm/silvermine-videojs-quality-selector@1.1.2/dist/css/quality-selector.min.css
151.101.193.229200 OK 375 B URL GET HTTP/2 cdn.jsdelivr.net/npm/silvermine-videojs-quality-selector@1.1.2/dist/css/quality-selector.min.css
IP 151.101.193.229:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT
File type ASCII text, with very long lines (449)
Hash ab70ea10db46a2b5fe2f7890b1f3a752
acb58a65732d4d7daf6c663aae785750461a2b1f
bbd9db8e1c208458a477d2d4bf7187b0fdf46ed806104228f278aeda0cf91cf4
GET /npm/silvermine-videojs-quality-selector@1.1.2/dist/css/quality-selector.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 1.1.2
x-jsd-version-type: version
etag: W/"299-rLWKZXMtTX2vbGY6rnhXUEYaKx8"
content-encoding: br
accept-ranges: bytes
date: Sat, 18 Nov 2023 21:40:39 GMT
age: 21458454
x-served-by: cache-fra-eddf8230075-FRA, cache-bma1638-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 375
X-Firefox-Spdy: h2
vjs.zencdn.net/7.5.5/video.min.js
151.101.130.217200 OK 139 kB URL GET HTTP/2 vjs.zencdn.net/7.5.5/video.min.js
IP 151.101.130.217:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGlobalSign nv-sa
Subjectvjs.zencdn.net
FingerprintF0:70:0B:AF:84:8A:AB:25:98:72:B0:E7:EE:F8:2C:2C:6B:58:8E:4E
ValiditySat, 03 Jun 2023 21:48:23 GMT - Thu, 04 Jul 2024 21:48:22 GMT
File type Unicode text, UTF-8 text, with very long lines (65133)
Size 139 kB (139372 bytes)
Hash abf127b5ab0bb498119a93890119a660
86083627a04fe65a9ff242a3edb746b94da084a8
4122c012e6c8aba50f529e47785cd402e2b1f6dc1c643907a9fb65375d5cee11
GET /7.5.5/video.min.js HTTP/1.1
Host: vjs.zencdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Thu, 13 Jun 2019 18:18:22 GMT
etag: "abf127b5ab0bb498119a93890119a660"
cache-control: public, max-age=31536000
content-type: application/javascript; charset=utf-8
content-encoding: gzip
date: Sat, 18 Nov 2023 21:40:39 GMT
x-served-by: cache-bma1670-BMA
x-cache: HIT
x-cache-hits: 1
vary: Accept-Encoding
access-control-allow-origin: *
timing-allow-origin: *
content-length: 139372
X-Firefox-Spdy: h2
cdn.jsdelivr.net/npm/js-cookie@2/src/js.cookie.min.js
151.101.193.229200 OK 1.1 kB URL GET HTTP/2 cdn.jsdelivr.net/npm/js-cookie@2/src/js.cookie.min.js
IP 151.101.193.229:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT
File type ASCII text, with very long lines (1619)
Hash 45f12de4d7b95a193ecdc5cfde664bb9
ee9541cf1a95d2a885f8b143a105caaa08ca9c9d
39b8fe6364621725ff90431a34af0f87976d95c00cbfd1d0f3711a3f1fa1a07b
GET /npm/js-cookie@2/src/js.cookie.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 2.2.1
x-jsd-version-type: version
etag: W/"79f-7pVBzxqV0qiF+LFDoQXKqgjKnJ0"
content-encoding: br
accept-ranges: bytes
date: Sat, 18 Nov 2023 21:40:39 GMT
age: 6144
x-served-by: cache-fra-eddf8230099-FRA, cache-bma1638-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1078
X-Firefox-Spdy: h2
game.starswalker.site/WMLj7S7.js
135.181.208.216200 OK 76 kB URL GET HTTP/2 game.starswalker.site/WMLj7S7.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 1cfdb6417dc1739fe5b3ac061cc76d31
2ee92606b2aa59d585d4826fd9a57fb73c9de1ec
09a63fd8278f241f3aff23d23ebb1e2b8c4a9156d1744c3f33625083b06a2abc
GET /WMLj7S7.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 76107
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-1294b"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 166
cf-ray: 822619a548ca70fb-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/Qa9gbH3.js
135.181.208.216200 OK 76 kB URL GET HTTP/2 game.starswalker.site/Qa9gbH3.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 1cfdb6417dc1739fe5b3ac061cc76d31
2ee92606b2aa59d585d4826fd9a57fb73c9de1ec
09a63fd8278f241f3aff23d23ebb1e2b8c4a9156d1744c3f33625083b06a2abc
GET /Qa9gbH3.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 76107
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-1294b"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 166
cf-ray: 822619a548ca70fb-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/XEXvawa.js
135.181.208.216200 OK 87 kB URL GET HTTP/2 game.starswalker.site/XEXvawa.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 23d2be590701c0431e43f31eafbf99b6
11e15c74725979358fdbb29e2b92c57163b8f510
d1832397628b9b48084c859c5a2b0238e3d32f85d1aecc748106da43be0e87b9
GET /XEXvawa.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 86725
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-152c5"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 232
cf-ray: 823c2b4099b870f8-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/8sq5gA5.js
135.181.208.216200 OK 76 kB URL GET HTTP/2 game.starswalker.site/8sq5gA5.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 1cfdb6417dc1739fe5b3ac061cc76d31
2ee92606b2aa59d585d4826fd9a57fb73c9de1ec
09a63fd8278f241f3aff23d23ebb1e2b8c4a9156d1744c3f33625083b06a2abc
GET /8sq5gA5.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 76107
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-1294b"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 166
cf-ray: 822619a548ca70fb-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/cZAjeQ7.js
135.181.208.216200 OK 76 kB URL GET HTTP/2 game.starswalker.site/cZAjeQ7.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 1cfdb6417dc1739fe5b3ac061cc76d31
2ee92606b2aa59d585d4826fd9a57fb73c9de1ec
09a63fd8278f241f3aff23d23ebb1e2b8c4a9156d1744c3f33625083b06a2abc
GET /cZAjeQ7.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 76107
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-1294b"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 166
cf-ray: 822619a548ca70fb-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/Ka0q1Ad.js
135.181.208.216200 OK 87 kB URL GET HTTP/2 game.starswalker.site/Ka0q1Ad.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 23d2be590701c0431e43f31eafbf99b6
11e15c74725979358fdbb29e2b92c57163b8f510
d1832397628b9b48084c859c5a2b0238e3d32f85d1aecc748106da43be0e87b9
GET /Ka0q1Ad.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 86725
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-152c5"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 232
cf-ray: 823c2b4099b870f8-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/PXXlKV5.js
135.181.208.216200 OK 76 kB URL GET HTTP/2 game.starswalker.site/PXXlKV5.js
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Hash 1cfdb6417dc1739fe5b3ac061cc76d31
2ee92606b2aa59d585d4826fd9a57fb73c9de1ec
09a63fd8278f241f3aff23d23ebb1e2b8c4a9156d1744c3f33625083b06a2abc
GET /PXXlKV5.js HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
content-length: 76107
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-1294b"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 166
cf-ray: 822619a548ca70fb-HEL
x-frame-options: DENY
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2
aibsgc.com/av/1150082/inp3.js
95.216.206.230200 OK 205 kB URL GET HTTP/1.1 aibsgc.com/av/1150082/inp3.js
IP 95.216.206.230:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectaibsgc.com
FingerprintAA:E0:15:CB:09:39:12:50:2B:AF:47:C2:5D:57:26:C6:C9:D9:42:43
ValidityThu, 19 Oct 2023 07:55:06 GMT - Wed, 17 Jan 2024 07:55:05 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 205 kB (204807 bytes)
Hash a06fbf7e1d4badb2d2fa6f8da02233fe
fc983ea25650b6d51cd0b7cea249b56b978a7d37
0428f7d78b976e79a4a360f9df2b8588d85dd74cc5beec81f07a98a6e56466eb
GET /av/1150082/inp3.js HTTP/1.1
Host: aibsgc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:40 GMT
Content-Type: application/javascript
Content-Length: 204807
Last-Modified: Fri, 17 Nov 2023 16:44:53 GMT
Connection: keep-alive
ETag: "65579885-32007"
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Referrer-Policy: strict-origin
Accept-Ranges: bytes
fonts.googleapis.com/css?family=Roboto:300,400,700
142.250.74.106200 OK 1.2 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700
IP 142.250.74.106:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type gzip compressed data, max compression\012- data
Hash f68b59a896eefd43c70cdce44e63a9e8
afdf80a3bb9792132bcbc4061f8b02d876af3613
1102287a695e525d5ab0ec7dfd3d1db0624ea827762c7685996be5c45155dced
GET /css?family=Roboto:300,400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 18 Nov 2023 21:40:40 GMT
date: Sat, 18 Nov 2023 21:40:40 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
badgegirdle.com/63/d4/5b/63d45b685911cef3b8cc3d1d1550bf85.js
192.243.59.12200 OK 23 kB URL GET HTTP/1.1 badgegirdle.com/63/d4/5b/63d45b685911cef3b8cc3d1d1550bf85.js
IP 192.243.59.12:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subject*.badgegirdle.com
FingerprintAB:89:96:23:3F:AC:ED:57:CB:A7:B1:7A:9D:D9:46:F0:2A:46:62:40
ValidityMon, 02 Oct 2023 06:08:16 GMT - Sun, 31 Dec 2023 06:08:15 GMT
File type ASCII text, with very long lines (59094), with no line terminators
Hash 210dfdf32378bd6c04510ac1cf7b0d70
65690b10d7f0b85b12d68527e3f2d3a469a08b33
6746561e32db0b60837104591e731220d4a7c3b232e018c41a86c57e8eff2d78
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /63/d4/5b/63d45b685911cef3b8cc3d1d1550bf85.js HTTP/1.1
Host: badgegirdle.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:40 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 09bbf01bbbda820a0fec247a347c3bdd
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
www.xxxfiles.tv/img/logo.png?v=3
104.21.83.6200 OK 24 kB URL GET HTTP/3 www.xxxfiles.tv/img/logo.png?v=3
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type PNG image data, 520 x 156, 8-bit/color RGBA, non-interlaced\012- data
Hash 9822997e90cc16212365e3cb4ce8271c
abdbe5c5e45ce673d6544f560ad8ea38639b78a7
504871362cd7d2f604b1b6cb99ebf785c53ee84f4cf19d029ec9c99b07e9611b
GET /img/logo.png?v=3 HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/css/main.css
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154; show_pops2=true2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: image/png
content-length: 23819
last-modified: Fri, 13 Dec 2019 13:17:37 GMT
etag: "5df38f71-5d0b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1971905
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F1f%2B69Ptq0pDUyr6WDPBak04eehE6VG3TuJVDhovlwKq2HVSOqw2jvsK%2F1%2Ff%2FZZlsOhV5iOmA%2B9mxPRTZMW1tNIp%2Bd3U%2FD2DkrlVRtMNiW9Zbh6jWNfbw0CTZUFtj7gDY68%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8d28fc5688-OSL
alt-svc: h3=":443"; ma=86400
game.starswalker.site/api/spots/329587?p=1&s1=%subid1%&kw=
135.181.208.216200 OK 23 kB URL GET HTTP/2 game.starswalker.site/api/spots/329587?p=1&s1=%subid1%&kw=
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash 7a8faef42d4e33ade2ae74c466b8f264
4f32d51dc351113b041614af6d7e9a2e3e8697ea
637372649f181c87602b1180f61545922a8c177dab7bfc7730f7672643a315bd
GET /api/spots/329587?p=1&s1=%subid1%&kw= HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: nauid=ghOdILfP107IVSlEawA2; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
135.181.208.216200 OK 20 kB URL GET HTTP/2 game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash c6dc258227ce1c843f3ce4d034e70f3e
da4dfb3bb8e71db62aa4048dac4d58ed28f97b0f
9766af02a192f8653a000fcf76f4b8a4c009675c48b01aa099bf817fc52367ad
GET /api/spots/329584?p=1&s1=%subid1%&kw= HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: nauid=5NVDHGqwNfLsrIjwscpj; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
142.250.74.163200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP 142.250.74.163:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Nov 2023 05:05:31 GMT
expires: Fri, 15 Nov 2024 05:05:31 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
age: 232510
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
142.250.74.163200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP 142.250.74.163:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 15 Nov 2023 21:52:12 GMT
expires: Thu, 14 Nov 2024 21:52:12 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 258509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js
142.250.74.106200 OK 33 kB URL GET HTTP/3 ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js
IP 142.250.74.106:443
Requested by https://game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (32086)
Hash 8101d596b2b8fa35fe3a634ea342d7c3
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
GET /ajax/libs/jquery/1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 33434
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Nov 2023 15:37:33 GMT
expires: Fri, 15 Nov 2024 15:37:33 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 194588
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cdn.tapioni.com/adgpt.js
104.22.38.71200 OK 814 B IP 104.22.38.71:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint67:5F:F1:E0:0C:5E:00:4E:6A:BF:B1:5F:40:29:66:0E:3F:9C:24:5F
ValidityWed, 30 Aug 2023 00:00:00 GMT - Thu, 29 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (2016), with no line terminators
Hash 05e1e405476171c5a42262d3cd106c26
faa3d9257050b15bfa335c376e0216a9f6c0c101
5f1693d43592f90bdbd5488cbb7118b3ec3d4d903f7f4ef0f910d6e479f2e790
GET /adgpt.js HTTP/1.1
Host: cdn.tapioni.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: application/javascript
content-length: 814
last-modified: Tue, 07 Nov 2023 13:54:27 GMT
vary: Accept-Encoding
etag: "654a4193-32e"
content-encoding: gzip
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-cache-status: HIT
age: 470950
accept-ranges: bytes
server: cloudflare
cf-ray: 82835f91cee40a30-ARN
X-Firefox-Spdy: h2
xngqoc.com/er?a=1
185.162.85.4200 OK 0 B IP 185.162.85.4:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectxngqoc.com
Fingerprint72:3D:8C:DE:14:53:13:4C:23:00:B1:8D:16:EC:18:3F:17:95:FC:09
ValidityTue, 29 Aug 2023 01:02:29 GMT - Mon, 27 Nov 2023 01:02:28 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /er?a=1 HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:42 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
X-Firefox-Spdy: h2
xngqoc.com/cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0NDU2NDMsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8=
185.162.85.4204 No Content 0 B URL GET HTTP/2 xngqoc.com/cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0NDU2NDMsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8=
IP 185.162.85.4:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectxngqoc.com
Fingerprint72:3D:8C:DE:14:53:13:4C:23:00:B1:8D:16:EC:18:3F:17:95:FC:09
ValidityTue, 29 Aug 2023 01:02:29 GMT - Mon, 27 Nov 2023 01:02:28 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /cuload?a=1&e=aeyJwaWQiOjExNDQ2NDYsInNpZCI6MTE5MDM3NSwid2lkIjo0NDU2NDMsImQiOiIiLCJsaSI6MX0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8= HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:42 GMT
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2
www.xxxfiles.tv/css/main.css
104.21.83.6200 OK 12 kB URL GET HTTP/3 www.xxxfiles.tv/css/main.css
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type assembler source, ASCII text, with very long lines (492)
Hash f2acc5750c70ce7508edcacb053ddda2
93cbb3c6fa87587f1c1c09ad44e7769ca8f41ea5
762a4d48cacd0adbc7d45e1feec08bc734ceeab368130560d57154d8c9d4a1fd
GET /css/main.css HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: text/css
last-modified: Mon, 23 May 2022 12:38:16 GMT
vary: Accept-Encoding
etag: W/"628b8038-12e50"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2042026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vCml9GJOdxly7Ak4A%2F8paa3b4x99tWSeo5tCmoTA6wMOUXZcmVFY2uB2gsjz59bn4YI6EL1HIDP5gCYcjnLBOVr7pXrhDa%2BvcQtJZNNakyMQIdnCf2cTUta9Hp0yfw1WHDc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82a89f5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
unpkg.com/silvermine-videojs-quality-selector/dist/js/silvermine-videojs-quality-selector.min.js
104.16.125.175302 Found 115 B URL GET HTTP/2 unpkg.com/silvermine-videojs-quality-selector/dist/js/silvermine-videojs-quality-selector.min.js
IP 104.16.125.175:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5ceab052486e6dab0266b2d2cff67ac9
c2e74da99492d77601aa241697d19f8c5c5ad447
f3fc046482861a4a86a4470137ecba208fc912bfdd68ffdc83c65fc623ff9cf1
GET /silvermine-videojs-quality-selector/dist/js/silvermine-videojs-quality-selector.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /silvermine-videojs-quality-selector@1.1.2/dist/js/silvermine-videojs-quality-selector.min.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01HFJ5VBQYZ791PPKT5Y34720P-arn
cf-cache-status: HIT
age: 213
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 82835f83089a5685-OSL
X-Firefox-Spdy: h2
s.orbsrv.com/v1/api.php
95.211.229.247200 OK 1.3 kB IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type JSON data\012- , ASCII text, with very long lines (1735), with no line terminators
Hash 22ad0f65c579fe177c18d2560c8ebb28
3129b798c432f133fae7ba6e473c11bf017876a8
b2579e0df5be8cf1f0330ea768ae74e7ff6f1a598dd5ee5bf0d4b1b39b788169
POST /v1/api.php HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 320
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Request-Method: POST
Access-Control-Allow-Credentials: true
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a0a1bc7.17919299309521385%22%3B%7D; expires=Mon, 17-Nov-2025 21:40:42 GMT; Max-Age=63072000; path=/; domain=orbsrv.com; secure; SameSite=None
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
s.orbsrv.com/v1/api.php
95.211.229.247200 OK 2.9 kB IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type JSON data\012- , ASCII text, with very long lines (6168), with no line terminators
Hash 5ff283b3b40d1620a8fce4cea9d1bb22
beb80bfa1ed449c7c4d6143876ae1ebba17ac80c
66417f6d852344ce6790f273f03388274d5745b556b78c12085fe85a12add1bb
POST /v1/api.php HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 320
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Request-Method: POST
Access-Control-Allow-Credentials: true
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5a0b1e53.021483711918359890%22%3B%7D; expires=Mon, 17-Nov-2025 21:40:42 GMT; Max-Age=63072000; path=/; domain=orbsrv.com; secure; SameSite=None
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
s.orbsrv.com/v1/api.php
95.211.229.247200 OK 3.0 kB IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type JSON data\012- , ASCII text, with very long lines (6537), with no line terminators
Hash 56dc74c14b3089200f9131ab5774b1ab
521ff9f602be855c3d2d67d4545cdc6706ed91d4
d042ff438021e1725d5f2c49d0d34d3492a9bff2c2b45a4d22bd7137527cae01
POST /v1/api.php HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 320
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Request-Method: POST
Access-Control-Allow-Credentials: true
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a1a30f4.65625540325315022%22%3B%7D; expires=Mon, 17-Nov-2025 21:40:42 GMT; Max-Age=63072000; path=/; domain=orbsrv.com; secure; SameSite=None
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
ocsp.r2m03.amazontrust.com/
54.230.218.11 471 B URL ocsp.r2m03.amazontrust.com/
IP 54.230.218.11:0
Hash 56e21383419bb553268c4c2b0684a8f2
0af446fda92e9e5d699073a6ee4c27bc6fad0a38
21fef66dd14d181b2d0c3fc76cdee0e5a050a05e91c75edb30cd8ea9546aed65
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 18 Nov 2023 21:40:42 GMT
Last-Modified: Sat, 18 Nov 2023 21:15:02 GMT
Server: ECAcc (ska/F776)
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: J6urGUpEjuNjJAfrRndJ0_mxJNm9AhV537lHF9ZOwTOPQ4_u5S0vHg==
Age: 1540
game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
135.181.208.216200 OK 4.1 kB URL GET HTTP/2 game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source, ASCII text, with very long lines (712)
Hash afbd336b9119fabf5be16644cf21713a
2a5a114a329c64cf6fc073046f906fc0d72c76ee
cd273deb23e57c1d4c47940d665d52c5d817bee641238be8a18df89e8521c464
GET /api/spots/329586?p=1&s1=%subid1%&kw= HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
52.59.122.145200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP 52.59.122.145:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5353d2f9a5d16ef82c9c0ea39f90faf4
e28fc93a2b22533e0869bdef2b157fe2c4948807
6639b072dd56a3f7f73c79c27e5a700793a67c89e3bd5184f805f2870522fd65
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.xxxfiles.tv
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=28c7e8cf-920a-425f-b7d7-3ecde0f957de:1:1; expires=Tue, 15 Nov 2033 21:40:42 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
www.xxxfiles.tv/js/kvs/main.min.js
104.21.83.6200 OK 87 kB URL GET HTTP/3 www.xxxfiles.tv/js/kvs/main.min.js
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type ASCII text, with very long lines (32089)
Hash bbfc761f3a524e108e25fc8c5451ef5b
0daaa3873cada1fd1283409fa6729249c51c404d
c6900d97762ace02398d34ae5bed95f7b4765c74353b1fde456fa352d070a119
GET /js/kvs/main.min.js HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
last-modified: Wed, 20 Nov 2019 11:57:15 GMT
vary: Accept-Encoding
etag: W/"5dd52a1b-412c8"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1976849
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3FgjrrExoXj2Oqh6tFLaOHJSCKwBLZZyfTB%2FsYlTGa9ZXaQkfusqk0PgPVzzpC7DUYk8dvP9DOsO1ZebqOXViCz8m%2BSs2EVlScsr22SMHhXdumZ6SuXewkjT7RdkOKE7BKk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82a8a35688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320&video_id=218473&mode=async&action=js_stats&rand=1700343643464
104.21.83.6200 OK 43 B URL GET HTTP/3 www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320&video_id=218473&mode=async&action=js_stats&rand=1700343643464
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 57f187c7a868faeac558007a8eb6cb2e
11ab10ab109fdb53d91d444ac781101f5a6360c6
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
GET /videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320&video_id=218473&mode=async&action=js_stats&rand=1700343643464 HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154; show_pops2=true2; show_pops1=true1; pp_show_on_63d45b685911cef3b8cc3d1d1550bf85=1; kt_tcookie=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: image/gif
content-length: 43
set-cookie: kt_is_visited=1; expires=Sun, 19-Nov-2023 21:40:42 GMT; Max-Age=86400; path=/; domain=.xxxfiles.tv; SameSite=Lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EWD6a4tdG%2BJ5q84oWJnVRwfE6CYYR6olsHchIqlZlgYzAW5HnggSKWpUdrkhhq%2FCsJVHB7feEFK0QHKoC0N%2BH7LZNBebSv3YgmzTMfJ2OtqUJEGyp2gmtBlGs8nO3dX0wmM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f942ea55688-OSL
alt-svc: h3=":443"; ma=86400
s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz1OW04DMQy8Chdo5Fdip9/wC1JRD5BN0wpBu6hbCZB8eJIF1Zas0dgzYwLiDeIG7QHTVmAr5BlDhiAUMIo/v+xc0D/n6+U0hzqfPREnRCdGVXKDbKYujGjZPII5Z4w5WZeZspE4RmeH3hRZZKAAAOQa/Wm/8/3rY2cyx+TdFrzPkTogdQzfQzqxplgPOKnVAhzVhPUwZeWJoeY2Dv1Uzi0st3JdvsrHe7uG5e3W1uQ1k8cv3RPuvRkqRukb8V7gK12Wn0t1v5/9Pe1x1RI55X8XdM9kJRVtqkVjrIljPFTJ0upxOlpqv2bAtYBiAQAA
95.211.229.247200 OK 20 B URL GET HTTP/1.1 s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz1OW04DMQy8Chdo5Fdip9/wC1JRD5BN0wpBu6hbCZB8eJIF1Zas0dgzYwLiDeIG7QHTVmAr5BlDhiAUMIo/v+xc0D/n6+U0hzqfPREnRCdGVXKDbKYujGjZPII5Z4w5WZeZspE4RmeH3hRZZKAAAOQa/Wm/8/3rY2cyx+TdFrzPkTogdQzfQzqxplgPOKnVAhzVhPUwZeWJoeY2Dv1Uzi0st3JdvsrHe7uG5e3W1uQ1k8cv3RPuvRkqRukb8V7gK12Wn0t1v5/9Pe1x1RI55X8XdM9kJRVtqkVjrIljPFTJ0upxOlpqv2bAtYBiAQAA
IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /cimp.php?t=api&data=H4sIAAAAAAAAAz1OW04DMQy8Chdo5Fdip9/wC1JRD5BN0wpBu6hbCZB8eJIF1Zas0dgzYwLiDeIG7QHTVmAr5BlDhiAUMIo/v+xc0D/n6+U0hzqfPREnRCdGVXKDbKYujGjZPII5Z4w5WZeZspE4RmeH3hRZZKAAAOQa/Wm/8/3rY2cyx+TdFrzPkTogdQzfQzqxplgPOKnVAhzVhPUwZeWJoeY2Dv1Uzi0st3JdvsrHe7uG5e3W1uQ1k8cv3RPuvRkqRukb8V7gK12Wn0t1v5/9Pe1x1RI55X8XdM9kJRVtqkVjrIljPFTJ0upxOlpqv2bAtYBiAQAA HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a1a30f4.65625540325315022%22%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Credentials: true
Set-Cookie: __upt=%7B%22v%22%3A1%2C%22id%22%3A%220%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.0199%22%7D; expires=Mon, 17 Nov 2025 21:40:42 GMT; path=/; domain=.orbsrv.com; Secure; SameSite=none
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
s3t3d2y8.afcdn.net/library/623611/1d086ee530ffd2df0ad79a4430c5284ea0bf43a1.webp
185.76.9.16200 OK 14 kB URL GET HTTP/2 s3t3d2y8.afcdn.net/library/623611/1d086ee530ffd2df0ad79a4430c5284ea0bf43a1.webp
IP 185.76.9.16:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectafcdn.net
Fingerprint23:5D:B4:21:E2:4A:BC:A2:81:F9:7D:F8:B1:5C:6C:1D:7D:F3:FC:C8
ValidityThu, 05 Oct 2023 14:56:57 GMT - Wed, 03 Jan 2024 14:56:56 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 4c844d5a19386b984d862c88ff15dd0f
1d086ee530ffd2df0ad79a4430c5284ea0bf43a1
5be93e78e93fcb00f0445cd83b9d55ad0d54aacddbd782b46286574a5b68a535
GET /library/623611/1d086ee530ffd2df0ad79a4430c5284ea0bf43a1.webp HTTP/1.1
Host: s3t3d2y8.afcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: image/webp
content-length: 14308
last-modified: Wed, 03 Nov 2021 19:23:20 GMT
etag: "6182e1a8-37e4"
expires: Wed, 25 Oct 2023 05:55:25 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-robots-tag: noindex, follow
x-cache-op: HIT
server: CDN77-Turbo
x-77-nzt: AblMCQ03Nzf/MGjHAQ
x-77-nzt-ray: c0a4cc2899566bf15a2f5965740e1418
x-accel-expires: @1702034090
x-accel-date: 1670498090
x-cache-lb: HIT
x-age-lb: 29845552
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 29845552
accept-ranges: bytes
X-Firefox-Spdy: h2
game.starswalker.site/api/users/320559?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1
135.181.208.216200 OK 28 kB URL GET HTTP/2 game.starswalker.site/api/users/320559?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash a2265473eee5f0ab85ed22a527952464
6a1dd2cb467fccd90520b5b883cf3d1792b7767a
8c153be42c1d775b39510ed9793fde725cac8e4a6b99c1fd6647017c0893ed3c
GET /api/users/320559?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
access-control-expose-headers: X-Asg-Config, X-t
x-robots-tag: noindex, nofollow
x-t: 0
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/click/10127958543113713095?c=90
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/10127958543113713095?c=90
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/10127958543113713095?c=90 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:42 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz1O7UrEQAx8FV+gSz53s/fb+6twcg/QbttD9K7SHqiQh3e3qAkkwzCTCQFxh9ihPWA8CByEPGPIEIQCqvjT88kF/WNZb5cllOXqkTgiOjGmRG6QzZILI2YgVzDnjJqjVZslNhRHdXaoTcoiDQWAKk7qx/PJzy+Plcms0etZ8DpbaoNUMXw1K5gKaTGbZI6Qy4gEZSiDzjzICNyEfumvU9ju/bp99u9v0xq21/u0J++ZHKUl/BG1u+ZiFKb6Vy3wne6371tx/5ex7Ut3L5FT/r2C7vUhTDqnORqgzsVK388SWWUaBzP6AcYOIyFiAQAA
95.211.229.247200 OK 20 B URL GET HTTP/1.1 s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz1O7UrEQAx8FV+gSz53s/fb+6twcg/QbttD9K7SHqiQh3e3qAkkwzCTCQFxh9ihPWA8CByEPGPIEIQCqvjT88kF/WNZb5cllOXqkTgiOjGmRG6QzZILI2YgVzDnjJqjVZslNhRHdXaoTcoiDQWAKk7qx/PJzy+Plcms0etZ8DpbaoNUMXw1K5gKaTGbZI6Qy4gEZSiDzjzICNyEfumvU9ju/bp99u9v0xq21/u0J++ZHKUl/BG1u+ZiFKb6Vy3wne6371tx/5ex7Ut3L5FT/r2C7vUhTDqnORqgzsVK388SWWUaBzP6AcYOIyFiAQAA
IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /cimp.php?t=api&data=H4sIAAAAAAAAAz1O7UrEQAx8FV+gSz53s/fb+6twcg/QbttD9K7SHqiQh3e3qAkkwzCTCQFxh9ihPWA8CByEPGPIEIQCqvjT88kF/WNZb5cllOXqkTgiOjGmRG6QzZILI2YgVzDnjJqjVZslNhRHdXaoTcoiDQWAKk7qx/PJzy+Plcms0etZ8DpbaoNUMXw1K5gKaTGbZI6Qy4gEZSiDzjzICNyEfumvU9ju/bp99u9v0xq21/u0J++ZHKUl/BG1u+ZiFKb6Vy3wne6371tx/5ex7Ut3L5FT/r2C7vUhTDqnORqgzsVK388SWWUaBzP6AcYOIyFiAQAA HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a1a30f4.65625540325315022%22%3B%7D; __upt=%7B%22v%22%3A1%2C%22id%22%3A%220%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.0199%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Credentials: true
Set-Cookie: __upt=%7B%22v%22%3A1%2C%22id%22%3A%220%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.029701%22%7D; expires=Mon, 17 Nov 2025 21:40:42 GMT; path=/; domain=.orbsrv.com; Secure; SameSite=none
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
s3t3d2y8.afcdn.net/library/623611/26c94b1b9322fb1f2558083727af47e58151007e.webp
185.76.9.16200 OK 6.8 kB URL GET HTTP/2 s3t3d2y8.afcdn.net/library/623611/26c94b1b9322fb1f2558083727af47e58151007e.webp
IP 185.76.9.16:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectafcdn.net
Fingerprint23:5D:B4:21:E2:4A:BC:A2:81:F9:7D:F8:B1:5C:6C:1D:7D:F3:FC:C8
ValidityThu, 05 Oct 2023 14:56:57 GMT - Wed, 03 Jan 2024 14:56:56 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash ac7f0a83b67d9661811c62d68cdd2074
26c94b1b9322fb1f2558083727af47e58151007e
24c3c958813cf663205712c9a41003d3c5f304d3a90301d63847ab46047fc66f
GET /library/623611/26c94b1b9322fb1f2558083727af47e58151007e.webp HTTP/1.1
Host: s3t3d2y8.afcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: image/webp
content-length: 6782
last-modified: Wed, 03 Nov 2021 19:29:43 GMT
etag: "6182e327-1a7e"
expires: Tue, 24 Oct 2023 13:31:49 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-robots-tag: noindex, follow
x-cache-op: HIT
server: CDN77-Turbo
x-77-nzt: AblMCQ03Nzf/5nfFAQ
x-77-nzt-ray: c0a4cc2899566bf15a2f5965804eb91e
x-accel-expires: @1702161140
x-accel-date: 1670625140
x-cache-lb: HIT
x-age-lb: 29718502
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 29718502
accept-ranges: bytes
X-Firefox-Spdy: h2
s3t3d2y8.afcdn.net/library/623611/2278481571affd0d06433855ece073cb06237a2a.webp
185.76.9.16200 OK 6.1 kB URL GET HTTP/2 s3t3d2y8.afcdn.net/library/623611/2278481571affd0d06433855ece073cb06237a2a.webp
IP 185.76.9.16:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectafcdn.net
Fingerprint23:5D:B4:21:E2:4A:BC:A2:81:F9:7D:F8:B1:5C:6C:1D:7D:F3:FC:C8
ValidityThu, 05 Oct 2023 14:56:57 GMT - Wed, 03 Jan 2024 14:56:56 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 6fa982653e11bf92f711f516bff7cc24
2278481571affd0d06433855ece073cb06237a2a
4ec89f5331b8e33f6ba993e5e835df7b3a008ee32ab12dcca448781bca935a97
GET /library/623611/2278481571affd0d06433855ece073cb06237a2a.webp HTTP/1.1
Host: s3t3d2y8.afcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: image/webp
content-length: 6076
last-modified: Wed, 03 Nov 2021 19:29:43 GMT
etag: "6182e327-17bc"
expires: Wed, 25 Oct 2023 01:17:49 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-robots-tag: noindex, follow
x-cache-op: HIT
server: CDN77-Turbo
x-77-nzt: AblMCQ03Nzf/yIXHAQ
x-77-nzt-ray: c0a4cc2899566bf15a2f5965a0b9cf23
x-accel-expires: @1702026514
x-accel-date: 1670490514
x-cache-lb: HIT
x-age-lb: 29853128
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 29853128
accept-ranges: bytes
X-Firefox-Spdy: h2
s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz2Pa0oDQRCEr+IFMvRztju/9a9CJAeY7COIJpFsQIU+vL3rYxqGopiq+ZqAeIO4QbvDuhXYCoVjcShCBVXi8WkXgvF+uZ6Pl9JfTlGJK2IQY9dRGLhZF8IoChIKFuyoXi1j1rEJBGpwQA4piyyqAABFp/Gw38X++T4dZ62RtRB5L78uklLDJ0RVdZq0YWOYpFStpCrAWYgKlFVgw4QOos3tMPS9D61psrW+jt6mpSeO7TSW+dau80d7ex2vZX65jSvYisTiC8CfkbNZUrkZU2LngVjtNn+d+4j/Zz87ha7ZhCH/bcEIO9ihG8RGxNZs5KHKpDa5Env1afgGqUJelIEBAAA=
95.211.229.247200 OK 20 B URL GET HTTP/1.1 s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAAz2Pa0oDQRCEr+IFMvRztju/9a9CJAeY7COIJpFsQIU+vL3rYxqGopiq+ZqAeIO4QbvDuhXYCoVjcShCBVXi8WkXgvF+uZ6Pl9JfTlGJK2IQY9dRGLhZF8IoChIKFuyoXi1j1rEJBGpwQA4piyyqAABFp/Gw38X++T4dZ62RtRB5L78uklLDJ0RVdZq0YWOYpFStpCrAWYgKlFVgw4QOos3tMPS9D61psrW+jt6mpSeO7TSW+dau80d7ex2vZX65jSvYisTiC8CfkbNZUrkZU2LngVjtNn+d+4j/Zz87ha7ZhCH/bcEIO9ihG8RGxNZs5KHKpDa5Env1afgGqUJelIEBAAA=
IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /cimp.php?t=api&data=H4sIAAAAAAAAAz2Pa0oDQRCEr+IFMvRztju/9a9CJAeY7COIJpFsQIU+vL3rYxqGopiq+ZqAeIO4QbvDuhXYCoVjcShCBVXi8WkXgvF+uZ6Pl9JfTlGJK2IQY9dRGLhZF8IoChIKFuyoXi1j1rEJBGpwQA4piyyqAABFp/Gw38X++T4dZ62RtRB5L78uklLDJ0RVdZq0YWOYpFStpCrAWYgKlFVgw4QOos3tMPS9D61psrW+jt6mpSeO7TSW+dau80d7ex2vZX65jSvYisTiC8CfkbNZUrkZU2LngVjtNn+d+4j/Zz87ha7ZhCH/bcEIO9ihG8RGxNZs5KHKpDa5Env1afgGqUJelIEBAAA= HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a1a30f4.65625540325315022%22%3B%7D; __upt=%7B%22v%22%3A1%2C%22id%22%3A%220%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.029701%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Credentials: true
Set-Cookie: __upt=%7B%22v%22%3A1%2C%22id%22%3A%2265592f5a1a30f4.65625540325315022%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.03940399%22%7D; expires=Mon, 17 Nov 2025 21:40:42 GMT; path=/; domain=.orbsrv.com; Secure; SameSite=none
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
januarydeliverywarfare.com/pixel/purst?dl=0&th=0&sc=0&rs=2075&rd=2075&fd=1521&bv=23.11.v.1&tmpl=70
192.243.61.225200 OK 0 B URL GET HTTP/1.1 januarydeliverywarfare.com/pixel/purst?dl=0&th=0&sc=0&rs=2075&rd=2075&fd=1521&bv=23.11.v.1&tmpl=70
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectjanuarydeliverywarfare.com
Fingerprint59:4C:33:F5:8F:85:E1:32:64:18:C5:69:D5:75:74:19:8C:59:31:CB
ValidityMon, 09 Oct 2023 12:27:34 GMT - Sun, 07 Jan 2024 12:27:33 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2075&rd=2075&fd=1521&bv=23.11.v.1&tmpl=70 HTTP/1.1
Host: januarydeliverywarfare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
januarydeliverywarfare.com/cc/48/f4/cc48f4cc72bd1ab0cd76dca8048a896c.js
192.243.61.225200 OK 14 kB URL GET HTTP/1.1 januarydeliverywarfare.com/cc/48/f4/cc48f4cc72bd1ab0cd76dca8048a896c.js
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectjanuarydeliverywarfare.com
Fingerprint59:4C:33:F5:8F:85:E1:32:64:18:C5:69:D5:75:74:19:8C:59:31:CB
ValidityMon, 09 Oct 2023 12:27:34 GMT - Sun, 07 Jan 2024 12:27:33 GMT
File type ASCII text, with very long lines (40572), with no line terminators
Hash 08d29f46fa12d5086d3153afc207ea08
810f6fd98b3084df7c1ed62c6ea5bad3336488ef
abd4a12fc1a16f09ed07f488b0d51ef085709eb26d2622b589952309e9e86b8b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /cc/48/f4/cc48f4cc72bd1ab0cd76dca8048a896c.js HTTP/1.1
Host: januarydeliverywarfare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d24a99bcfc32d1e7008ac3e01fdd2183
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
professionalswebcheck.com/stats
52.59.122.145200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP 52.59.122.145:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5353d2f9a5d16ef82c9c0ea39f90faf4
e28fc93a2b22533e0869bdef2b157fe2c4948807
6639b072dd56a3f7f73c79c27e5a700793a67c89e3bd5184f805f2870522fd65
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: uid_id2=28c7e8cf-920a-425f-b7d7-3ecde0f957de:1:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.xxxfiles.tv
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
banquetunarmedgrater.com/advertisers.js
104.21.86.121200 OK 0 B URL GET HTTP/2 banquetunarmedgrater.com/advertisers.js
IP 104.21.86.121:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectbanquetunarmedgrater.com
Fingerprint92:8E:AD:72:AC:AD:3B:21:99:CD:21:A0:9F:BD:F2:AF:0D:98:D8:57
ValidityThu, 09 Nov 2023 11:40:15 GMT - Wed, 07 Feb 2024 11:40:14 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertisers.js HTTP/1.1
Host: banquetunarmedgrater.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: application/javascript
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=172800
x-request-id: 9d0de39b830af536e8ce3f4425dcc8f9
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 18 Nov 2023 21:40:42 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HpIOgg5n0sLx%2Fi7B7E45t%2B3aF9%2BPx5eSLTn%2F2qieqY4dK%2FA2F7yci3Z73TnJmI3P%2FYfu0pqC9%2FweezV3PM9Yu%2BSfkY9hkuK6TkAjLdboXns0rySR79zMT38F2ZduZ7%2Fc7OQfJN0W58hAgG4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f993f285696-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
twinrdsrv.com//Redirect.eng?MediaSegmentId=33124&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20ucVN-UbAuwPeh9r2fZ-NlusyKKy-dVjNjGezTELazb4qiAqbJehGNngamKk6ogZOI92WTB8XQ5nwbQnDxRs-xSD85vIhcvmUnhRauaWi5Kg2OWV-5eTTejazoQBB_PIf5wNxrIdkQ9SSQ5CgWjK7FpTKPNBrFM38obsLdCmCGI203Nmr27liuK7hVGHqnBj9mpIJQHvWnMq-E4QyDI_yicwGUU9aiP4bc4GOldDcNeAeLOOsXbl9eG-FpzOuzUlmZzRuGmDN_J_SS3gcSjBZhxXPyAHvWdJRuboY9fB82nCzqRPnjOYUNVqyuP6HajNedD1tdxWbMqPQQZWNKPH-Jbn-DD8HiYouUtWTQjQiUZMhM4V3VpqsXThJIf5ZzU6NXE0_rZjBOVZaWubMC0gIFnLkD5Nkym8MxtGDv-iuk5h5e2aaI_jHzV10SstJKhKLRS2dFFEGVzSxKgG4Q2GTyeBRKb3EpU4FV4XVWsdUP_1_R-KYOklAUiBhYzsRI_7S0TqMaPcepaT3prntTMZEMPF-cKo7AH26jYNg5v5LMcuF8VZZ5d-p2geqO2Hx21n_egVU9TZ2MocaUM9ta_K3EzO1hBFUgRXSu4XvRugYwr_dmq6WgL58TQVaowOXmBc_p_Ow13socl8LgS1OFypnUaQg1SACKfX27vSDcziNr4uWyo8Szjs15hcbN0KA9qL-Y05TBBYY2Og2VmiQH-MzklPREKTO4Exs582DnG5JqzawX46lCtAw74SoQJ3OAPOrI0HJgvDkNoD3I8Zz8VbffI192YWbCniOVpCS3tiIGQKye01dkMn5OtOUPZlQCzNSAJpbSyHptnLrBNMg2S-oTgoaxysyqzLpMvkLjz0ZlCmQVpKgJaAXCAhkBy35AoY8VOc7uJhE_0I3-80ds3j0B8smhNm7hrk5Kf6jbLHGDndHpkUXge78EBg48iRM4HMS41&kw=&mw=150&mh=125&ml=64&curlh=362792523
172.66.40.197302 Found 428 B URL GET HTTP/3 twinrdsrv.com//Redirect.eng?MediaSegmentId=33124&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20ucVN-UbAuwPeh9r2fZ-NlusyKKy-dVjNjGezTELazb4qiAqbJehGNngamKk6ogZOI92WTB8XQ5nwbQnDxRs-xSD85vIhcvmUnhRauaWi5Kg2OWV-5eTTejazoQBB_PIf5wNxrIdkQ9SSQ5CgWjK7FpTKPNBrFM38obsLdCmCGI203Nmr27liuK7hVGHqnBj9mpIJQHvWnMq-E4QyDI_yicwGUU9aiP4bc4GOldDcNeAeLOOsXbl9eG-FpzOuzUlmZzRuGmDN_J_SS3gcSjBZhxXPyAHvWdJRuboY9fB82nCzqRPnjOYUNVqyuP6HajNedD1tdxWbMqPQQZWNKPH-Jbn-DD8HiYouUtWTQjQiUZMhM4V3VpqsXThJIf5ZzU6NXE0_rZjBOVZaWubMC0gIFnLkD5Nkym8MxtGDv-iuk5h5e2aaI_jHzV10SstJKhKLRS2dFFEGVzSxKgG4Q2GTyeBRKb3EpU4FV4XVWsdUP_1_R-KYOklAUiBhYzsRI_7S0TqMaPcepaT3prntTMZEMPF-cKo7AH26jYNg5v5LMcuF8VZZ5d-p2geqO2Hx21n_egVU9TZ2MocaUM9ta_K3EzO1hBFUgRXSu4XvRugYwr_dmq6WgL58TQVaowOXmBc_p_Ow13socl8LgS1OFypnUaQg1SACKfX27vSDcziNr4uWyo8Szjs15hcbN0KA9qL-Y05TBBYY2Og2VmiQH-MzklPREKTO4Exs582DnG5JqzawX46lCtAw74SoQJ3OAPOrI0HJgvDkNoD3I8Zz8VbffI192YWbCniOVpCS3tiIGQKye01dkMn5OtOUPZlQCzNSAJpbSyHptnLrBNMg2S-oTgoaxysyqzLpMvkLjz0ZlCmQVpKgJaAXCAhkBy35AoY8VOc7uJhE_0I3-80ds3j0B8smhNm7hrk5Kf6jbLHGDndHpkUXge78EBg48iRM4HMS41&kw=&mw=150&mh=125&ml=64&curlh=362792523
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (356), with CRLF line terminators
Hash 12ab9612ff59fd6deead9eb448937244
8c6adb871ae5bafef0f93f5a8dc8fb57cb38290f
e12a9d4a609aec47d7bb60b0ecf949e910383c53506a0c3e3d72531c424c226b
GET //Redirect.eng?MediaSegmentId=33124&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20ucVN-UbAuwPeh9r2fZ-NlusyKKy-dVjNjGezTELazb4qiAqbJehGNngamKk6ogZOI92WTB8XQ5nwbQnDxRs-xSD85vIhcvmUnhRauaWi5Kg2OWV-5eTTejazoQBB_PIf5wNxrIdkQ9SSQ5CgWjK7FpTKPNBrFM38obsLdCmCGI203Nmr27liuK7hVGHqnBj9mpIJQHvWnMq-E4QyDI_yicwGUU9aiP4bc4GOldDcNeAeLOOsXbl9eG-FpzOuzUlmZzRuGmDN_J_SS3gcSjBZhxXPyAHvWdJRuboY9fB82nCzqRPnjOYUNVqyuP6HajNedD1tdxWbMqPQQZWNKPH-Jbn-DD8HiYouUtWTQjQiUZMhM4V3VpqsXThJIf5ZzU6NXE0_rZjBOVZaWubMC0gIFnLkD5Nkym8MxtGDv-iuk5h5e2aaI_jHzV10SstJKhKLRS2dFFEGVzSxKgG4Q2GTyeBRKb3EpU4FV4XVWsdUP_1_R-KYOklAUiBhYzsRI_7S0TqMaPcepaT3prntTMZEMPF-cKo7AH26jYNg5v5LMcuF8VZZ5d-p2geqO2Hx21n_egVU9TZ2MocaUM9ta_K3EzO1hBFUgRXSu4XvRugYwr_dmq6WgL58TQVaowOXmBc_p_Ow13socl8LgS1OFypnUaQg1SACKfX27vSDcziNr4uWyo8Szjs15hcbN0KA9qL-Y05TBBYY2Og2VmiQH-MzklPREKTO4Exs582DnG5JqzawX46lCtAw74SoQJ3OAPOrI0HJgvDkNoD3I8Zz8VbffI192YWbCniOVpCS3tiIGQKye01dkMn5OtOUPZlQCzNSAJpbSyHptnLrBNMg2S-oTgoaxysyqzLpMvkLjz0ZlCmQVpKgJaAXCAhkBy35AoY8VOc7uJhE_0I3-80ds3j0B8smhNm7hrk5Kf6jbLHGDndHpkUXge78EBg48iRM4HMS41&kw=&mw=150&mh=125&ml=64&curlh=362792523 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
content-length: 428
location: https://twinrdsrv.com/mediahosting.engine?MediaId=62271&AId=9653&CId=23846&PId=41673&SiteId=7003&ZoneId=41938&VolumeMetricId=deb54791-4f41-4799-a394-d3dfdbce64b7&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
cache-control: private, no-transform
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=deb54791-4f41-4799-a394-d3dfdbce64b7; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: CP="CAO PSA OUR IND"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gF3CP8hXRGWeRr7YzMvho%2FfM%2Bunw3%2B1S0CBH0axACNA93DL%2FzbsalQKNCKmEz3eYGeFrE8Fx2jyZFAc0OyJjndrMcawqH5rgOQjEQnYc2oOaDOXydojbu3IXRlU9oEs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f98e816b505-OSL
alt-svc: h3=":443"; ma=86400
twinrdsrv.com//Redirect.eng?MediaSegmentId=58098&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20tm302Xp-nc4-58BQo9sYvvaR92FplT4AyT9MhP4Lmk0DP1pmvSD9HzgobjxCLShdsuKNvbjbt3eWURryKwx7Xb57CR7UJlR1PsJ8ZMhWu0_5OfaCP8z6y8NW6atBrT3UP1MY97wHYmfIHlgEtJ2MDe4dUvESuvPCvU53RkwwoHVEMfHdNqjhX-aJz1rsXhO3eXTHETBMPxSXDh4lGMp4aGmIJMmjUT2IdlbW-dalA9wFnW2eYIoDJDwAAReiiEhtaDPwOg477mjUXm2j-pxCHR2iBjZBSKnnLfzkiyRk0QoBO8bz2DAnsZ3Q9trV4TmeOYMKXSeWRzMIVFxgH5amygEY-0T_MHSq7PPI2wDmvq2CenbSM6HUUsPje7KfvcfqaFksYvXCBjdDrr64wqNKoMNdtYBnQnEjLRNIVugfZElZ92oCHT0mhoDaSzUdYss4ZeiRb4Frwe5bfx26kTF-3TDYGEwkPpl5CzeO_xrfKzG_F-btUXTE3aWKNNESFcVx9dCpC9M7GT4RCY3Oc-9DmQ6Pe3iSfu1LPvRbyAIUtrokJ5jrap1QgP1oSKCHrRuFt_XMDkmjY3T-TK6KFaAG-x5Rp8ePJb1Kz_bmEmJPGGoY6ZXYFhzFBKghVw8tN7-oeawVQA0ntfHrwhG3amnml_IiMhJ36QsMFDNcPqjsh2_vlI52XOYP7zIydoot2BnjAUA6lnz6JtQtdqIE9Jn6z6jY02lX4TnFz1nWtZlHP9bIy09xekMlyysNw_vp6vLXyos9TBkOh4KC5D8eKJFd4FbkvKJuCo8Y2ZMsgWvnsmENlHK-Pcyf93zCog4soJGZS7U8NIIaL6qTBNdFvxIhaJyXNGcgHukZwxW9KCy53AvWZ7gvSDFFsDepnh0LpJDT6C9jnvAeCxeivzs5OEHkpadvyVrR9CMTMqI59AlrU6YIFQDRO59EPoH1vINVK4rN81&kw=&mw=150&mh=125&ml=64&curlh=362792523
172.66.40.197302 Found 428 B URL GET HTTP/3 twinrdsrv.com//Redirect.eng?MediaSegmentId=58098&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20tm302Xp-nc4-58BQo9sYvvaR92FplT4AyT9MhP4Lmk0DP1pmvSD9HzgobjxCLShdsuKNvbjbt3eWURryKwx7Xb57CR7UJlR1PsJ8ZMhWu0_5OfaCP8z6y8NW6atBrT3UP1MY97wHYmfIHlgEtJ2MDe4dUvESuvPCvU53RkwwoHVEMfHdNqjhX-aJz1rsXhO3eXTHETBMPxSXDh4lGMp4aGmIJMmjUT2IdlbW-dalA9wFnW2eYIoDJDwAAReiiEhtaDPwOg477mjUXm2j-pxCHR2iBjZBSKnnLfzkiyRk0QoBO8bz2DAnsZ3Q9trV4TmeOYMKXSeWRzMIVFxgH5amygEY-0T_MHSq7PPI2wDmvq2CenbSM6HUUsPje7KfvcfqaFksYvXCBjdDrr64wqNKoMNdtYBnQnEjLRNIVugfZElZ92oCHT0mhoDaSzUdYss4ZeiRb4Frwe5bfx26kTF-3TDYGEwkPpl5CzeO_xrfKzG_F-btUXTE3aWKNNESFcVx9dCpC9M7GT4RCY3Oc-9DmQ6Pe3iSfu1LPvRbyAIUtrokJ5jrap1QgP1oSKCHrRuFt_XMDkmjY3T-TK6KFaAG-x5Rp8ePJb1Kz_bmEmJPGGoY6ZXYFhzFBKghVw8tN7-oeawVQA0ntfHrwhG3amnml_IiMhJ36QsMFDNcPqjsh2_vlI52XOYP7zIydoot2BnjAUA6lnz6JtQtdqIE9Jn6z6jY02lX4TnFz1nWtZlHP9bIy09xekMlyysNw_vp6vLXyos9TBkOh4KC5D8eKJFd4FbkvKJuCo8Y2ZMsgWvnsmENlHK-Pcyf93zCog4soJGZS7U8NIIaL6qTBNdFvxIhaJyXNGcgHukZwxW9KCy53AvWZ7gvSDFFsDepnh0LpJDT6C9jnvAeCxeivzs5OEHkpadvyVrR9CMTMqI59AlrU6YIFQDRO59EPoH1vINVK4rN81&kw=&mw=150&mh=125&ml=64&curlh=362792523
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (356), with CRLF line terminators
Hash 9944bdd2c079a4415cc689828c836bb1
d88c5c515b8e18a946b2e69c4348e79fa7f8eb9e
8057c6ec5f0b6bfdd0bb5a6818afc4482b3308402b0a3fbe16c910a8cbf7b8cc
GET //Redirect.eng?MediaSegmentId=58098&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=4gwMQa7Txy9Fseo_2h_0FUN1wsCvIR8i1YbfUKQH20tm302Xp-nc4-58BQo9sYvvaR92FplT4AyT9MhP4Lmk0DP1pmvSD9HzgobjxCLShdsuKNvbjbt3eWURryKwx7Xb57CR7UJlR1PsJ8ZMhWu0_5OfaCP8z6y8NW6atBrT3UP1MY97wHYmfIHlgEtJ2MDe4dUvESuvPCvU53RkwwoHVEMfHdNqjhX-aJz1rsXhO3eXTHETBMPxSXDh4lGMp4aGmIJMmjUT2IdlbW-dalA9wFnW2eYIoDJDwAAReiiEhtaDPwOg477mjUXm2j-pxCHR2iBjZBSKnnLfzkiyRk0QoBO8bz2DAnsZ3Q9trV4TmeOYMKXSeWRzMIVFxgH5amygEY-0T_MHSq7PPI2wDmvq2CenbSM6HUUsPje7KfvcfqaFksYvXCBjdDrr64wqNKoMNdtYBnQnEjLRNIVugfZElZ92oCHT0mhoDaSzUdYss4ZeiRb4Frwe5bfx26kTF-3TDYGEwkPpl5CzeO_xrfKzG_F-btUXTE3aWKNNESFcVx9dCpC9M7GT4RCY3Oc-9DmQ6Pe3iSfu1LPvRbyAIUtrokJ5jrap1QgP1oSKCHrRuFt_XMDkmjY3T-TK6KFaAG-x5Rp8ePJb1Kz_bmEmJPGGoY6ZXYFhzFBKghVw8tN7-oeawVQA0ntfHrwhG3amnml_IiMhJ36QsMFDNcPqjsh2_vlI52XOYP7zIydoot2BnjAUA6lnz6JtQtdqIE9Jn6z6jY02lX4TnFz1nWtZlHP9bIy09xekMlyysNw_vp6vLXyos9TBkOh4KC5D8eKJFd4FbkvKJuCo8Y2ZMsgWvnsmENlHK-Pcyf93zCog4soJGZS7U8NIIaL6qTBNdFvxIhaJyXNGcgHukZwxW9KCy53AvWZ7gvSDFFsDepnh0LpJDT6C9jnvAeCxeivzs5OEHkpadvyVrR9CMTMqI59AlrU6YIFQDRO59EPoH1vINVK4rN81&kw=&mw=150&mh=125&ml=64&curlh=362792523 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
content-length: 428
location: https://twinrdsrv.com/mediahosting.engine?MediaId=97906&AId=2598&CId=44243&PId=75906&SiteId=7003&ZoneId=41938&VolumeMetricId=cebfa2b8-0a84-4cb4-80d4-cf65c3587761&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
cache-control: private, no-transform
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=cebfa2b8-0a84-4cb4-80d4-cf65c3587761; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: CP="CAO PSA OUR IND"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UMiwYQyu%2BHAV%2BzURqEXdSGJB9TCL4ZQmSqYQltzcKulGmEjzC47YKcsMj0PW7SLhWZVWrfRcewgtQ5HDZ6%2FQAf9OAUQ362Ll4tIO%2Fn%2FOu%2BbgALM4XEGCvQ9LL8CLDks%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f98e814b505-OSL
alt-svc: h3=":443"; ma=86400
twinrdsrv.com/banner.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&z=41938&cid=b9c&rand=73683&ver=async&time=0&referrerurl=https%3A%2F%2Fwww.xxxfiles.tv%2F&abr=false&curl=https%3A%2F%2Fwww.xxxfiles.tv%2F
172.66.40.197 2.2 kB URL GET twinrdsrv.com/banner.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&z=41938&cid=b9c&rand=73683&ver=async&time=0&referrerurl=https%3A%2F%2Fwww.xxxfiles.tv%2F&abr=false&curl=https%3A%2F%2Fwww.xxxfiles.tv%2F
IP 172.66.40.197:0
Requested by https://game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 9aebff61eff98cdb7ebca1cc7eb0d4b7
773c10be75fafef97006574eb6faf67b7b22aeaa
548b5ca3cd561bf7b489d19340410024e8ea26deb3e25231d3bb5691c5847ea4
GET /banner.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&z=41938&cid=b9c&rand=73683&ver=async&time=0&referrerurl=https%3A%2F%2Fwww.xxxfiles.tv%2F&abr=false&curl=https%3A%2F%2Fwww.xxxfiles.tv%2F HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=; path=/; SameSite=None; secure
IPLH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oGu6xGvjwD%2FipIDi5zKwipWkrLBhdrBMQp6eus0fWCxwn7AzpL%2BfyqfZjx3wfAgaMcGTeJx0uXlDcej76j7P3wi6CftcoFkNrDYw8ivnZdhrj9hsMyz9TMKMo%2BD9UeI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f922818568b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
twinrdsrv.com//Redirect.eng?MediaSegmentId=33214&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgDZIYhAL5l9PBfWrBRlZl8k46T5xbFXlI92xB62BKsjOvykx5aGUmlH65oyMIfiK9BO_Oqeu3zouSGnBxNtPDbtG1-kxNdBXPpz9-xGVtGwkFfHx9M2vjKd9L3BM88u5yYMSmQtogAaYjyRq9-Gz1JusjZjpHRbrzvyvLu6LIm9FGO9skbdLTKVVYppH50Gt7pn1tF15dcq4dDgySvD3A3VkkLOoVXjc20tMh4YKD-Hr5f3WnXMA1MNgT0KlDI-bKLQo5z4ZWExM04iJqT6q1upvOaH0KKMsOVf7CldPUPbSA1R_Cs2GQcubyg_M50hMHEcz2rda41ZxsV0ZENA_HhcgY2rryahEzRtmA2cLAjzcFbPdcCdUm5Zf_oyR8hCWuKaynSAf7-k0kjUMOiFwVvYfLjzUXGBhwZpxeG7aPaojIbhhaX2C9KkCuf-Nkd2Dhg2QYv3qSlFedOBuXsGY2Fs3sLAXK9nqgmt5l0khszh2jZHJXPsgmNn3GcoEeCUTdo-F95GeLlnHZK77nzjggAsHr0eyKVfVmflsasrJMK0QCJSwcTSlzYyLE0Qaq95NLB3HJaYJMXsWFy1Lq5q8RKh8n7BU4D8BnOJAdHEwsqVdD1xQcbREm33loudI6_1CeBjbHRAxvYvnxgjMmZ62jp112fqwb2R4-b-yFEFTqIs9aAlczkY9YJVsJFx2TUBQ5J9wF__v9X_crwSGvjfFhVp92NcsSAh4hr_hBnKvWhPj-Zcbqiy2NdncAozfJkxTX-iCMUDbxZ68R8WXJsx8dPLnBoOLed-0TsqQW0AsFwMO3QPa1bqJ2TFATYl6SKD5ytVfekUfnaa3ll5s5fjGkTMVM2iGZr0TL2JduMuzXb3XC4DgvRS9O2E8XuphYRNgXycmu6CvFmhjd1RNvmHG9GIZ1ICfeKQ4XaA50S_7g6sqvozavMe89tiUR81sFTgO4IveIUzhuGaHfRqidMl4lDQ1&kw=&mw=150&mh=125&ml=64&curlh=362792523
172.66.40.197302 Found 428 B URL GET HTTP/3 twinrdsrv.com//Redirect.eng?MediaSegmentId=33214&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgDZIYhAL5l9PBfWrBRlZl8k46T5xbFXlI92xB62BKsjOvykx5aGUmlH65oyMIfiK9BO_Oqeu3zouSGnBxNtPDbtG1-kxNdBXPpz9-xGVtGwkFfHx9M2vjKd9L3BM88u5yYMSmQtogAaYjyRq9-Gz1JusjZjpHRbrzvyvLu6LIm9FGO9skbdLTKVVYppH50Gt7pn1tF15dcq4dDgySvD3A3VkkLOoVXjc20tMh4YKD-Hr5f3WnXMA1MNgT0KlDI-bKLQo5z4ZWExM04iJqT6q1upvOaH0KKMsOVf7CldPUPbSA1R_Cs2GQcubyg_M50hMHEcz2rda41ZxsV0ZENA_HhcgY2rryahEzRtmA2cLAjzcFbPdcCdUm5Zf_oyR8hCWuKaynSAf7-k0kjUMOiFwVvYfLjzUXGBhwZpxeG7aPaojIbhhaX2C9KkCuf-Nkd2Dhg2QYv3qSlFedOBuXsGY2Fs3sLAXK9nqgmt5l0khszh2jZHJXPsgmNn3GcoEeCUTdo-F95GeLlnHZK77nzjggAsHr0eyKVfVmflsasrJMK0QCJSwcTSlzYyLE0Qaq95NLB3HJaYJMXsWFy1Lq5q8RKh8n7BU4D8BnOJAdHEwsqVdD1xQcbREm33loudI6_1CeBjbHRAxvYvnxgjMmZ62jp112fqwb2R4-b-yFEFTqIs9aAlczkY9YJVsJFx2TUBQ5J9wF__v9X_crwSGvjfFhVp92NcsSAh4hr_hBnKvWhPj-Zcbqiy2NdncAozfJkxTX-iCMUDbxZ68R8WXJsx8dPLnBoOLed-0TsqQW0AsFwMO3QPa1bqJ2TFATYl6SKD5ytVfekUfnaa3ll5s5fjGkTMVM2iGZr0TL2JduMuzXb3XC4DgvRS9O2E8XuphYRNgXycmu6CvFmhjd1RNvmHG9GIZ1ICfeKQ4XaA50S_7g6sqvozavMe89tiUR81sFTgO4IveIUzhuGaHfRqidMl4lDQ1&kw=&mw=150&mh=125&ml=64&curlh=362792523
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (356), with CRLF line terminators
Hash a3a4d344a5b7e880ba610fdaad4de526
74396598edbaae34372381da96fd5b1ceadd74a5
0ba63b38190ddf0e1ca2956b85c75e856aad66c1ac4575b1e88ba1047a80ec73
GET //Redirect.eng?MediaSegmentId=33214&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgDZIYhAL5l9PBfWrBRlZl8k46T5xbFXlI92xB62BKsjOvykx5aGUmlH65oyMIfiK9BO_Oqeu3zouSGnBxNtPDbtG1-kxNdBXPpz9-xGVtGwkFfHx9M2vjKd9L3BM88u5yYMSmQtogAaYjyRq9-Gz1JusjZjpHRbrzvyvLu6LIm9FGO9skbdLTKVVYppH50Gt7pn1tF15dcq4dDgySvD3A3VkkLOoVXjc20tMh4YKD-Hr5f3WnXMA1MNgT0KlDI-bKLQo5z4ZWExM04iJqT6q1upvOaH0KKMsOVf7CldPUPbSA1R_Cs2GQcubyg_M50hMHEcz2rda41ZxsV0ZENA_HhcgY2rryahEzRtmA2cLAjzcFbPdcCdUm5Zf_oyR8hCWuKaynSAf7-k0kjUMOiFwVvYfLjzUXGBhwZpxeG7aPaojIbhhaX2C9KkCuf-Nkd2Dhg2QYv3qSlFedOBuXsGY2Fs3sLAXK9nqgmt5l0khszh2jZHJXPsgmNn3GcoEeCUTdo-F95GeLlnHZK77nzjggAsHr0eyKVfVmflsasrJMK0QCJSwcTSlzYyLE0Qaq95NLB3HJaYJMXsWFy1Lq5q8RKh8n7BU4D8BnOJAdHEwsqVdD1xQcbREm33loudI6_1CeBjbHRAxvYvnxgjMmZ62jp112fqwb2R4-b-yFEFTqIs9aAlczkY9YJVsJFx2TUBQ5J9wF__v9X_crwSGvjfFhVp92NcsSAh4hr_hBnKvWhPj-Zcbqiy2NdncAozfJkxTX-iCMUDbxZ68R8WXJsx8dPLnBoOLed-0TsqQW0AsFwMO3QPa1bqJ2TFATYl6SKD5ytVfekUfnaa3ll5s5fjGkTMVM2iGZr0TL2JduMuzXb3XC4DgvRS9O2E8XuphYRNgXycmu6CvFmhjd1RNvmHG9GIZ1ICfeKQ4XaA50S_7g6sqvozavMe89tiUR81sFTgO4IveIUzhuGaHfRqidMl4lDQ1&kw=&mw=150&mh=125&ml=64&curlh=362792523 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
content-length: 428
location: https://twinrdsrv.com/mediahosting.engine?MediaId=62318&AId=9653&CId=23846&PId=41956&SiteId=7003&ZoneId=41938&VolumeMetricId=85fb3f53-723c-4064-9c5e-334be61b8f1f&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
cache-control: private, no-transform
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: CP="CAO PSA OUR IND"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p3Fq6%2BFZpp4eSNqQnUkPwUClt3rqjQu%2FH%2Beo0U0v631YYgUVWXa0NigTCi5KpvJTcQ40b9VZVfV7cHAIcxxPx%2B%2BL2wdHTyBk%2Ffq%2BzQ6nL92oCFg1pmsNPKMToZ15GXk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f991833b505-OSL
alt-svc: h3=":443"; ma=86400
www.xxxfiles.tv/apple-touch-icon.png
104.21.83.6200 OK 14 kB URL GET HTTP/3 www.xxxfiles.tv/apple-touch-icon.png
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash 302003967bcce57931c372aa26310c88
526045f535e90a6d7b19240532f9100c9535beee
117477b129e4ca959b0afd092f7edca8f460ff25120b8dbe2011a88d9f48bef8
GET /apple-touch-icon.png HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154; show_pops2=true2; show_pops1=true1; pp_show_on_63d45b685911cef3b8cc3d1d1550bf85=1; kt_tcookie=1; kt_is_visited=1; pp_main_63d45b685911cef3b8cc3d1d1550bf85=1; pp_exp_63d45b685911cef3b8cc3d1d1550bf85=1700347244359
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: image/png
content-length: 13713
last-modified: Fri, 25 Nov 2022 12:46:44 GMT
etag: "6380b934-3591"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1886556
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T5p0dOeLvUhtBzr1R3%2BbjC6qjYJY5jQa6FiEQqTvqnAPD7Twp%2BJR9civFVGpMQWBhAYIO91cR2NcQtDjJvJmVUd0S35Y9kUpvlF7J9qTeM5pjaFXsXBiZUFQRJnz%2FAIn040%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f9aed8f5688-OSL
alt-svc: h3=":443"; ma=86400
www.xxxfiles.tv/favicon-16x16.png
104.21.83.6200 OK 1.5 kB URL GET HTTP/3 www.xxxfiles.tv/favicon-16x16.png
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type PNG image data, 16 x 16, 8-bit colormap, non-interlaced\012- data
Hash 552872354755cb050014a9501cfec4fa
fd05b4d7002b52e705344db04db723495910e4c7
88ef331642f08aaee6990894bd8015032891181d446faa6c4bbec095a56aba8d
GET /favicon-16x16.png HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154; show_pops2=true2; show_pops1=true1; pp_show_on_63d45b685911cef3b8cc3d1d1550bf85=1; kt_tcookie=1; kt_is_visited=1; pp_main_63d45b685911cef3b8cc3d1d1550bf85=1; pp_exp_63d45b685911cef3b8cc3d1d1550bf85=1700347244359
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: image/png
content-length: 1489
last-modified: Fri, 25 Nov 2022 12:46:44 GMT
etag: "6380b934-5d1"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2042746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4aglfopofauIfIdGlpckoUCHRhEm9REr%2FsRSmipdcS2vqr26Cs1KBb0JUwUL6OteBOdMoxEtWSKZGNzZep75A8iBe%2FJrxU1jyMdmHfuIqfgHGvVVIVUhbKTT348HyOgutHc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f9aed905688-OSL
alt-svc: h3=":443"; ma=86400
januarydeliverywarfare.com/pixel/pure
192.243.61.225204 No Content 0 B URL OPTIONS HTTP/1.1 januarydeliverywarfare.com/pixel/pure
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectjanuarydeliverywarfare.com
Fingerprint59:4C:33:F5:8F:85:E1:32:64:18:C5:69:D5:75:74:19:8C:59:31:CB
ValidityMon, 09 Oct 2023 12:27:34 GMT - Sun, 07 Jan 2024 12:27:33 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /pixel/pure HTTP/1.1
Host: januarydeliverywarfare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:43 GMT
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Content-Length: 0
januarydeliverywarfare.com/pixel/pure
192.243.61.225204 No Content 0 B URL OPTIONS HTTP/1.1 januarydeliverywarfare.com/pixel/pure
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectjanuarydeliverywarfare.com
Fingerprint59:4C:33:F5:8F:85:E1:32:64:18:C5:69:D5:75:74:19:8C:59:31:CB
ValidityMon, 09 Oct 2023 12:27:34 GMT - Sun, 07 Jan 2024 12:27:33 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /pixel/pure HTTP/1.1
Host: januarydeliverywarfare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 73
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:43 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
twinrdsrv.com/mediahosting.engine?MediaId=97906&AId=2598&CId=44243&PId=75906&SiteId=7003&ZoneId=41938&VolumeMetricId=cebfa2b8-0a84-4cb4-80d4-cf65c3587761&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
172.66.40.197200 OK 68 kB URL GET HTTP/3 twinrdsrv.com/mediahosting.engine?MediaId=97906&AId=2598&CId=44243&PId=75906&SiteId=7003&ZoneId=41938&VolumeMetricId=cebfa2b8-0a84-4cb4-80d4-cf65c3587761&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash f1bec27d2fef9ef0d19cf926fc3a13ff
ebfd79b69acb955ac19d86e90de286c8a82f5dbc
96737c3f4ad39e2d7442ee49d4bbab295536a7eb698362a81425910f03eb17c2
GET /mediahosting.engine?MediaId=97906&AId=2598&CId=44243&PId=75906&SiteId=7003&ZoneId=41938&VolumeMetricId=cebfa2b8-0a84-4cb4-80d4-cf65c3587761&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LBemMmLJqH3ro3shuT00%2F0j4nZoOzAEyJwPHZwE%2FpNaF8P0xfLB1Dm5BdRvYYM7H1%2BJGd3nKWkel%2BxraI5Aj9od8nGUrf9ZLruv0BMTya85wWcKaN0dvZZfuQvqMtng%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9a6936b505-OSL
alt-svc: h3=":443"; ma=86400
twinrdsrv.com/mediahosting.engine?MediaId=62318&AId=9653&CId=23846&PId=41956&SiteId=7003&ZoneId=41938&VolumeMetricId=85fb3f53-723c-4064-9c5e-334be61b8f1f&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
172.66.40.197200 OK 70 kB URL GET HTTP/3 twinrdsrv.com/mediahosting.engine?MediaId=62318&AId=9653&CId=23846&PId=41956&SiteId=7003&ZoneId=41938&VolumeMetricId=85fb3f53-723c-4064-9c5e-334be61b8f1f&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 6891589adfcd01769762f6044d173cb3
d0d9a83642278feb509cef17ad9208633220b42b
4212f14cea455abc881f31577cc3baea9d793b0229723dc6dad371586f211f06
GET /mediahosting.engine?MediaId=62318&AId=9653&CId=23846&PId=41956&SiteId=7003&ZoneId=41938&VolumeMetricId=85fb3f53-723c-4064-9c5e-334be61b8f1f&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lk%2BeRZBGfrvfDK2FyVM7CTIi1Od4yGMFiiK7%2BgCuZ4IriqOGPUM4BZpWkeUqzhYY9tvg%2F%2BXTdBf0mi1rIWzooM%2BndazQp%2B5ZaiZ31jjx%2F4d1ZFlgKa2fg3Q5lJG6UKE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9a793ab505-OSL
alt-svc: h3=":443"; ma=86400
twinrdsrv.com/mediahosting.engine?MediaId=62271&AId=9653&CId=23846&PId=41673&SiteId=7003&ZoneId=41938&VolumeMetricId=deb54791-4f41-4799-a394-d3dfdbce64b7&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
172.66.40.197200 OK 82 kB URL GET HTTP/3 twinrdsrv.com/mediahosting.engine?MediaId=62271&AId=9653&CId=23846&PId=41673&SiteId=7003&ZoneId=41938&VolumeMetricId=deb54791-4f41-4799-a394-d3dfdbce64b7&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash a2a45f7535a6507c226ae6b7793428f7
0bac5130f80afa26a2750e9c6efe7d0f5e223872
524ff8b495076619b1eee68d29cf315549d7137e1e46d9d81c6e4af7d7901c01
GET /mediahosting.engine?MediaId=62271&AId=9653&CId=23846&PId=41673&SiteId=7003&ZoneId=41938&VolumeMetricId=deb54791-4f41-4799-a394-d3dfdbce64b7&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SxJ1OY%2BxZeJo%2Feu%2FJsL0Yt%2FU0E5PWun3vLBUqgk9aevRBC4QTuYKQlblv3ck9c1KKSnEO68fmQLq0nKY%2BdDI5qMF8mR0V59qmM7Uewrqy%2F1rLVbPjK8iYRMcxKD4%2B6w%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9a6935b505-OSL
alt-svc: h3=":443"; ma=86400
m3.twinredads.com/m62279.png
69.16.175.10200 OK 144 kB URL GET HTTP/1.1 m3.twinredads.com/m62279.png
IP 69.16.175.10:443
Requested by https://twinrdsrv.com/mediahosting.engine?MediaId=62279&AId=9653&CId=23846&PId=41674&SiteId=7003&ZoneId=41938&VolumeMetricId=e436a309-3a84-4e4f-9797-b32b0daf8cac&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
Certificate IssuerGoDaddy.com, Inc.
Subjectm3.twinredads.com
FingerprintB2:08:56:DF:D1:03:83:DE:20:1E:DB:6F:01:ED:DD:B8:EB:09:64:FB
ValidityTue, 25 Oct 2022 19:48:27 GMT - Sun, 26 Nov 2023 19:48:27 GMT
File type PNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced\012- data
Size 144 kB (144448 bytes)
Hash 22482f9cbd0f0ee7b5721ac25e19c6c4
58870160a242de243894185dcffe7b9cb3ad64c8
1f23a7fb6e583bade918dd2dd306cd5c93f48d7960e81cdb23946cc147c5b5a9
GET /m62279.png HTTP/1.1
Host: m3.twinredads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 18 Nov 2023 21:40:43 GMT
Connection: Keep-Alive
ETag: "1620828807"
Cache-Control: max-age=77
Content-Length: 144448
Content-Type: image/png
Last-Modified: Wed, 12 May 2021 14:13:27 GMT
Accept-Ranges: bytes
X-HW: 1700343643.dop015.sk1.t,1700343643.cds248.sk1.shn,1700343643.dop015.sk1.t,1700343643.cds252.sk1.c
Access-Control-Allow-Origin: *
xngqoc.com/admc?a=2&pid=1150082&sid=1195199&wid=439938&fp=4cb725660c43031e3b06c75892d96c5a&f=8&tz=0
185.162.85.4200 OK 0 B URL GET HTTP/2 xngqoc.com/admc?a=2&pid=1150082&sid=1195199&wid=439938&fp=4cb725660c43031e3b06c75892d96c5a&f=8&tz=0
IP 185.162.85.4:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectxngqoc.com
Fingerprint72:3D:8C:DE:14:53:13:4C:23:00:B1:8D:16:EC:18:3F:17:95:FC:09
ValidityTue, 29 Aug 2023 01:02:29 GMT - Mon, 27 Nov 2023 01:02:28 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /admc?a=2&pid=1150082&sid=1195199&wid=439938&fp=4cb725660c43031e3b06c75892d96c5a&f=8&tz=0 HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:43 GMT
content-length: 0
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
accept-ch: Sec-CH-UA-Platform-Version
X-Firefox-Spdy: h2
xngqoc.com/trt?a=1&t=2060
185.162.85.4200 OK 0 B URL GET HTTP/2 xngqoc.com/trt?a=1&t=2060
IP 185.162.85.4:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectxngqoc.com
Fingerprint72:3D:8C:DE:14:53:13:4C:23:00:B1:8D:16:EC:18:3F:17:95:FC:09
ValidityTue, 29 Aug 2023 01:02:29 GMT - Mon, 27 Nov 2023 01:02:28 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /trt?a=1&t=2060 HTTP/1.1
Host: xngqoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:43 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
52.59.122.145200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP 52.59.122.145:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 5353d2f9a5d16ef82c9c0ea39f90faf4
e28fc93a2b22533e0869bdef2b157fe2c4948807
6639b072dd56a3f7f73c79c27e5a700793a67c89e3bd5184f805f2870522fd65
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: uid_id2=28c7e8cf-920a-425f-b7d7-3ecde0f957de:1:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.xxxfiles.tv
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
game.starswalker.site/api/users/18238267800148645095/1636027?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 930 B URL GET HTTP/2 game.starswalker.site/api/users/18238267800148645095/1636027?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash fa23630ac35a6ccae93966faae0ec5fd
e7e55f43bb6f836a16c2226d2767230603fd8b54
6750f716ff99f90ecd7c9497da8c95eab32bfc17d28b41587a880ee64e728444
GET /api/users/18238267800148645095/1636027?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/18238267800148645095/1636039?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 632 B URL GET HTTP/2 game.starswalker.site/api/users/18238267800148645095/1636039?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (383)
Hash 99dc09f30224082567681be919441265
fd900f4d2f28b123c45ae9a827c21580ef937b6b
94843d39f6ea5f21a2d71456f211c424d3008c6934a11a5873b1f1b2a20d2ac5
GET /api/users/18238267800148645095/1636039?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/12531191190914742095/997762?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 3.6 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/997762?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (1579)
Hash 99971884e7675ab3e9a0902e4a5e19f3
cb7e9ff991453a40f0d8a6f26b6cf737eaad4193
485d8805bc5966e523465dbfc291465c721f1a13247424daf77a4063ffa68cff
GET /api/users/12531191190914742095/997762?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
prhzxq.com/wnrw?aid=6102049986091174721&a=1
185.162.85.14200 OK 0 B URL GET HTTP/2 prhzxq.com/wnrw?aid=6102049986091174721&a=1
IP 185.162.85.14:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectprhzxq.com
FingerprintAF:E4:1D:E8:DA:E7:CB:59:A8:A1:F6:FC:7B:22:BD:88:80:FA:14:B0
ValidityFri, 15 Sep 2023 17:07:53 GMT - Thu, 14 Dec 2023 17:07:52 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wnrw?aid=6102049986091174721&a=1 HTTP/1.1
Host: prhzxq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:44 GMT
content-length: 0
access-control-allow-origin: https://www.xxxfiles.tv
X-Firefox-Spdy: h2
s.magsrv.com/splash.php?idzone=4248590
95.211.229.245200 OK 2.7 kB URL GET HTTP/1.1 s.magsrv.com/splash.php?idzone=4248590
IP 95.211.229.245:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectmagsrv.com
FingerprintC5:BC:C0:62:0C:DC:A9:D2:61:A6:77:A9:6C:31:19:AD:CD:2E:00:67
ValidityThu, 05 Oct 2023 15:26:28 GMT - Wed, 03 Jan 2024 15:26:27 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (1575)
Hash 6d4eb2751c47cd1a0670a2046c6b552a
2c644c2935bb587eaae9a0801d0b0486d101dc92
c79874bb190fa3ed86025874fd4fae0c59a9b00104ce5f9211ed6f5437326dda
GET /splash.php?idzone=4248590 HTTP/1.1
Host: s.magsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:44 GMT
Content-Type: text/xml;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: X-CH-VALUES
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5c5fe3c8.852051683657022699%22%3B%7D; expires=Mon, 17 Nov 2025 21:40:44 GMT; path=; domain=.magsrv.com; Secure; SameSite=none
c-tag=%7B%22tag-video%22%3A%22v4%7C%7CNOR%7C4248590%7C87974542%7C0%7C%7C508%7C41%7C3%7C15%7C0%7C0%7C0%7C25344%7C3143242%7C3143244%7C0%7C1%7C0%7C0%7C0%7C0%7C1%7C0%7C0%7C1%7C%7C%7C0%7Cxxxfiles.tv%7C%7C%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C1700343644%7Cb59739fbef2d63b52d1e9969cf93c208%7Cok%22%7D; expires=Fri, 16 Feb 2024 21:40:44 GMT; path=/; domain=.magsrv.com; Secure; SameSite=none
Cache-Control: no-store
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://www.xxxfiles.tv
Access-Control-Allow-Credentials: true
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
game.starswalker.site/api/users/12531191190914742095/2036206?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 3.5 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/2036206?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (1575)
Hash 43fff9a6e80679f349d26488e37ce14f
66d245729364d0f8f00cbef10f294954c31c44dc
4c66e8f0c5cd9eb8a94f9095e3ed3a96d3863e6ad80d757cf59367b26f3301b0
GET /api/users/12531191190914742095/2036206?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
lemondependedadminister.com/sbar.json?key=cc48f4cc72bd1ab0cd76dca8048a896c
192.243.59.20200 OK 4.1 kB URL GET HTTP/1.1 lemondependedadminister.com/sbar.json?key=cc48f4cc72bd1ab0cd76dca8048a896c
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (6123), with no line terminators
Hash b1bf2d0b00004a679f31ffc19e7696b3
70bbfd55473f65f25379861d18c1a16a3af72cfc
ffaab518e116326c0265fd43b681065f48f08800c2ec78690a8df85d342281c9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=cc48f4cc72bd1ab0cd76dca8048a896c HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:44 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.xxxfiles.tv
Access-Control-Allow-Origin: https://www.xxxfiles.tv
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=17371676; expires=Sun, 19 Nov 2023 21:40:44 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 19 Nov 2023 21:40:44 GMT; secure; SameSite=None
uncs=1; expires=Sun, 19 Nov 2023 21:40:44 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sun, 19 Nov 2023 21:40:44 GMT; secure; SameSite=None
uncs29=1; expires=Sun, 19 Nov 2023 21:40:44 GMT; secure; SameSite=None
sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]; expires=Sat, 18 Nov 2023 21:40:49 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 36ee75d68b4a8391a3fc40b1d5231bd8
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
ocsp.buypass.com/
23.36.76.129 1.7 kB IP 23.36.76.129:0
ASN #20940 Akamai International B.V.
Hash f9baeca6a4dec9cb624f86e91a09c513
ac47bc754c42e81222d2aef977e51426a46742ec
e9a06bf1b3c8f72d3bbe4c4f66a92b581487ed6cfeed35dfc49add466918d6f4
POST / HTTP/1.1
Host: ocsp.buypass.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 78
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Access-Control-Allow-Origin: https://www.buypass.no
Access-Control-Allow-Headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Buypass-Session-Id,X-Buypass-Locale
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
MDC-correlationId: b1371c75-abe0-42df-83f1-428c8f66de21
Content-Length: 1704
Date: Sat, 18 Nov 2023 21:40:44 GMT
Connection: keep-alive
lemondependedadminister.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3s3v8HMvGrwICnPwoCCT7k4nM%2BMeFuMaCcbNuquoIEh1VfWkTHVXW9U1PQkIwQXZ4%2Bhf0HmTbFDDon%2BAoh0PQnAxIwg5mIPgxauwN1FmMjj6QfO91%2B8d3vd99dGeOyc%2BHD1bfVXvSKXowlLTbzzzVhBcbazLzPUb%2Ffbyu8vR1YbpPR%2F4nab%2FbONlwbb0QugHvh%2F4QWNVGpHo%2FkIQBE0fMj%2FqBM2O34zCZrAUoW%2F%2By63zYKkH3jsn85B89MjR%2FQiS1cjSL64Lu1Xo%2FLmXUqdooQ16%2FPCNbCvTZYZ0BhPjIckOp25oe7r6NXR2MAkM3fvHGMsR8X77FXF2OE2JuHdwETRWEBlifgVlr4ZQNSStwfQdSH5KAMZxYwNZeu%2BGNiXdvlDpWB2RuYd%2FQJYjMvfL48jS%2BytK9hu3tXKF1JlFP6kg%2BzVkt0bujlHseJDlMVjxISR%2FQBYeriNL9zes0pC8mgwvZQ2Z1FBiAGo9uPEnPbjEg8s9pPys0WJRu83bS5wKxsI4CdpJlEQdyvyE%2BYudEI6N4w1Q5AMwNQAzu8jNLrbkJ6dL86frazDuG9jNCpZ7sMWIeK%2FtoscrlIKgtAQlJSglQVkQlL3qgCsb2uoeV9bFwbSH075YDXXR3aMHuuiKjOzl5%2BSx8Xa8%2F88%2FiS1x1mAsaicRY60w5gGNfcZby5zRth%2B1abuzzGBlBWkvTQbekSPyv98%2FQC5H5BL9ATE9hlXHYPJRUPcUaDlshT7o5jBq%2B9jJjvr9fiKVsE2mU3BdIS%2FmUGx7e%2BqcPDG50sr3f0Gwk2s%2FkkmBmQq5qfCe%2FI6gq%2B4Ob%2BmS7N%2FSpSVfbuSFTOUOHV%2FwdkELcfmzV8R2qQ1fu24Hn77AxsIYHr0ubLFOMy6zriWfr0jOhVnVhgny1Zp9U8Q3nd1ccSZz%2BfrNF1fX0twIa6XOalA5IqR%2BH0yOyJU%2FH0xe59M%2FfwtpahhXIXUnZFqQ%2Bhgs34XNZ%2FmtJjBq5olzD6WrhiaMZz%2BVJFBixmlcwf6LxzO8Z%2B%2BiazzQ4g6ytELPVOipClQNYN3lYZGbk2s%2FLU4KsfKGsTLefqyM%2BvhiuVaeNURLLHc6kR%2B1uO%2FHEQ%2FDYEkwuhjRDg3DpIXCjsTbC%2B%2F8DQAA%2F%2F8BAAD%2F%2F1zXetBqBAAA
192.243.59.20200 OK 7 B URL GET HTTP/1.1 lemondependedadminister.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3s3v8HMvGrwICnPwoCCT7k4nM%2BMeFuMaCcbNuquoIEh1VfWkTHVXW9U1PQkIwQXZ4%2Bhf0HmTbFDDon%2BAoh0PQnAxIwg5mIPgxauwN1FmMjj6QfO91%2B8d3vd99dGeOyc%2BHD1bfVXvSKXowlLTbzzzVhBcbazLzPUb%2Ffbyu8vR1YbpPR%2F4nab%2FbONlwbb0QugHvh%2F4QWNVGpHo%2FkIQBE0fMj%2FqBM2O34zCZrAUoW%2F%2By63zYKkH3jsn85B89MjR%2FQiS1cjSL64Lu1Xo%2FLmXUqdooQ16%2FPCNbCvTZYZ0BhPjIckOp25oe7r6NXR2MAkM3fvHGMsR8X77FXF2OE2JuHdwETRWEBlifgVlr4ZQNSStwfQdSH5KAMZxYwNZeu%2BGNiXdvlDpWB2RuYd%2FQJYjMvfL48jS%2BytK9hu3tXKF1JlFP6kg%2BzVkt0bujlHseJDlMVjxISR%2FQBYeriNL9zes0pC8mgwvZQ2Z1FBiAGo9uPEnPbjEg8s9pPys0WJRu83bS5wKxsI4CdpJlEQdyvyE%2BYudEI6N4w1Q5AMwNQAzu8jNLrbkJ6dL86frazDuG9jNCpZ7sMWIeK%2FtoscrlIKgtAQlJSglQVkQlL3qgCsb2uoeV9bFwbSH075YDXXR3aMHuuiKjOzl5%2BSx8Xa8%2F88%2FiS1x1mAsaicRY60w5gGNfcZby5zRth%2B1abuzzGBlBWkvTQbekSPyv98%2FQC5H5BL9ATE9hlXHYPJRUPcUaDlshT7o5jBq%2B9jJjvr9fiKVsE2mU3BdIS%2FmUGx7e%2BqcPDG50sr3f0Gwk2s%2FkkmBmQq5qfCe%2FI6gq%2B4Ob%2BmS7N%2FSpSVfbuSFTOUOHV%2FwdkELcfmzV8R2qQ1fu24Hn77AxsIYHr0ubLFOMy6zriWfr0jOhVnVhgny1Zp9U8Q3nd1ccSZz%2BfrNF1fX0twIa6XOalA5IqR%2BH0yOyJU%2FH0xe59M%2FfwtpahhXIXUnZFqQ%2Bhgs34XNZ%2FmtJjBq5olzD6WrhiaMZz%2BVJFBixmlcwf6LxzO8Z%2B%2BiazzQ4g6ytELPVOipClQNYN3lYZGbk2s%2FLU4KsfKGsTLefqyM%2BvhiuVaeNURLLHc6kR%2B1uO%2FHEQ%2FDYEkwuhjRDg3DpIXCjsTbC%2B%2F8DQAA%2F%2F8BAAD%2F%2F1zXetBqBAAA
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3s3v8HMvGrwICnPwoCCT7k4nM%2BMeFuMaCcbNuquoIEh1VfWkTHVXW9U1PQkIwQXZ4%2Bhf0HmTbFDDon%2BAoh0PQnAxIwg5mIPgxauwN1FmMjj6QfO91%2B8d3vd99dGeOyc%2BHD1bfVXvSKXowlLTbzzzVhBcbazLzPUb%2Ffbyu8vR1YbpPR%2F4nab%2FbONlwbb0QugHvh%2F4QWNVGpHo%2FkIQBE0fMj%2FqBM2O34zCZrAUoW%2F%2By63zYKkH3jsn85B89MjR%2FQiS1cjSL64Lu1Xo%2FLmXUqdooQ16%2FPCNbCvTZYZ0BhPjIckOp25oe7r6NXR2MAkM3fvHGMsR8X77FXF2OE2JuHdwETRWEBlifgVlr4ZQNSStwfQdSH5KAMZxYwNZeu%2BGNiXdvlDpWB2RuYd%2FQJYjMvfL48jS%2BytK9hu3tXKF1JlFP6kg%2BzVkt0bujlHseJDlMVjxISR%2FQBYeriNL9zes0pC8mgwvZQ2Z1FBiAGo9uPEnPbjEg8s9pPys0WJRu83bS5wKxsI4CdpJlEQdyvyE%2BYudEI6N4w1Q5AMwNQAzu8jNLrbkJ6dL86frazDuG9jNCpZ7sMWIeK%2FtoscrlIKgtAQlJSglQVkQlL3qgCsb2uoeV9bFwbSH075YDXXR3aMHuuiKjOzl5%2BSx8Xa8%2F88%2FiS1x1mAsaicRY60w5gGNfcZby5zRth%2B1abuzzGBlBWkvTQbekSPyv98%2FQC5H5BL9ATE9hlXHYPJRUPcUaDlshT7o5jBq%2B9jJjvr9fiKVsE2mU3BdIS%2FmUGx7e%2BqcPDG50sr3f0Gwk2s%2FkkmBmQq5qfCe%2FI6gq%2B4Ob%2BmS7N%2FSpSVfbuSFTOUOHV%2FwdkELcfmzV8R2qQ1fu24Hn77AxsIYHr0ubLFOMy6zriWfr0jOhVnVhgny1Zp9U8Q3nd1ccSZz%2BfrNF1fX0twIa6XOalA5IqR%2BH0yOyJU%2FH0xe59M%2FfwtpahhXIXUnZFqQ%2Bhgs34XNZ%2FmtJjBq5olzD6WrhiaMZz%2BVJFBixmlcwf6LxzO8Z%2B%2BiazzQ4g6ytELPVOipClQNYN3lYZGbk2s%2FLU4KsfKGsTLefqyM%2BvhiuVaeNURLLHc6kR%2B1uO%2FHEQ%2FDYEkwuhjRDg3DpIXCjsTbC%2B%2F8DQAA%2F%2F8BAAD%2F%2F1zXetBqBAAA HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:44 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4140036740097be845797bfbae21ce85
Strict-Transport-Security: max-age=0; includeSubdomains
game.starswalker.site/api/users/18238267800148645095/1635934?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 4.9 kB URL GET HTTP/2 game.starswalker.site/api/users/18238267800148645095/1635934?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (5660)
Hash dbe75bdf8c28e56de3e90cb7ef19f69a
47706f8511b732b9995cb47630ee297a12005868
0ff60803699906d70371aecd91feaf4220ed322829e11109b30e4b2bb60d39cb
GET /api/users/18238267800148645095/1635934?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/377391?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1
135.181.208.216200 OK 1.1 kB URL GET HTTP/2 game.starswalker.site/api/users/377391?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash d7ab549be249915798e0166e2702482c
e1b0929d26394df2d2e3c913fcf6c460128e6281
3130ee0d42e97f29292055fd73e1f751c1f7f1d23edf7e77eeb65b048d80a01a
GET /api/users/377391?v2=1&fill=0&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25&s2=%25subid2%25&i=1 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
access-control-expose-headers: X-Asg-Config, X-t
x-robots-tag: noindex, nofollow
x-t: 0
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
www.xxxfiles.tv/css/plugins.css
104.21.83.6200 OK 9.5 kB URL GET HTTP/3 www.xxxfiles.tv/css/plugins.css
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type ASCII text, with very long lines (29529)
Hash 4092218dab88f50c2ae78b636da0f06e
6534c8b0dfeaa401038c595a238f3fed21b69da6
2e3480402dc98bc43baa6327e8765e2e07dfc5781359086cb11993e817776cb6
GET /css/plugins.css HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: text/css
last-modified: Wed, 20 Nov 2019 10:53:49 GMT
vary: Accept-Encoding
etag: W/"5dd51b3d-c445"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1798952
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOvVb1i4OiJb3%2Bb5zSz4S6qmrvfkxwHFmb3iSpEy5ieKCb9ipo%2BnROQEOjMLUAuLB%2FzSv%2Fl8fXmMYq71n9ckIprx%2B3gIAoP24izmEVNMCMHYGlO63TfpwdSuw43wBl5DwNg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82a8a25688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F24%2F54%2F4e%2F24544ed07f7394384bbb75023b9b0b3a%2F1591713925.html&l=1274&fd=401
192.243.59.20200 OK 0 B URL GET HTTP/1.1 lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F24%2F54%2F4e%2F24544ed07f7394384bbb75023b9b0b3a%2F1591713925.html&l=1274&fd=401
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F24%2F54%2F4e%2F24544ed07f7394384bbb75023b9b0b3a%2F1591713925.html&l=1274&fd=401 HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:45 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
game.starswalker.site/api/users/12531191190914742095/1987407?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 2.2 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/1987407?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash a79b704ffdad69868378b2c520663518
6a28e408952b31c4e8fcfa6ce631ffbbc8bcb3e1
53c3fae301873433b74ba5a093c58b517b240700ca188d8ca50eb960b03dd729
GET /api/users/12531191190914742095/1987407?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/410357?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
135.181.208.216200 OK 45 kB URL GET HTTP/2 game.starswalker.site/api/users/410357?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type gzip compressed data, from Unix\012- data
Hash fc9e6390562007523a6599105f83df9c
1c6a2f976f73c99e12e2ad02e0f06bb3b7320630
14d2aed4f93d3f48e014c3ff314b5f1a4890beb9b4ff6f364b1cd7488a2237da
GET /api/users/410357?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
set-cookie: asgfp=e19e1989b72653a7152c87a7240d524a; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/img/close.png
172.64.109.10200 OK 4.0 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/img/close.png
IP 172.64.109.10:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type PNG image data, 500 x 500, 8-bit gray+alpha, non-interlaced\012- data
Hash 23e9690b0e7ac26868363a6248f44467
d7ad0eae64e0c1e65b12eda0aa9d2b91996dd64f
f362c67320d739ccf3bea21f857b9620075bd20ceacda8c51261b9612fe28395
GET /sb/notifications/dating/default/us/desk-all/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: image/png
content-length: 4022
last-modified: Tue, 14 Apr 2020 14:09:22 GMT
etag: "5e95c412-fb6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1607101
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iFWUJvovQI1pgnwB0QnaaeuKzeoDZ339d8ISOiaWLsiGscTK%2FsV7ETOEUYdwxFhOtjw5HffTL7LqWpmdDFDr%2FhX5us%2F4AO6U02vsj9VgVY44gx%2FUexdgR1%2FEQHq5GzMgsZF1MwfWa702"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835fae88e42502-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/05/c8/20/05c820d9ce67af6dea2e5441dbe3e8f9/1683231080.png
45.133.44.9200 OK 39 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/05/c8/20/05c820d9ce67af6dea2e5441dbe3e8f9/1683231080.png
IP 45.133.44.9:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint62:DE:BA:BA:30:E9:EE:15:E9:24:B9:C5:BF:E1:7E:39:8B:20:E5:42
ValiditySun, 24 Sep 2023 23:04:02 GMT - Sat, 23 Dec 2023 23:04:01 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash 6451b63b68b5068db02571051f6f6a30
32badef5d69090b4d2ea7b300bb5264938e198ef
b1b0a314a2d4924b2849fec48b7863ccc68413e58330d99f6ad901bfa6282819
GET /si/05/c8/20/05c820d9ce67af6dea2e5441dbe3e8f9/1683231080.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: image/png
content-length: 39220
server: nginx/1.21.6
last-modified: Thu, 04 May 2023 20:11:29 GMT
etag: "64541171-9934"
expires: Mon, 20 Nov 2023 21:40:46 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/b3/dd/fd/b3ddfd7cf6f212b3bce3129fb7a007fc/1683231156.png
45.133.44.9200 OK 65 kB URL GET HTTP/2 cdn.cloudimagesb.com/si/b3/dd/fd/b3ddfd7cf6f212b3bce3129fb7a007fc/1683231156.png
IP 45.133.44.9:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectcdn.cloudimagesb.com
Fingerprint62:DE:BA:BA:30:E9:EE:15:E9:24:B9:C5:BF:E1:7E:39:8B:20:E5:42
ValiditySun, 24 Sep 2023 23:04:02 GMT - Sat, 23 Dec 2023 23:04:01 GMT
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash 887812a53b8ea2dbad33f6ae105b8c2d
f83d97ef46827200fa62093ed09b4b6fa25b26d8
9443edf293511b0732211234002c799508a2bfc63a3e28a57d7b12ee30f277e9
GET /si/b3/dd/fd/b3ddfd7cf6f212b3bce3129fb7a007fc/1683231156.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: image/png
content-length: 64601
server: nginx/1.21.6
last-modified: Thu, 04 May 2023 20:12:45 GMT
etag: "645411bd-fc59"
expires: Mon, 20 Nov 2023 21:40:46 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
go.sexfortokens.com/api/models/vast?action=sbSignupWithModel&campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&campaignType=smartpop&creativeId=0fe634b4ed7128d94852002b593185fc904d0c54974e9bbbec389730ba324b3e&domain=stripchat&duration=00%3A00%3A30&iterationId=752054&masterSmartpopId=2683&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&mlView=1&ruleId=29&skipOffset=00%3A00%3A05&smartpopId=10507&sourceId=tstars-outstream-11186-Out-stream%20Video%20Desktop&tag=-girls%2Fmobile&usePreroll=true&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&variationId=31904
104.18.63.126200 OK 2.5 kB URL GET HTTP/3 go.sexfortokens.com/api/models/vast?action=sbSignupWithModel&campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&campaignType=smartpop&creativeId=0fe634b4ed7128d94852002b593185fc904d0c54974e9bbbec389730ba324b3e&domain=stripchat&duration=00%3A00%3A30&iterationId=752054&masterSmartpopId=2683&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&mlView=1&ruleId=29&skipOffset=00%3A00%3A05&smartpopId=10507&sourceId=tstars-outstream-11186-Out-stream%20Video%20Desktop&tag=-girls%2Fmobile&usePreroll=true&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&variationId=31904
IP 104.18.63.126:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsexfortokens.com
Fingerprint14:74:83:B8:1B:D5:4F:1D:A3:FD:1B:C0:F1:C8:9F:C4:71:56:16:CA
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sat, 21 Sep 2024 23:59:59 GMT
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (2333), with no line terminators
Hash 73ca2c61a2b7cc5d352bfa50044ca859
eca79045da40ba434c0bc8db840b16cf5df27844
9df93e4fd4e8ef7c9e231a6cedfbc771d42dfd8330553a18f508195c9085da8d
GET /api/models/vast?action=sbSignupWithModel&campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&campaignType=smartpop&creativeId=0fe634b4ed7128d94852002b593185fc904d0c54974e9bbbec389730ba324b3e&domain=stripchat&duration=00%3A00%3A30&iterationId=752054&masterSmartpopId=2683&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&mlView=1&ruleId=29&skipOffset=00%3A00%3A05&smartpopId=10507&sourceId=tstars-outstream-11186-Out-stream%20Video%20Desktop&tag=-girls%2Fmobile&usePreroll=true&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&variationId=31904 HTTP/1.1
Host: go.sexfortokens.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
Referer: https://www.xxxfiles.tv/
DNT: 1
Connection: keep-alive
Cookie: __cflb=04dToajuB2cYa95JPJmk1yQQMjYKLoXMASvRLi2GuA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:45 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82835fa649feb529-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
www.xxxfiles.tv/js/main.js
104.21.83.6200 OK 22 kB URL GET HTTP/3 www.xxxfiles.tv/js/main.js
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
Hash c719a8f50a9ec082de5a40a2d0b1a442
e9c74b76c56ad7106bd75cb77ef4bbbdb6f67859
96c5ec1f6d8d942a6c1f563600a7f05d8424371972aeb6576be2cd762bee5b1c
GET /js/main.js HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
last-modified: Tue, 04 May 2021 10:44:25 GMT
vary: Accept-Encoding
etag: W/"60912589-511f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 982362
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fRZkKpGMQGtImUhQwx9sc0SQk1Q9Cigbfoo6DNkFGXxK55BMRkT9360%2BuixRozEIo4uQTh2Usd7ZZfCKIytQ8pnjjpWb6Frx8Tc0JsA3XcHV68lv47gGJxLVNVJFgxEcaJc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82a8ad5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
142.250.74.163200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 142.250.74.163:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 13 Nov 2023 23:43:03 GMT
expires: Tue, 12 Nov 2024 23:43:03 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 424663
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/js/script.js
172.64.109.10200 OK 189 B URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/js/script.js
IP 172.64.109.10:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash 5ca8c1679ba9453cfa512e01d6fec9c5
45628341eb20e4acee5e812d3b2dfc8f23962daf
520a0196a18cbe656f7382a02ec828125e68bdac511b9ebe2bf27f31e262d037
GET /sb/notifications/dating/default/us/desk-all/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: application/javascript
last-modified: Tue, 14 Apr 2020 14:09:27 GMT
etag: W/"5e95c417-182"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 581801
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FxWXcZ2y5S9WaXB5iQciEmpo693iBNdXcGnsJv4%2FhuRLuDF3Za6hU3JeEUaZmZ5MG0oWSGkjyCOIcRBcRxle4TOuRpZNzzcYA5c0vuxCjqFlGm%2F1965UV5VcVoz2C9tUP1ms3JoQI3aR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835fae7a346511-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
www.xxxfiles.tv/vpaid/videojs_5.vast.vpaid.min.js
104.21.83.6200 OK 71 kB URL GET HTTP/3 www.xxxfiles.tv/vpaid/videojs_5.vast.vpaid.min.js
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type ASCII text, with very long lines (32057)
Hash 3eb2d1bdcb22ab1037fe9f6b5cf00143
b065d9fabe06ca3488cdd628c6da319c49dd4a78
66348d21d329d78be67f953ac0aad20a504ec3f3f911d3d67f58516475a18036
GET /vpaid/videojs_5.vast.vpaid.min.js HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
last-modified: Wed, 20 Nov 2019 11:59:07 GMT
vary: Accept-Encoding
etag: W/"5dd52a8b-19ebe"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1867851
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fse324Voit4RK0m9im4NN7iezHbbDTDHm924O2USuGfyPLAP%2BRW1tcVL0%2Bqg4Zp96xW7gJ2LG8e%2FpPjCQ3Ek2PBvkWqzGnugkkLCxY8ojEDEgDhlJXV5CUN0k2jWO%2F94GlY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82d8d35688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
lemondependedadminister.com/pixel/sbs?c=1
192.243.59.20200 OK 0 B URL GET HTTP/1.1 lemondependedadminister.com/pixel/sbs?c=1
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:46 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
game.starswalker.site/api/click/15443191398799364095?c=60&data[error]=3
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/15443191398799364095?c=60&data[error]=3
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/15443191398799364095?c=60&data[error]=3 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
i.wmgtr.com/cic/Z7lnYLLOXrmS4-xZSk7ADX5WgcqupEhI.png
45.133.44.33 18 kB URL GET i.wmgtr.com/cic/Z7lnYLLOXrmS4-xZSk7ADX5WgcqupEhI.png
IP 45.133.44.33:0
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecti.wmgtr.com
FingerprintEC:B5:1E:3E:A4:6B:92:23:E2:9E:1E:FC:99:58:59:8E:23:DD:C1:25
ValidityMon, 23 Oct 2023 00:02:20 GMT - Sun, 21 Jan 2024 00:02:19 GMT
File type PNG image data, 192 x 192, 8-bit colormap, non-interlaced\012- data
Hash d58df9eafc7b648ee545cfe27bc6d5ed
e4a50dbe582373820c756597d2dfbac095645bee
9708a1cded605600202c9cddaeb3b4adf56292b920f6a7104a04445cf0a32b54
GET /cic/Z7lnYLLOXrmS4-xZSk7ADX5WgcqupEhI.png HTTP/1.1
Host: i.wmgtr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: image/png
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-option: nosniff
content-encoding: gzip
cache-control: max-age=82800
expires: Sun, 19 Nov 2023 20:40:44 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
lemondependedadminister.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3t3f4ededPEiKMzBg4JMuic9Mz3uYTGukWDcrLuKCoJUV1VPylR3tVVd05OAEFyQPY7%2BBZ03yQY1LPoHKNrxIAQXM4KQgzkIXrwKexNlJsHRD5rve%2F3e4X3fq4923Cnx4ejJ8qt6SypFF9pNv%2FHMW0FwtbEqMzdsDKPOu53wasMMng%2F8XtN%2FtvGyYBt6oeUHvh%2F4QWNZGpHo4UIQBE0fMj%2FoBc2e3wxbzaAdYmj%2Bi63zYKkHPjglVyD55JGD%2ByEkq5GlX1wXdqPQ%2BXMvpU7RQhsM%2BP4b2UamywzpfEyMhyTbP1dD2%2BPlr6GzvZlh6ME%2FwlhOiPfbr4iz%2FXOXiAd7Z0ZjBZEh5pdRDmoIVUPSGkzfgeTHBGAcN9aQpfduaFPSzTOWTtkJufTwD8hyQi798jiy9P6SksPGba1cIXVmMUwqyGEN2a%2BRu0MUWx5keQhWfAjJH5CFh6vI0t01qzQkr2bLS1lDJjWUGIFaD276SQ8u8eByDyk%2FaXRZGEU8anMqGGvFSRAlYRL2KPMT5i%2F2WnBsam%2BEIh%2BBqRGY2UZutrEhPzluXzleXYFx38CuV7Dcgy0mxHttGwNeoRQEpSUoKUEpCcqCoBxUe1zZlq3ucWVdHJz31nlfrMa66O%2FQPV30RUZ28lPy2PQ63v%2BvPIkNcdJgLIySkLFuK%2BYBjX3Gux3OaOSHEY16HQYrK0h7YbbwlpyQ%2F%2F3%2BAXI5IRfoD4jpIaw6BJOPgrqnQMtxt%2BWDro%2FDyMdWdjAcDhOphG0ynYLrCnlxCcWmt6NOyROzlJa%2B%2FwuCHV37kcwKzFTITYX35HcEfXV3fEuXZPeWLi35ci0vZCq36DTB2wUtxMXPXhGbpTZ85bodffoCmxLT8eB1YYtVmnGZ9S35fElyLsyyNkyQr1bsmyK%2B6ez6kjOZy1dvvri8kuZGWCt1VoPKCSH1%2B2ByQi7%2F%2BWD2Op%2F%2B%2BVtIU8O4Cqk7IucFqQ%2FB8m3YfO7fagKj5po491C6amxa8fynkgRKzDGNK9h%2F4Xg%2B79i76BsPtLiDLK0wMBUGqgJVI1h3cVzk5ujaT4uzQqy8cayMtxsroz4%2BO66V05B9QYO4GwjBRXuRsbDDoriTLIZdEbV5G4WdiLcX3vkbAAD%2F%2FwEAAP%2F%2Fo%2FDSwGoEAAA%3D
173.233.139.164200 OK 7 B URL GET HTTP/1.1 lemondependedadminister.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3t3f4ededPEiKMzBg4JMuic9Mz3uYTGukWDcrLuKCoJUV1VPylR3tVVd05OAEFyQPY7%2BBZ03yQY1LPoHKNrxIAQXM4KQgzkIXrwKexNlJsHRD5rve%2F3e4X3fq4923Cnx4ejJ8qt6SypFF9pNv%2FHMW0FwtbEqMzdsDKPOu53wasMMng%2F8XtN%2FtvGyYBt6oeUHvh%2F4QWNZGpHo4UIQBE0fMj%2FoBc2e3wxbzaAdYmj%2Bi63zYKkHPjglVyD55JGD%2ByEkq5GlX1wXdqPQ%2BXMvpU7RQhsM%2BP4b2UamywzpfEyMhyTbP1dD2%2BPlr6GzvZlh6ME%2FwlhOiPfbr4iz%2FXOXiAd7Z0ZjBZEh5pdRDmoIVUPSGkzfgeTHBGAcN9aQpfduaFPSzTOWTtkJufTwD8hyQi798jiy9P6SksPGba1cIXVmMUwqyGEN2a%2BRu0MUWx5keQhWfAjJH5CFh6vI0t01qzQkr2bLS1lDJjWUGIFaD276SQ8u8eByDyk%2FaXRZGEU8anMqGGvFSRAlYRL2KPMT5i%2F2WnBsam%2BEIh%2BBqRGY2UZutrEhPzluXzleXYFx38CuV7Dcgy0mxHttGwNeoRQEpSUoKUEpCcqCoBxUe1zZlq3ucWVdHJz31nlfrMa66O%2FQPV30RUZ28lPy2PQ63v%2BvPIkNcdJgLIySkLFuK%2BYBjX3Gux3OaOSHEY16HQYrK0h7YbbwlpyQ%2F%2F3%2BAXI5IRfoD4jpIaw6BJOPgrqnQMtxt%2BWDro%2FDyMdWdjAcDhOphG0ynYLrCnlxCcWmt6NOyROzlJa%2B%2FwuCHV37kcwKzFTITYX35HcEfXV3fEuXZPeWLi35ci0vZCq36DTB2wUtxMXPXhGbpTZ85bodffoCmxLT8eB1YYtVmnGZ9S35fElyLsyyNkyQr1bsmyK%2B6ez6kjOZy1dvvri8kuZGWCt1VoPKCSH1%2B2ByQi7%2F%2BWD2Op%2F%2B%2BVtIU8O4Cqk7IucFqQ%2FB8m3YfO7fagKj5po491C6amxa8fynkgRKzDGNK9h%2F4Xg%2B79i76BsPtLiDLK0wMBUGqgJVI1h3cVzk5ujaT4uzQqy8cayMtxsroz4%2BO66V05B9QYO4GwjBRXuRsbDDoriTLIZdEbV5G4WdiLcX3vkbAAD%2F%2FwEAAP%2F%2Fo%2FDSwGoEAAA%3D
IP 173.233.139.164:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSwWskxRut3t3f4ededPEiKMzBg4JMuic9Mz3uYTGukWDcrLuKCoJUV1VPylR3tVVd05OAEFyQPY7%2BBZ03yQY1LPoHKNrxIAQXM4KQgzkIXrwKexNlJsHRD5rve%2F3e4X3fq4923Cnx4ejJ8qt6SypFF9pNv%2FHMW0FwtbEqMzdsDKPOu53wasMMng%2F8XtN%2FtvGyYBt6oeUHvh%2F4QWNZGpHo4UIQBE0fMj%2FoBc2e3wxbzaAdYmj%2Bi63zYKkHPjglVyD55JGD%2ByEkq5GlX1wXdqPQ%2BXMvpU7RQhsM%2BP4b2UamywzpfEyMhyTbP1dD2%2BPlr6GzvZlh6ME%2FwlhOiPfbr4iz%2FXOXiAd7Z0ZjBZEh5pdRDmoIVUPSGkzfgeTHBGAcN9aQpfduaFPSzTOWTtkJufTwD8hyQi798jiy9P6SksPGba1cIXVmMUwqyGEN2a%2BRu0MUWx5keQhWfAjJH5CFh6vI0t01qzQkr2bLS1lDJjWUGIFaD276SQ8u8eByDyk%2FaXRZGEU8anMqGGvFSRAlYRL2KPMT5i%2F2WnBsam%2BEIh%2BBqRGY2UZutrEhPzluXzleXYFx38CuV7Dcgy0mxHttGwNeoRQEpSUoKUEpCcqCoBxUe1zZlq3ucWVdHJz31nlfrMa66O%2FQPV30RUZ28lPy2PQ63v%2BvPIkNcdJgLIySkLFuK%2BYBjX3Gux3OaOSHEY16HQYrK0h7YbbwlpyQ%2F%2F3%2BAXI5IRfoD4jpIaw6BJOPgrqnQMtxt%2BWDro%2FDyMdWdjAcDhOphG0ynYLrCnlxCcWmt6NOyROzlJa%2B%2FwuCHV37kcwKzFTITYX35HcEfXV3fEuXZPeWLi35ci0vZCq36DTB2wUtxMXPXhGbpTZ85bodffoCmxLT8eB1YYtVmnGZ9S35fElyLsyyNkyQr1bsmyK%2B6ez6kjOZy1dvvri8kuZGWCt1VoPKCSH1%2B2ByQi7%2F%2BWD2Op%2F%2B%2BVtIU8O4Cqk7IucFqQ%2FB8m3YfO7fagKj5po491C6amxa8fynkgRKzDGNK9h%2F4Xg%2B79i76BsPtLiDLK0wMBUGqgJVI1h3cVzk5ujaT4uzQqy8cayMtxsroz4%2BO66V05B9QYO4GwjBRXuRsbDDoriTLIZdEbV5G4WdiLcX3vkbAAD%2F%2FwEAAP%2F%2Fo%2FDSwGoEAAA%3D HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:47 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 20d3d3bf718d76072d1a8dcc4ab13378
Strict-Transport-Security: max-age=0; includeSubdomains
lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fanimate.css&l=79245&fd=1641
173.233.139.164200 OK 0 B URL GET HTTP/1.1 lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fanimate.css&l=79245&fd=1641
IP 173.233.139.164:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fanimate.css&l=79245&fd=1641 HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:47 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
pxl.tsyndicate.com/api/v1/error?errorcode=400&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644
176.9.61.214200 OK 0 B URL GET HTTP/2 pxl.tsyndicate.com/api/v1/error?errorcode=400&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644
IP 176.9.61.214:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/v1/error?errorcode=400&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644 HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: ts_uid=32292795-9262-46b2-bf7a-15696304e81d; bfq=APeIECNCx5YZN2jMkDEDRxcWIsYU3BLjoYgyE2PcgAFDIUcaNLr0URAQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
pxl.tsyndicate.com/api/v1/error?errorcode=3&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644
176.9.61.214200 OK 0 B URL GET HTTP/2 pxl.tsyndicate.com/api/v1/error?errorcode=3&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644
IP 176.9.61.214:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/v1/error?errorcode=3&p=APeICDOGjggdMFgMhAPnYIyHOGwoHNOmoQ4bMnLgyBFDoRg3bg7OuCEjhg2OCum0cXgDBowZNGbYoEEjZRsZLF3ClEmzBowcCuGwGXMwoYgxZ4r2URAQ&s=a5d2757779ecc43b708f32e582ed75035ffb440de0f0aa9505e220dfd40add8b1700343644 HTTP/1.1
Host: pxl.tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: ts_uid=32292795-9262-46b2-bf7a-15696304e81d; bfq=APeIECNCx5YZN2jMkDEDRxcWIsYU3BLjoYgyE2PcgAFDIUcaNLr0URAQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
x-robots-tag: noindex, nofollow
X-Firefox-Spdy: h2
galleryn1.vcmdiawe.com/cff8db667da30f61f58f9ad88f1393fa17/12998a97dec5e55f155e4bb36d667243.mp4?psid=ct_trrmntvbdtww
93.93.51.190206 Partial Content 3.1 MB URL GET HTTP/2 galleryn1.vcmdiawe.com/cff8db667da30f61f58f9ad88f1393fa17/12998a97dec5e55f155e4bb36d667243.mp4?psid=ct_trrmntvbdtww
IP 93.93.51.190:443
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerSectigo Limited
Subject*.vcmdiawe.com
FingerprintAA:C6:B9:40:26:EC:8E:97:8B:70:D4:4A:8A:19:9C:C6:19:5D:07:EE
ValidityTue, 02 May 2023 00:00:00 GMT - Thu, 02 May 2024 23:59:59 GMT
File type ISO Media, MP4 v2 [ISO 14496-14]\012- data
Size 3.1 MB (3064277 bytes)
Hash 4e260f434edebe7b78031236d1e054b5
35a109595adfcb5a9defc28e5f57ea7704247735
66050b070ce54d2eb540826f99aa616027cba3b087304191e0c4d6474833572b
GET /cff8db667da30f61f58f9ad88f1393fa17/12998a97dec5e55f155e4bb36d667243.mp4?psid=ct_trrmntvbdtww HTTP/1.1
Host: galleryn1.vcmdiawe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:47 GMT
content-type: video/mp4
content-length: 3064277
last-modified: Fri, 07 Jul 2023 11:29:16 GMT
x-rgw-object-type: Normal
etag: "4e260f434edebe7b78031236d1e054b5"
access-control-allow-origin: *
x-content-type-options: nosniff
x-cache-source: Origin
x-cache-status: R-HIT
expires: Sat, 02 Dec 2023 21:40:47 GMT
server: unknown
x-cdn-node: sesto
cache-control: max-age=1209600
x-real-source: -
content-range: bytes 0-3064276/3064277
X-Firefox-Spdy: h2
game.starswalker.site/api/click/8662162342837405095?c=60&data[error]=3
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/8662162342837405095?c=60&data[error]=3
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/8662162342837405095?c=60&data[error]=3 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
game.starswalker.site/api/click/8662162342837405095?c=60&data[error]=400
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/8662162342837405095?c=60&data[error]=400
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/8662162342837405095?c=60&data[error]=400 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
game.starswalker.site/api/click/14501003478878081095?c=60&data[error]=3
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/14501003478878081095?c=60&data[error]=3
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/14501003478878081095?c=60&data[error]=3 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:48 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
game.starswalker.site/api/click/14501003478878081095?c=60&data[error]=400
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/14501003478878081095?c=60&data[error]=400
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/14501003478878081095?c=60&data[error]=400 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:48 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
s.magsrv.com/vregister.php?a=vview&errorcode=3&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine
95.211.229.245200 OK 20 B URL GET HTTP/1.1 s.magsrv.com/vregister.php?a=vview&errorcode=3&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine
IP 95.211.229.245:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectmagsrv.com
FingerprintC5:BC:C0:62:0C:DC:A9:D2:61:A6:77:A9:6C:31:19:AD:CD:2E:00:67
ValidityThu, 05 Oct 2023 15:26:28 GMT - Wed, 03 Jan 2024 15:26:27 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /vregister.php?a=vview&errorcode=3&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine HTTP/1.1
Host: s.magsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5c668b14.849545443274206090%22%3B%7D; c-tag=%7B%22tag-video%22%3A%22v4%7C%7CNOR%7C4878486%7C87974542%7C0%7C%7C97%7C41%7C3%7C15%7C0%7C0%7C0%7C25344%7C3143242%7C3143244%7C0%7C1%7C0%7C0%7C0%7C0%7C1%7C0%7C0%7C1%7C%7C%7C0%7Cxxxfiles.tv%7C%7C%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C1700343644%7C36a520af53ee99e8809eac57a639765e%7Cok%22%7D; zone-cap-4878486=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin:
Access-Control-Allow-Credentials: true
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
u3y8v8u4.aucdn.net/library/141372/6143e03a2a294d9c05f2edcafb29c0d172a71cb1.mp4
185.76.9.16206 Partial Content 5.5 MB URL GET HTTP/2 u3y8v8u4.aucdn.net/library/141372/6143e03a2a294d9c05f2edcafb29c0d172a71cb1.mp4
IP 185.76.9.16:443
ASN #60068 Datacamp Limited
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectafcdn.net
Fingerprint23:5D:B4:21:E2:4A:BC:A2:81:F9:7D:F8:B1:5C:6C:1D:7D:F3:FC:C8
ValidityThu, 05 Oct 2023 14:56:57 GMT - Wed, 03 Jan 2024 14:56:56 GMT
File type ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]\012- data
Size 5.5 MB (5531340 bytes)
Hash 45d6de3300b5363c8e088bded1ffdaa8
6143e03a2a294d9c05f2edcafb29c0d172a71cb1
1f7e74c1c320567068ac70ac395cb088e801068918f697ac65379fc22c5a342b
GET /library/141372/6143e03a2a294d9c05f2edcafb29c0d172a71cb1.mp4 HTTP/1.1
Host: u3y8v8u4.aucdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:47 GMT
content-type: video/mp4
content-length: 5531340
last-modified: Tue, 14 Mar 2023 13:10:26 GMT
etag: "64107242-5466cc"
expires: Wed, 13 Mar 2024 13:17:04 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-robots-tag: noindex, follow
x-cache-op: HIT
server: CDN77-Turbo
x-77-nzt: AblMCQ03Nzf/OU86AA
x-77-nzt-ray: c0a4cc2899566bf15f2f596585e2b929
x-accel-expires: @1728058278
x-accel-date: 1696522278
x-cache-lb: HIT
x-age-lb: 3821369
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 3821369
content-range: bytes 0-5531339/5531340
X-Firefox-Spdy: h2
s.magsrv.com/vregister.php?a=vview&errorcode=400&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine
95.211.229.245200 OK 20 B URL GET HTTP/1.1 s.magsrv.com/vregister.php?a=vview&errorcode=400&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine
IP 95.211.229.245:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectmagsrv.com
FingerprintC5:BC:C0:62:0C:DC:A9:D2:61:A6:77:A9:6C:31:19:AD:CD:2E:00:67
ValidityThu, 05 Oct 2023 15:26:28 GMT - Wed, 03 Jan 2024 15:26:27 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /vregister.php?a=vview&errorcode=400&idzone=4646896&dg=5786572-NOR-81873074-3-0-1-0-InLine HTTP/1.1
Host: s.magsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5c668b14.849545443274206090%22%3B%7D; c-tag=%7B%22tag-video%22%3A%22v4%7C%7CNOR%7C4878486%7C87974542%7C0%7C%7C97%7C41%7C3%7C15%7C0%7C0%7C0%7C25344%7C3143242%7C3143244%7C0%7C1%7C0%7C0%7C0%7C0%7C1%7C0%7C0%7C1%7C%7C%7C0%7Cxxxfiles.tv%7C%7C%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C1700343644%7C36a520af53ee99e8809eac57a639765e%7Cok%22%7D; zone-cap-4878486=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin:
Access-Control-Allow-Credentials: true
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
game.starswalker.site/api/click/12853537157542678095?c=90
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/12853537157542678095?c=90
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/12853537157542678095?c=90 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:42 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
m3.twinredads.com/m62271.jpg
69.16.175.10200 OK 64 kB URL GET HTTP/1.1 m3.twinredads.com/m62271.jpg
IP 69.16.175.10:443
Requested by https://twinrdsrv.com/mediahosting.engine?MediaId=62271&AId=9653&CId=23846&PId=41673&SiteId=7003&ZoneId=41938&VolumeMetricId=deb54791-4f41-4799-a394-d3dfdbce64b7&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
Certificate IssuerGoDaddy.com, Inc.
Subjectm3.twinredads.com
FingerprintB2:08:56:DF:D1:03:83:DE:20:1E:DB:6F:01:ED:DD:B8:EB:09:64:FB
ValidityTue, 25 Oct 2022 19:48:27 GMT - Sun, 26 Nov 2023 19:48:27 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], progressive, precision 8, 715x551, components 3\012- data
Hash 59e1ece7106bb6203db90d05564c5cbe
14447794b2f3c91467806900623cf268afb51b0e
160887836fe533271e5b8d51fa66144947e4eee4586092d845daa5d5a854a9b2
GET /m62271.jpg HTTP/1.1
Host: m3.twinredads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 18 Nov 2023 21:40:43 GMT
Connection: Keep-Alive
ETag: "1620827760"
Cache-Control: max-age=103
Content-Length: 64252
Content-Type: image/jpeg
Last-Modified: Wed, 12 May 2021 13:56:00 GMT
Accept-Ranges: bytes
X-HW: 1700343643.dop220.sk1.t,1700343643.cds206.sk1.shn,1700343643.dop220.sk1.t,1700343643.cds020.sk1.c
Access-Control-Allow-Origin: *
game.starswalker.site/api/users/12531191190914742095/997745?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 1.8 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/997745?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML document, ASCII text, with very long lines (1810), with no line terminators
Hash cd4f6bfa3d2a75cb0a7a1a5689e2df8e
16cf847f9c2440fa1430264f099879499a6597b0
882a7019917353e8deadbae124af06d2406b81fd5f993a2e1a2d9b973c48c41a
GET /api/users/12531191190914742095/997745?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
xdiwbc.com/template/social.html
188.114.96.1200 OK 4.6 kB URL GET HTTP/2 xdiwbc.com/template/social.html
IP 188.114.96.1:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxdiwbc.com
Fingerprint5D:41:10:46:C6:59:EE:4D:26:CD:FC:4F:4C:13:35:6F:6E:2E:05:91
ValidityMon, 02 Oct 2023 04:50:38 GMT - Sun, 31 Dec 2023 04:50:37 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4639), with no line terminators
Hash 474cf430e4f70fc61a3695cb75f686de
8c14127415e490dff27896747f730ca8e49a957a
12fe3666e6b24360e737799e0cb1eafc47e6f11ccc109562f5426767a8529ef7
GET /template/social.html HTTP/1.1
Host: xdiwbc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: https://www.xxxfiles.tv
cache-control: max-age=14400
cf-cache-status: HIT
age: 3212
last-modified: Sat, 18 Nov 2023 20:47:12 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nZotKcBI49T50I9i8pyM7DL4N1R4vilait%2BucMYf4TRH4u98xooifCwEq%2BGsGOfA3nMkg6q9pC%2B2dOBKkyIXDRFmAIi9Uu21zCDa0pxsTDFu3A8%2BDtu70yxQH6n"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9f0f7e568f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
s.magsrv.com/splash.php?idzone=4878486&sub=%25subid1%25&tags=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent
95.211.229.245200 OK 6.2 kB URL GET HTTP/1.1 s.magsrv.com/splash.php?idzone=4878486&sub=%25subid1%25&tags=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent
IP 95.211.229.245:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectmagsrv.com
FingerprintC5:BC:C0:62:0C:DC:A9:D2:61:A6:77:A9:6C:31:19:AD:CD:2E:00:67
ValidityThu, 05 Oct 2023 15:26:28 GMT - Wed, 03 Jan 2024 15:26:27 GMT
File type XML document, ASCII text, with very long lines (6315), with no line terminators
Hash d9412fc3de48adde4e0363bcd3e3e639
e0fa21b93644839b4d8b4e5dc58859c22f5dcc0c
aa98f1e0c8ebc0ec132d090c25efb780ebf716ecfd7cc2ed31f2f5f22ce2c6a1
GET /splash.php?idzone=4878486&sub=%25subid1%25&tags=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent HTTP/1.1
Host: s.magsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:44 GMT
Content-Type: text/xml;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: X-CH-VALUES
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5c668b14.849545443274206090%22%3B%7D; expires=Mon, 17 Nov 2025 21:40:44 GMT; path=; domain=.magsrv.com; Secure; SameSite=none
c-tag=%7B%22tag-video%22%3A%22v4%7C%7CNOR%7C4878486%7C87974542%7C0%7C%7C97%7C41%7C3%7C15%7C0%7C0%7C0%7C25344%7C3143242%7C3143244%7C0%7C1%7C0%7C0%7C0%7C0%7C1%7C0%7C0%7C1%7C%7C%7C0%7Cxxxfiles.tv%7C%7C%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C1700343644%7C36a520af53ee99e8809eac57a639765e%7Cok%22%7D; expires=Fri, 16 Feb 2024 21:40:44 GMT; path=/; domain=.magsrv.com; Secure; SameSite=none
zone-cap-4878486=1; expires=Sat, 18 Nov 2023 21:41:44 GMT; path=/; domain=.magsrv.com; Secure; SameSite=none
Cache-Control: no-store
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://www.xxxfiles.tv
Access-Control-Allow-Credentials: true
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
twinrdsrv.com//Redirect.eng?MediaSegmentId=33126&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgBI8dGEasOEJdPTogi0yyZzH0Nth4KOdXCfmUQFhPO08GR06S3JS4fiJbdAl4pdJWJbWHkAM2FsKiADvHaBBryXcOenjnXohwu-H9JQDwJ83jttmhBvZE4sbZZ4UdWF6t9IeY7Sq2G9yeV5bEiK3bI0ORAIUa_uyXaS7fWfkdloLwA1ouUoHsqpX3O3rcuaLui9dMSx64z2ejIMi6uxGkrqLygzshZ__OMnC2rYgIcamfG67pKQExwzJLfz0Z4DB-smuxor--zA4gbmVjWIj-d7eH9iqqGP4KAz3jgRe4FXu3FmZ6IriCDy6i6qJlu19Uq4xkM6Fq2Mg39NAj7GrGUtzJg7S1uauQWC5v_vNVcwchrcIv_Xullb1IGQ7oLn4_tkNATlTQU2Tv4ZdQBGVg3u2Zc2FlHjnxt9WLSbd9gTfasxySFKB5EjRF0Fx2lWKHob1eWUsGzIcMk0eZZeBZcwJgSDf_ONoU8hqoh24dpL7l-dIe5X3pQPBnOVtXGHxmTboxnKrRMrrlPCTadW8l5JnJn2OJ5sHljxfJP7DmuXTDrOewIgXQUKTG45FHgDw-2SSYas9XDQfn6PBSeThdN5mH3WUYbCzvtCEOfZxWVutXwTSlJK6mJc96jAtA2xB7Zu-bJHBVQPzPyVAajLwt41s-Q2WaHJpHdg1FvQHNudLA9TeWCBQqYSj1r_iLzpBgpWKOzlwUQZUIbab-o2XepjdZF5q6XamRRmrX2qmf1SURQJ_IhFh8IMFDc2CmP2JMzckZKmGV2NRH8AV4MMC3zlpbr0PSFgzXVYkqe5MCEF915R0QT_maO090TNRm1nx83m_4U_9qMEuF_0_S3lxeCajwyi5D0L6CS-kD7_F5F59XoXn3rpT42syM8BvOS5Lqi_9R9yi6dYWxqXiHvL-p5gPujYqOlz-7OiKh9GWmdAN0nwvhuQRvW5Vwumrle9kY1uf_bhwQTBTRkZOK5vnOOE1&kw=&mw=150&mh=125&ml=64&curlh=362792523
172.66.40.197302 Found 15 kB URL GET HTTP/3 twinrdsrv.com//Redirect.eng?MediaSegmentId=33126&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgBI8dGEasOEJdPTogi0yyZzH0Nth4KOdXCfmUQFhPO08GR06S3JS4fiJbdAl4pdJWJbWHkAM2FsKiADvHaBBryXcOenjnXohwu-H9JQDwJ83jttmhBvZE4sbZZ4UdWF6t9IeY7Sq2G9yeV5bEiK3bI0ORAIUa_uyXaS7fWfkdloLwA1ouUoHsqpX3O3rcuaLui9dMSx64z2ejIMi6uxGkrqLygzshZ__OMnC2rYgIcamfG67pKQExwzJLfz0Z4DB-smuxor--zA4gbmVjWIj-d7eH9iqqGP4KAz3jgRe4FXu3FmZ6IriCDy6i6qJlu19Uq4xkM6Fq2Mg39NAj7GrGUtzJg7S1uauQWC5v_vNVcwchrcIv_Xullb1IGQ7oLn4_tkNATlTQU2Tv4ZdQBGVg3u2Zc2FlHjnxt9WLSbd9gTfasxySFKB5EjRF0Fx2lWKHob1eWUsGzIcMk0eZZeBZcwJgSDf_ONoU8hqoh24dpL7l-dIe5X3pQPBnOVtXGHxmTboxnKrRMrrlPCTadW8l5JnJn2OJ5sHljxfJP7DmuXTDrOewIgXQUKTG45FHgDw-2SSYas9XDQfn6PBSeThdN5mH3WUYbCzvtCEOfZxWVutXwTSlJK6mJc96jAtA2xB7Zu-bJHBVQPzPyVAajLwt41s-Q2WaHJpHdg1FvQHNudLA9TeWCBQqYSj1r_iLzpBgpWKOzlwUQZUIbab-o2XepjdZF5q6XamRRmrX2qmf1SURQJ_IhFh8IMFDc2CmP2JMzckZKmGV2NRH8AV4MMC3zlpbr0PSFgzXVYkqe5MCEF915R0QT_maO090TNRm1nx83m_4U_9qMEuF_0_S3lxeCajwyi5D0L6CS-kD7_F5F59XoXn3rpT42syM8BvOS5Lqi_9R9yi6dYWxqXiHvL-p5gPujYqOlz-7OiKh9GWmdAN0nwvhuQRvW5Vwumrle9kY1uf_bhwQTBTRkZOK5vnOOE1&kw=&mw=150&mh=125&ml=64&curlh=362792523
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET //Redirect.eng?MediaSegmentId=33126&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=pnRDbQOSFQ--68Xdld-IgBI8dGEasOEJdPTogi0yyZzH0Nth4KOdXCfmUQFhPO08GR06S3JS4fiJbdAl4pdJWJbWHkAM2FsKiADvHaBBryXcOenjnXohwu-H9JQDwJ83jttmhBvZE4sbZZ4UdWF6t9IeY7Sq2G9yeV5bEiK3bI0ORAIUa_uyXaS7fWfkdloLwA1ouUoHsqpX3O3rcuaLui9dMSx64z2ejIMi6uxGkrqLygzshZ__OMnC2rYgIcamfG67pKQExwzJLfz0Z4DB-smuxor--zA4gbmVjWIj-d7eH9iqqGP4KAz3jgRe4FXu3FmZ6IriCDy6i6qJlu19Uq4xkM6Fq2Mg39NAj7GrGUtzJg7S1uauQWC5v_vNVcwchrcIv_Xullb1IGQ7oLn4_tkNATlTQU2Tv4ZdQBGVg3u2Zc2FlHjnxt9WLSbd9gTfasxySFKB5EjRF0Fx2lWKHob1eWUsGzIcMk0eZZeBZcwJgSDf_ONoU8hqoh24dpL7l-dIe5X3pQPBnOVtXGHxmTboxnKrRMrrlPCTadW8l5JnJn2OJ5sHljxfJP7DmuXTDrOewIgXQUKTG45FHgDw-2SSYas9XDQfn6PBSeThdN5mH3WUYbCzvtCEOfZxWVutXwTSlJK6mJc96jAtA2xB7Zu-bJHBVQPzPyVAajLwt41s-Q2WaHJpHdg1FvQHNudLA9TeWCBQqYSj1r_iLzpBgpWKOzlwUQZUIbab-o2XepjdZF5q6XamRRmrX2qmf1SURQJ_IhFh8IMFDc2CmP2JMzckZKmGV2NRH8AV4MMC3zlpbr0PSFgzXVYkqe5MCEF915R0QT_maO090TNRm1nx83m_4U_9qMEuF_0_S3lxeCajwyi5D0L6CS-kD7_F5F59XoXn3rpT42syM8BvOS5Lqi_9R9yi6dYWxqXiHvL-p5gPujYqOlz-7OiKh9GWmdAN0nwvhuQRvW5Vwumrle9kY1uf_bhwQTBTRkZOK5vnOOE1&kw=&mw=150&mh=125&ml=64&curlh=362792523 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
content-length: 428
location: https://twinrdsrv.com/mediahosting.engine?MediaId=62279&AId=9653&CId=23846&PId=41674&SiteId=7003&ZoneId=41938&VolumeMetricId=e436a309-3a84-4e4f-9797-b32b0daf8cac&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
cache-control: private, no-transform
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=e436a309-3a84-4e4f-9797-b32b0daf8cac; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: CP="CAO PSA OUR IND"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I%2B9ozyHUd8NheZkYusZOSgY%2B6DAvoFqXhuqUETHx6wiwYrN39t7S8v32nRzJTZCTVTOTmpI80jvuHoA6pDH6InHMZGd87vr6AbHGbLbEAKstjoyZNz5OGaUW%2F5L6JNo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f98f821b505-OSL
alt-svc: h3=":443"; ma=86400
m3.twinredads.com/m97906.jpg
69.16.175.10200 OK 66 kB URL GET HTTP/1.1 m3.twinredads.com/m97906.jpg
IP 69.16.175.10:443
Requested by https://twinrdsrv.com/mediahosting.engine?MediaId=97906&AId=2598&CId=44243&PId=75906&SiteId=7003&ZoneId=41938&VolumeMetricId=cebfa2b8-0a84-4cb4-80d4-cf65c3587761&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
Certificate IssuerGoDaddy.com, Inc.
Subjectm3.twinredads.com
FingerprintB2:08:56:DF:D1:03:83:DE:20:1E:DB:6F:01:ED:DD:B8:EB:09:64:FB
ValidityTue, 25 Oct 2022 19:48:27 GMT - Sun, 26 Nov 2023 19:48:27 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 0x0, segment length 16, baseline, precision 8, 489x367, components 3\012- data
Hash bc3a713fbd906bbbce568612f322cbea
be2b4d6972fbf6fd4d3dc7024c345c3164b635e3
938124ea98e9502b1836ef58436d4db18f7d39ff28941d4da77c6cbcebe59c85
GET /m97906.jpg HTTP/1.1
Host: m3.twinredads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 18 Nov 2023 21:40:43 GMT
Connection: Keep-Alive
ETag: "1700055579"
Cache-Control: max-age=474
Content-Length: 65662
Content-Type: image/jpeg
Last-Modified: Wed, 15 Nov 2023 13:39:39 GMT
Accept-Ranges: bytes
X-HW: 1700343643.dop228.sk1.t,1700343643.cds252.sk1.shn,1700343643.dop228.sk1.t,1700343643.cds020.sk1.c
Access-Control-Allow-Origin: *
cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/css/style.css
172.64.109.10200 OK 5.8 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/css/style.css
IP 172.64.109.10:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
File type ASCII text, with very long lines (6136), with no line terminators
Hash 9f80fb73071a2440f4592b4422167a7a
bbd9cd5f77ec53153284f71655920f35815c6c4b
0a1eda0aa145d20b7434500ebb9087051733b0e11eb2187a237a2891b0973b9d
GET /sb/notifications/dating/default/us/desk-all/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: text/css
last-modified: Fri, 27 Aug 2021 11:38:00 GMT
etag: W/"6128ce98-169c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 585711
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8tPsHDZGgTFWr3TG38PSGljy5w4cJX1y2549Fmn2nj2sgU7%2FTeTsldXVLIiTO3oPiLt2h65XlhN38sDQTLA9hiL63pu0Djrbemdk6pS0qzdrW480NtVtU6pXsb7Q085MT0V0bgqLXrx8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835faedad36511-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
game.starswalker.site/api/users/456453?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
135.181.208.216200 OK 572 B URL GET HTTP/2 game.starswalker.site/api/users/456453?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type ASCII text, with very long lines (646), with no line terminators
Hash 3f0304f28168c37199a57619e98539ca
27c95ee21bdae0fa3a624939a285a67d214c69b9
afb0e05c740b24798083543675b34fd48696ba7f46c7b9b5b0619b784fd47c86
GET /api/users/456453?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
set-cookie: asgfp=e19e1989b72653a7152c87a7240d524a; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
unpkg.com/silvermine-videojs-quality-selector@1.1.2/dist/js/silvermine-videojs-quality-selector.min.js
104.16.125.175200 OK 21 kB URL GET HTTP/2 unpkg.com/silvermine-videojs-quality-selector@1.1.2/dist/js/silvermine-videojs-quality-selector.min.js
IP 104.16.125.175:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
File type ASCII text, with very long lines (21159)
Hash 242c96b6f341fad00f677b568a7a6e6b
7ba156f36a99393095461ef4ed1f29e5a26732e6
2b17f02db63529b2ba6fe67c320b69ff803b775b7bd6c70ce4809c5c660ab30b
GET /silvermine-videojs-quality-selector@1.1.2/dist/js/silvermine-videojs-quality-selector.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:40 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Wed, 10 Jan 2018 00:56:00 GMT
etag: W/"5329-e6FW82qZOTCVRh707R8p5aJnMuY"
via: 1.1 fly.io
fly-request-id: 01HDQRVVKQQX2GA99MC0ST1BCD-arn
cf-cache-status: HIT
age: 1959985
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 82835f8a1e0d5685-OSL
content-encoding: br
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
172.64.98.2200 OK 86 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP 172.64.98.2:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: f19cd6fa4c43fd1c5a1f805a9e02f0f1
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 18 Nov 2023 21:40:42 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FWLC%2FP%2FTSuz6dAYiTTYHk2Gww7eT4QuBOAmm2GcnE%2FITXBtUY%2BBZgBSVBfbHzwvb%2BMhYSCf1H24GiiJ4LWMVwy9SbQIBQetdmt1nH4ZVn1JS3iQzn260z%2B3wLtHnRBNmaC9Nhww%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f992d606343-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
vast.livejasmin.com/?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=7407&sub_source=pornpapa.com
93.93.51.191200 OK 3.3 kB URL GET HTTP/2 vast.livejasmin.com/?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=7407&sub_source=pornpapa.com
IP 93.93.51.191:443
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlubet.vast.livejasmin.com
FingerprintE5:4D:69:59:60:D2:67:4A:5E:8D:F1:D6:98:35:85:B6:EF:47:B3:71
ValidityWed, 18 Oct 2023 17:01:04 GMT - Tue, 16 Jan 2024 17:01:03 GMT
File type ASCII text, with very long lines (3358), with no line terminators
Hash 847fc49c34f7f7e0513cd5d099003d8b
6e46162ddd1287c56b79a87106767be4d70aa969
d607f457ed07af38f9725a7e48f5bd3eedacf392b2af4bc8ef8159279e73c1c4
GET /?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=7407&sub_source=pornpapa.com HTTP/1.1
Host: vast.livejasmin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:45 GMT
content-type: text/xml; charset=utf-8
x-target-pstool: 401_1
x-ud-id: cvAGG/xOb
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: OPTIONS, GET
server: unknown
set-cookie: psui=7c488d85daecc2bf18f4f49ac0fc0392; Path=/; Expires=Mon, 18-Dec-23 21:40:45 GMT; SameSite=None; Secure
X-Firefox-Spdy: h2
twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
172.66.40.197200 OK 19 kB URL GET HTTP/3 twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
IP 172.66.40.197:443
Requested by https://game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5294), with CRLF line terminators
Hash 572fe84dde33d0cdd18bd9574da2c548
4284afafa3ef16a15d1c7f19f5de20b350568a8c
fc28812f3c1700291c14a0f0513becf2d70211773451c315dad69e3b99d6a9ab
GET /multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu= HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=; IPLH=#{}; IPLH_Q=#[]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{}; IZH_Q=#[]; IMCH=#{}; IMCH_Q=#[]; IMH=#{}; IMH_Q=#[]; ISH=#{}; ISH_Q=#[]; ISPH=#{}; ISPH_Q=#[]; ICH=#{}; ICH_Q=#[]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:42 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qE1br7AX%2FnUr2VFk8DLr%2Bnqnde1KZutR1BM1i1Gv1Lf8K7ILo5DpHl3U7NdVUmv%2BijEraNVJK3pUDitusS2Autc9r19CPGUR392oBertl1ysIqAP0aWXTQFeFRl%2BsrA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f96ce6db505-OSL
alt-svc: h3=":443"; ma=86400
twinrdsrv.com/preroll.engine?id=6ad96df4-2aad-435f-b4e3-8b8b1a0e95a1&zid=40316&cvs=%7BClientVideoSupport%7D&time=%7BTimeOffset%7D&stdtime=%7BStdTimeOffset%7D&abr=%7BIsAdblockRequest%7D&pageurl=%7BPageUrl%7D&tid=%7BTrackingId%7D&res=%7BResolution%7D&bw=%7BBrowserWidth%7D&bh=%7BBrowserHeight%7D&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl=%7BReferrerUrl%7D&pw=%7BPlayerWidth%7D&ph=%7BPlayerHeight%7D
172.66.40.197200 OK 7.5 kB URL GET HTTP/3 twinrdsrv.com/preroll.engine?id=6ad96df4-2aad-435f-b4e3-8b8b1a0e95a1&zid=40316&cvs=%7BClientVideoSupport%7D&time=%7BTimeOffset%7D&stdtime=%7BStdTimeOffset%7D&abr=%7BIsAdblockRequest%7D&pageurl=%7BPageUrl%7D&tid=%7BTrackingId%7D&res=%7BResolution%7D&bw=%7BBrowserWidth%7D&bh=%7BBrowserHeight%7D&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl=%7BReferrerUrl%7D&pw=%7BPlayerWidth%7D&ph=%7BPlayerHeight%7D
IP 172.66.40.197:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (7481), with no line terminators
Hash 7a21f7d48c0adae50270f0dac8b22751
d2cc02519743583e7f3f287f532da2d784108fb7
e2217d4faff89328b44b18db3abc3f72c924f5089c8805cc27d4d4383f2fbb56
GET /preroll.engine?id=6ad96df4-2aad-435f-b4e3-8b8b1a0e95a1&zid=40316&cvs=%7BClientVideoSupport%7D&time=%7BTimeOffset%7D&stdtime=%7BStdTimeOffset%7D&abr=%7BIsAdblockRequest%7D&pageurl=%7BPageUrl%7D&tid=%7BTrackingId%7D&res=%7BResolution%7D&bw=%7BBrowserWidth%7D&bh=%7BBrowserHeight%7D&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl=%7BReferrerUrl%7D&pw=%7BPlayerWidth%7D&ph=%7BPlayerHeight%7D HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
access-control-allow-credentials: true
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: https://www.xxxfiles.tv
set-cookie: IKSR={}; path=/; SameSite=None; secure
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=owUXL61Yf5nGcVUOGGvWYZEneu4jsF40vc4MBbA7Ascr2KHQIoDW5H5cus13dVeq8qVB7YOjWV%2F9FXssTa274qQ4xGQLKHJpZT79SXpRDxTl%2BTFNhe0O5a%2Br3IEiuZs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835fa0de78b505-OSL
alt-svc: h3=":443"; ma=86400
chryvast.com/?uid=2464&popup=register&utm_content=2464&utm_source=17&utm_medium=media&utm_campaign=71&utm_term=Vast&ref_affid=17&ref_oid=71&source_id=38264&sub1=xxxfiles.com&sub2=Remnant_PreRoll%20%28VAST%29&sub3=preroll&sub4=Remnant_PreRoll_Desktop_WW&sub5=dcb615a9-97a6-4e89-a27b-2542cc8c55ab&verifyage=false&ms_notrack=1&psid=ct_trrmntvbdtww
93.93.51.191200 OK 2.2 kB URL GET HTTP/2 chryvast.com/?uid=2464&popup=register&utm_content=2464&utm_source=17&utm_medium=media&utm_campaign=71&utm_term=Vast&ref_affid=17&ref_oid=71&source_id=38264&sub1=xxxfiles.com&sub2=Remnant_PreRoll%20%28VAST%29&sub3=preroll&sub4=Remnant_PreRoll_Desktop_WW&sub5=dcb615a9-97a6-4e89-a27b-2542cc8c55ab&verifyage=false&ms_notrack=1&psid=ct_trrmntvbdtww
IP 93.93.51.191:443
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectchryvast.com
FingerprintD9:A4:CE:60:06:10:0C:E6:0A:EC:58:BD:70:7C:A2:12:24:D5:39:AE
ValidityThu, 26 Oct 2023 21:01:03 GMT - Wed, 24 Jan 2024 21:01:02 GMT
File type ASCII text, with very long lines (2216), with no line terminators
Hash 23b384bca811f4c178bd59df26e2d54f
cc9f412feb46ca62f851777be4b9b55028707216
27939a4eff95c2619612aaa34338112e286430dfbb52b364b328f67a1fc89834
GET /?uid=2464&popup=register&utm_content=2464&utm_source=17&utm_medium=media&utm_campaign=71&utm_term=Vast&ref_affid=17&ref_oid=71&source_id=38264&sub1=xxxfiles.com&sub2=Remnant_PreRoll%20%28VAST%29&sub3=preroll&sub4=Remnant_PreRoll_Desktop_WW&sub5=dcb615a9-97a6-4e89-a27b-2542cc8c55ab&verifyage=false&ms_notrack=1&psid=ct_trrmntvbdtww HTTP/1.1
Host: chryvast.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:45 GMT
content-type: text/xml; charset=utf-8
x-target-pstool: 701_1
x-ud-id: yEdpn/nU2
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: OPTIONS, GET
server: unknown
set-cookie: psui=7c488d85daecc2bf18f4f49ac0fc0392; Path=/; Expires=Mon, 18-Dec-23 21:40:45 GMT; SameSite=None; Secure
X-Firefox-Spdy: h2
i.wmgtr.com/cim/SaP5ahUXtxnKs1xMBghwLCnVkIs1ci0O.png
0.0.0.0 0 B URL GET i.wmgtr.com/cim/SaP5ahUXtxnKs1xMBghwLCnVkIs1ci0O.png
IP 0.0.0.0:0
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecti.wmgtr.com
FingerprintEC:B5:1E:3E:A4:6B:92:23:E2:9E:1E:FC:99:58:59:8E:23:DD:C1:25
ValidityMon, 23 Oct 2023 00:02:20 GMT - Sun, 21 Jan 2024 00:02:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cim/SaP5ahUXtxnKs1xMBghwLCnVkIs1ci0O.png HTTP/1.1
Host: i.wmgtr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: image/png
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-option: nosniff
content-encoding: gzip
cache-control: max-age=82800
expires: Sun, 19 Nov 2023 20:40:44 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
a.orbsrv.com/ad-provider.js
185.76.9.26200 OK 122 kB URL GET HTTP/2 a.orbsrv.com/ad-provider.js
IP 185.76.9.26:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type ASCII text, with very long lines (32959)
Size 122 kB (122106 bytes)
Hash 37a51e5a3e81c06a86896833341c1ecf
075f126ac630e1b7e6c942013891821fe7d5628b
cfc14ad92298562dd4fbd2a033e4eec2d280f988fc4f161cb70deecebe473352
GET /ad-provider.js HTTP/1.1
Host: a.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: application/javascript
vary: Accept-Encoding
etag: W/"075f126ac630e1b7e6c94201389"
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
expires: Thu, 16 Nov 2023 18:01:01 GMT
cache-control: max-age=10800
x-robots-tag: noindex, follow
access-control-allow-origin: *
x-77-nzt: ArlMCRQ3Nzf/OgkAALlMCgE3Nzf/BwAAAA
x-77-nzt-ray: af5856304bd057a7592f596511f6fe26
x-accel-expires: @1700352079
x-accel-date: 1700341279
x-77-cache: HIT
x-77-age: 2369
content-encoding: gzip
server: CDN77-Turbo
x-cache-lb: HIT
x-age-lb: 2362
x-77-pop: stockholmSE
X-Firefox-Spdy: h2
unseenreport.com/pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=63d45b685911cef3b8cc3d1d1550bf85&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
192.243.61.225200 OK 0 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=63d45b685911cef3b8cc3d1d1550bf85&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
FingerprintBE:8C:78:D1:BA:58:B8:88:10:09:32:1D:31:7A:D9:4A:09:BF:6C:7A
ValiditySat, 23 Sep 2023 07:33:12 GMT - Fri, 22 Dec 2023 07:33:11 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=63d45b685911cef3b8cc3d1d1550bf85&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:45 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cc27c6f8474bd3ae5e6348bd227043d4
Strict-Transport-Security: max-age=0; includeSubdomains
lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fjs%2Fscript.js&l=386&fd=1344
192.243.59.20200 OK 0 B URL GET HTTP/1.1 lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fjs%2Fscript.js&l=386&fd=1344
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fjs%2Fscript.js&l=386&fd=1344 HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:46 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
xdiwbc.com/template/social.html
188.114.96.1200 OK 4.6 kB URL GET HTTP/2 xdiwbc.com/template/social.html
IP 188.114.96.1:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxdiwbc.com
Fingerprint5D:41:10:46:C6:59:EE:4D:26:CD:FC:4F:4C:13:35:6F:6E:2E:05:91
ValidityMon, 02 Oct 2023 04:50:38 GMT - Sun, 31 Dec 2023 04:50:37 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4639), with no line terminators
Hash 474cf430e4f70fc61a3695cb75f686de
8c14127415e490dff27896747f730ca8e49a957a
12fe3666e6b24360e737799e0cb1eafc47e6f11ccc109562f5426767a8529ef7
GET /template/social.html HTTP/1.1
Host: xdiwbc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: https://www.xxxfiles.tv
cache-control: max-age=14400
cf-cache-status: HIT
age: 3212
last-modified: Sat, 18 Nov 2023 20:47:12 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=whgNo%2BBQMJYyA6En53qti1IaoYxJp8XKpT1UkCMgU9lJApn8LS7kHfmIoekMREmGoe9%2FBOyQKTvkx8sJIvj1q7unCLJGe4oj5jH1upnIeesrZZB1ZiqU1SoEXBRi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9f1f85568f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
game.starswalker.site/api/users/433863?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
135.181.208.216200 OK 544 B URL GET HTTP/2 game.starswalker.site/api/users/433863?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type ASCII text, with very long lines (616), with no line terminators
Hash b1a61a525cf29081f0154472d28f8f0f
62b6f9991b5e683b3eb20c05577235360b52efc2
04eae2a4a750341b81532990e9a40cfe4547f6d06055f75ab4d9738066ec455f
GET /api/users/433863?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
set-cookie: asgfp=e19e1989b72653a7152c87a7240d524a; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
s3t3d2y8.afcdn.net/library/448451/acef643f4825b0cf2e2631871dfe10a1ba727b03.mp4
185.76.9.16206 Partial Content 27 kB URL GET HTTP/2 s3t3d2y8.afcdn.net/library/448451/acef643f4825b0cf2e2631871dfe10a1ba727b03.mp4
IP 185.76.9.16:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329587?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectafcdn.net
Fingerprint23:5D:B4:21:E2:4A:BC:A2:81:F9:7D:F8:B1:5C:6C:1D:7D:F3:FC:C8
ValidityThu, 05 Oct 2023 14:56:57 GMT - Wed, 03 Jan 2024 14:56:56 GMT
File type ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]\012- data
Hash 765f32ac2ca3b8394763f6053a3dbb91
acef643f4825b0cf2e2631871dfe10a1ba727b03
7a2683c06ff2079cba7f9438036257cd984213c6590bf924f4b20fb7de690dce
GET /library/448451/acef643f4825b0cf2e2631871dfe10a1ba727b03.mp4 HTTP/1.1
Host: s3t3d2y8.afcdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: video/mp4
content-length: 26964
last-modified: Thu, 27 Jul 2023 20:28:57 GMT
etag: "64c2d389-6954"
accept-ch:
expires: Fri, 26 Jul 2024 21:05:08 GMT
cache-control: max-age=31536000
access-control-allow-origin: *
x-robots-tag: noindex, follow
x-cache-op: HIT
server: CDN77-Turbo
x-77-nzt: AblMCQ03Nzf/PlOWAA
x-77-nzt-ray: c0a4cc2899566bf15a2f5965f20c8618
x-accel-expires: @1722027932
x-accel-date: 1690491932
x-cache-lb: HIT
x-age-lb: 9851710
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 9851710
content-range: bytes 0-26963/26964
X-Firefox-Spdy: h2
game.starswalker.site/api/settings/377391
135.181.208.216200 OK 33 B URL GET HTTP/2 game.starswalker.site/api/settings/377391
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 511ff610a0435434dd22a4836719fbb3
0cf692a9ecb6dd3d715e3315e0eeccc1c384f0c3
d090111da31c837d965f1dcf49b00a53cf41686d0913627f78c5ff36d693c6d0
GET /api/settings/377391 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: application/json
vary: Accept-Encoding
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/309159?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
135.181.208.216200 OK 733 B URL GET HTTP/2 game.starswalker.site/api/users/309159?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type ASCII text, with very long lines (785), with no line terminators
Hash 6211e063c5b282062b5a848ded08fcdd
0c11b5b696629550fb2a59c7f00652f4c318fba1
a0d12c123da2453567184a0bca6b4820158f04ab1c167ec47faaea8673521a61
GET /api/users/309159?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
set-cookie: asgfp=e19e1989b72653a7152c87a7240d524a; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
twinrdsrv.com/preroll.engine?id=60ce2051-b47e-42bc-90c1-2e6fd1708bdf&zid=60896&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw={Keywords}&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight}
172.66.40.197200 OK 7.5 kB URL GET HTTP/3 twinrdsrv.com/preroll.engine?id=60ce2051-b47e-42bc-90c1-2e6fd1708bdf&zid=60896&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw={Keywords}&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight}
IP 172.66.40.197:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (7482), with no line terminators
Hash e5d22db872d9dbbb89ecff9d6eac5473
ba790031870fa4a34ea2b2b9ca6b8365f3157742
c9ef15bf4cb9fa49f655fd375b131e0be343ef4a99b1cb508c9d3d004308993c
GET /preroll.engine?id=60ce2051-b47e-42bc-90c1-2e6fd1708bdf&zid=60896&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw={Keywords}&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight} HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
access-control-allow-credentials: true
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: https://www.xxxfiles.tv
set-cookie: IKSR={}; path=/; SameSite=None; secure
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Uwy5hP1cWCA5zq7VFU5l%2Fi8T%2Fzujlx2hWHCHH3TJwapgcN3B6nxtDD%2FVyiJ9oOE6dHljsvxyOf2%2Btt3MglwOCfGVpWBejzj0UiiAN5EUiuOICiRUcAJRWLA9iI9f9%2BU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835fa0be56b505-OSL
alt-svc: h3=":443"; ma=86400
game.starswalker.site/api/click/12484082188943947095?c=90
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/12484082188943947095?c=90
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/12484082188943947095?c=90 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/api/spots/329584?p=1&s1=%subid1%&kw=
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:42 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
vast.livejasmin.com/?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=11956&sub_source=bigwank.com
93.93.51.191200 OK 3.4 kB URL GET HTTP/2 vast.livejasmin.com/?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=11956&sub_source=bigwank.com
IP 93.93.51.191:443
ASN #34655 DuoDecad IT Services Luxembourg S.a r.l.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlubet.vast.livejasmin.com
FingerprintE5:4D:69:59:60:D2:67:4A:5E:8D:F1:D6:98:35:85:B6:EF:47:B3:71
ValidityWed, 18 Oct 2023 17:01:04 GMT - Tue, 16 Jan 2024 17:01:03 GMT
File type ASCII text, with very long lines (3412), with no line terminators
Hash 9b3f5abce49e4fff8c515b36ec42def7
b2bc3d8ca245edfa89defaedd5f2ed8c6fd0e896
8cd46491ec086e25cbd1841953572c51153680ecb3ab5a463b97908c3532bbb9
GET /?psid=ed_dpronvbdtno&utm_source=tr&ms_notrack=1&pstour=t1&psprogram=REVS&site=jsm&utm_medium=network&categoryName=girl&subAffId=11956&sub_source=bigwank.com HTTP/1.1
Host: vast.livejasmin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:45 GMT
content-type: text/xml; charset=utf-8
x-target-pstool: 401_16
x-ud-id: znFl2/MS0
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: OPTIONS, GET
server: unknown
set-cookie: psui=7c488d85daecc2bf18f4f49ac0fc0392; Path=/; Expires=Mon, 18-Dec-23 21:40:45 GMT; SameSite=None; Secure
X-Firefox-Spdy: h2
tsyndicate.com/do2/5a4d8c9f24e543abb29e2f21424e70ea/vast?
159.69.137.49200 OK 5.1 kB URL GET HTTP/2 tsyndicate.com/do2/5a4d8c9f24e543abb29e2f21424e70ea/vast?
IP 159.69.137.49:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
File type XML document, ASCII text, with very long lines (5140), with no line terminators
Hash dc04d8d248c134910e648de2962d3898
9581f0317fd42f604e7c90603ee5a09312575bb3
c4d8f53143d5c0f08620de8e3c36c298d947b944a66570e962ac99147af11c41
GET /do2/5a4d8c9f24e543abb29e2f21424e70ea/vast? HTTP/1.1
Host: tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: application/xml; charset=utf-8
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-methods: POST, GET, HEAD
access-control-allow-headers: Accept, X-Requested-With, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Legacy
access-control-allow-credentials: true
pragma: no-cache
expires: 0
vary: Accept-Encoding, *
x-api-version: 2
x-vast: 3.0
x-request-id: 6366b805a362433c
set-cookie: ts_uid=32292795-9262-46b2-bf7a-15696304e81d; expires=Sat, 18 May 2024 21:40:44 GMT; domain=.tsyndicate.com; path=/; HttpOnly; secure; SameSite=None
bfq=APeIECNCx5YZN2jMkDEDRxcWIsYU3BLjoYgyE2PcgAFDIUcaNLr0URAQ; expires=Sun, 19 Nov 2023 21:40:44 GMT; domain=.tsyndicate.com; path=/; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-encoding: gzip
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
172.64.98.2200 OK 86 kB URL GET HTTP/2 friendshipmale.com/sfp.js
IP 172.64.98.2:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 51cad91c8f0d5bbeb135dac9cf550180
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 18 Nov 2023 21:40:42 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DglMztiTrBA2SlTKqYn94D9SBcy7UGUeFtGD97RgFgrioiuMSXcLcxgrljkQLMyCzfZ4PPYHhCIg58yDw7qCr9uX7UbXFpli7Q6mcSt%2B3MnlLlIxtsyqBPVaj0JLxUUHNBC2ARI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f937ad8642a-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
svrgcqgtpe.com/sc4fr/rwff/f9ef/2002348/dba.xml
212.117.190.201200 OK 5.2 kB URL GET HTTP/2 svrgcqgtpe.com/sc4fr/rwff/f9ef/2002348/dba.xml
IP 212.117.190.201:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerBuypass AS-983163327
Subject
FingerprintB9:5E:99:5C:A5:9D:51:F3:09:61:25:FC:88:57:9B:58:DB:EC:2A:45
ValidityMon, 30 Oct 2023 01:15:43 GMT - Fri, 26 Apr 2024 21:59:00 GMT
File type XML document, ASCII text, with very long lines (5228), with no line terminators
Hash cb0c6f0fb0d9a1d3ed18128ffb2192c1
fb6bbbcdd5f3132dfc3b4bd3fee7527d9546f2a5
44b2942a99a6d496a56852d14d5c99ab92f6fc0b497bfe5fc0d1a91b0d9e1774
GET /sc4fr/rwff/f9ef/2002348/dba.xml HTTP/1.1
Host: svrgcqgtpe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
x-route-id: script
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
set-cookie: UID=231118164045146e39dec14343baadf50000; Path=/; Expires=Sat, 21 Dec 2024 21:40:44 GMT; Secure; SameSite=None
CHCK=1; Path=/; Expires=Sat, 21 Dec 2024 21:40:44 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
a.orbsrv.com/ad-provider.js
185.76.9.26200 OK 122 kB URL GET HTTP/2 a.orbsrv.com/ad-provider.js
IP 185.76.9.26:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329586?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type ASCII text, with very long lines (32959)
Size 122 kB (122106 bytes)
Hash 37a51e5a3e81c06a86896833341c1ecf
075f126ac630e1b7e6c942013891821fe7d5628b
cfc14ad92298562dd4fbd2a033e4eec2d280f988fc4f161cb70deecebe473352
GET /ad-provider.js HTTP/1.1
Host: a.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: application/javascript
vary: Accept-Encoding
etag: W/"075f126ac630e1b7e6c94201389"
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
expires: Thu, 16 Nov 2023 18:01:01 GMT
cache-control: max-age=10800
x-robots-tag: noindex, follow
access-control-allow-origin: *
x-77-nzt: ArlMCRQ3Nzf/OgkAALlMCgE3Nzf/BwAAAA
x-77-nzt-ray: af5856304bd057a7592f5965489fbc36
x-accel-expires: @1700352079
x-accel-date: 1700341279
x-77-cache: HIT
x-77-age: 2369
content-encoding: gzip
server: CDN77-Turbo
x-cache-lb: HIT
x-age-lb: 2362
x-77-pop: stockholmSE
X-Firefox-Spdy: h2
prhzxq.com/wnload?a=1&e=aeyJwaWQiOjExNTAwODIsInNpZCI6MTE5NTE5OSwid2lkIjo0Mzk5MzgsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8=&inc=1
185.162.85.14200 OK 714 B URL GET HTTP/2 prhzxq.com/wnload?a=1&e=aeyJwaWQiOjExNTAwODIsInNpZCI6MTE5NTE5OSwid2lkIjo0Mzk5MzgsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8=&inc=1
IP 185.162.85.14:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectprhzxq.com
FingerprintAF:E4:1D:E8:DA:E7:CB:59:A8:A1:F6:FC:7B:22:BD:88:80:FA:14:B0
ValidityFri, 15 Sep 2023 17:07:53 GMT - Thu, 14 Dec 2023 17:07:52 GMT
File type Unicode text, UTF-8 text, with very long lines (783), with no line terminators
Hash 043c086e26b7f68ad2e72a3589c7f129
ef6800adc6eb54b263af9cfbb1fb6f1ab4aa57b5
750a3f26279dfb3ff9dd6a5335ecbfdbf0b90fb98c9fb85f02cd3c3cd1c55248
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wnload?a=1&e=aeyJwaWQiOjExNTAwODIsInNpZCI6MTE5NTE5OSwid2lkIjo0Mzk5MzgsImQiOiIiLCJsaSI6Mn0=&tz=0&if=0&u=aHR0cHM6Ly93d3cueHh4ZmlsZXMudHYvdmlkZW9zLzIxODQ3My81MzNkYWY5Y2UxOWQ2NTVmYzY3MGFlZTdmNTlmYjE5MS8=&inc=1 HTTP/1.1
Host: prhzxq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/users/12531191190914742095/997869?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 1.8 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/997869?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML document, ASCII text, with very long lines (1829), with no line terminators
Hash 890c97ed59e88a03dba99602d55f8ca0
4a292817837d169ddfdd0fe7275dc362e3d43f13
873eb8e4108fee5d1ede0bf58bf5ecc438f41bab83b25e3b7df19dc56a0aef1a
GET /api/users/12531191190914742095/997869?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
img.xxxfiles.tv/218000/218473/player/1.jpg
104.21.83.6200 OK 18 kB URL GET HTTP/3 img.xxxfiles.tv/218000/218473/player/1.jpg
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 592x585, segment length 16, comment: "Lavc56.26.100", baseline, precision 8, 390x222, components 3\012- data
Hash 6dcbb8aa5c09fad21a6e02a9dbceb58f
821a5eb5ade8f40ba9c1af596231db1b39864b1f
300756a9033d166f4e6e0157fe0ff86412546659f5682eb403f92cf757c4018c
GET /218000/218473/player/1.jpg HTTP/1.1
Host: img.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: image/jpeg
content-length: 18523
last-modified: Wed, 24 Jul 2019 16:56:03 GMT
etag: "5d388da3-485b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XH2DR%2BFVN13YI3mQynaDKzeEcrfYiRDmrYOmWBOuvGWQGv0cnlNitVfb4xWnWoKF21iYDK4BPSE4FuHFML%2BfcZGkm3X41I370GL%2F5QjOBRTJh5U7LaMkdiOEW1waCt4u6Jc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835f8e09aa5688-OSL
alt-svc: h3=":443"; ma=86400
cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
8.247.218.121206 Partial Content 42 kB URL GET HTTP/2 cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
IP 8.247.218.121:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerSectigo Limited
Subject*.zblkqa.com
Fingerprint78:E7:B2:86:25:92:88:24:6D:8D:51:1E:AC:78:AC:9C:F3:91:E1:EA
ValidityTue, 17 Oct 2023 00:00:00 GMT - Sat, 16 Nov 2024 23:59:59 GMT
Hash d7bd719b2e0aebc115d8621d582b27b6
0c24739936ae55e17bb74f657060d63b367da44f
974f2e2701ec4ad8623b66bf82b661811daaa88051b30cf00635720d69199baa
GET /video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457 HTTP/1.1
Host: cdn.zblkqa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=2293760-
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: binary/octet-stream
content-length: 41591
content-security-policy: block-all-mixed-content
etag: "b635158d9f8bd49e0c7a0e5e2ab4b425"
expires: Sat, 18 Nov 2023 22:37:36 GMT
last-modified: Sat, 18 Nov 2023 21:37:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-request-id: 1798D55DF2E6F90E
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=28800
cf-cache-status: HIT
server: cloudflare
cf-ray: 82835b2cad681c7e-AMS
alt-svc: h3=":443"; ma=86400
age: 185
content-range: bytes 2293760-2335350/2335351
X-Firefox-Spdy: h2
game.starswalker.site/api/users/12531191190914742095/1987986?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
135.181.208.216200 OK 2.1 kB URL GET HTTP/2 game.starswalker.site/api/users/12531191190914742095/1987986?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type XML document, ASCII text, with very long lines (2121), with no line terminators
Hash 343467230f9b4c689017a6fb1b8faa0d
3ce6bbf69e89591c7d0bf9c35eaae950269a69e5
0981ada2059f376060aa2ec88299b367c6aa36e7ee30f1316542ae289114e63f
GET /api/users/12531191190914742095/1987986?fill=0&kw=Creampie,facial,Amateur,deep%20throat,public%20sex,POV,outdoors,sex,doggystyle%20-%20standing,hair%20pulling,blowjob%20-%20pov,work%20fantasies,doggystyle%20-%20pov,cum%20on%20ass,park,pussy%20creampie,Fake%20Hub,fakehub.com,publicagent.com,FakeHub,Public%20Agent,PublicAgent HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/xml
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: https://www.xxxfiles.tv
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
game.starswalker.site/api/click/15443191398799364095?c=60&data[error]=400
135.181.208.216200 OK 0 B URL GET HTTP/2 game.starswalker.site/api/click/15443191398799364095?c=60&data[error]=400
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /api/click/15443191398799364095?c=60&data[error]=400 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:47 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
x-robots-tag: noindex, nofollow
cache-control: private
X-Firefox-Spdy: h2
www.xxxfiles.tv/vpaid/videojs.vast.vpaid.min.css
104.21.83.6200 OK 2.0 kB URL GET HTTP/3 www.xxxfiles.tv/vpaid/videojs.vast.vpaid.min.css
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type ASCII text, with very long lines (1995), with no line terminators
Hash baedc257029b5207975b29c0686f4d63
05a3fadb1e8710938065ebff068da1bad1d80d2d
e1e5a57ab44fca6e9f7b437fbc6dfa7221eaa6c6a40013718e2972c1ec438b44
GET /vpaid/videojs.vast.vpaid.min.css HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: text/css
last-modified: Wed, 20 Nov 2019 10:54:23 GMT
vary: Accept-Encoding
etag: W/"5dd51b5f-7c7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 1862796
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PGjaJZPM8r7MMqHdSNVqwq5%2FSkHq8uUNu6WEaa3FSyjfHLNzHGA5kezWqXjn2rknU%2B5ElWPyWoB42ASdZhQkT1%2F5TUc8AyQjUNhS2ehV7j6pIx5dNrdd52jBu9isVBCiWU0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82f8e95688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
twinrdsrv.com/mediahosting.engine?MediaId=62279&AId=9653&CId=23846&PId=41674&SiteId=7003&ZoneId=41938&VolumeMetricId=e436a309-3a84-4e4f-9797-b32b0daf8cac&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
172.66.40.197200 OK 15 kB URL GET HTTP/3 twinrdsrv.com/mediahosting.engine?MediaId=62279&AId=9653&CId=23846&PId=41674&SiteId=7003&ZoneId=41938&VolumeMetricId=e436a309-3a84-4e4f-9797-b32b0daf8cac&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
IP 172.66.40.197:443
Requested by https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (464), with CRLF, LF line terminators
Hash 1ad4da434971dda91d6116772fed3bd2
a839ccc283f353fd3bf9099e0a69b24498ad7022
682a7235881f2ebec524cb6cbe9ec9cbf6267c49c7d0d549322b751113247b2e
GET /mediahosting.engine?MediaId=62279&AId=9653&CId=23846&PId=41674&SiteId=7003&ZoneId=41938&VolumeMetricId=e436a309-3a84-4e4f-9797-b32b0daf8cac&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64 HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://twinrdsrv.com/multipane.engine?vms=LoaS2Kq2EmD3pvSX0AUf_yytgqY0jjXUuJo6dav8-tb1RCdL-CDIGBBH6HlBgiWfAMo5CZ_NUAjfzvN1iqEAuuArSwtye-PFGM1O5ceTQVsFaCu6oFelYni6gjRHTAHnZAC7-l2MsN5qhG7L4X6j_Eoi4lAsPRiRPN86xiVhW5rDGsBAYm9INaUlHq7mIKxJfbvgetbpXT9iTeO50_E9_Vr-XUOs1l506pVUPCIXrgEYtfb3xEz6uNMmPCkCTb4pY4GKD3hu-e--Poo0x92Z1Clw-BEATO_6gKkLVd2ffIpxPVPYQJCddbdDIlN5jNEOVDrG5_7co2wCxOCYsxKfUbE-Xpq1Kcu318ONRvAXrSho9FY0_QJqT2OeyN-N1hT4pMl2g3qBk_XPh7M4_X7yjLDoKbduuI5gk7OkL_YBTQCwo2r0SmE5Ycdudv7L5FiZq6Lt955S82exseiVmg0zdK76YwkNNl2SfA2lJXqIs4Vqw5PaonBiaxkjN8QUtVPCFviBbqV5fu9gXMd5I1dJG6V-tX_z6NDjiqE2u1qSNzxH4Dpo1Y8D7wcI3_M1PHD6JE_r8TTBBhTZQl9zbDh5Dn2WGMS5okK8TGPeSC3A1ME85vZKY6bhZEvrkHOIKrrbjChTpxS5Z4Op9cQndv6pzkEkXTYsxYyQejYGMczK7FpcZA-c33rLWtfSnRHytUeW-E07HKU2wh5h2nE_0seixBjY8gXJLFrINMKxAaeSlY1lAdHyhjYLUD51_9MpBm4SctJe4PmHMK7pPAIiIuL6fHIcVJ8f17NSXffyqaaHNdd4iZ92sDFuWUPZypxF1PLnW8gpseWKrbMuJBYJce5HqenDAnJxaeq8sShRk4e7RuWt6xQrtZu9U4Ozv--B7mKO-mwoeTZ3yr-6AcubJ-fRwnGTshzyrDgCJW0ac0B24n4MEtkjRAFgCfrhz-Zwgj2stCo0WHPBHGzbh2b1NI4XlZPd6DMrIJDul1JnNpRPSw8H7s9jTJiEf74_U_XaQh1k-kox-6wmfOuoX4F94JUld9d-lCL_4C9qN6MhpFfVFvP3Dy8JBvJ1HRV9MKazGtxaRoNOy3Gyko2hTkUFSipMBenaefTnRSQ0KUi5csxLFV635lrzbKA6qFQlOIp6Lwm69qv6AABvV0AYKuLlsKqHGg6IEZHT-avtGEIBveRG6AmtW15VTXfMZqeTI-rNCKYOTXIvOCckLo9XO_Llv0ufrA2&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&w=300&h=250&ml=64&cu=
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:43 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: *
set-cookie: IKSR={}; path=/; SameSite=None; secure
INF_DFL8=false; path=/; SameSite=None; secure
IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ISSH=6F6454; path=/; SameSite=None; secure
VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; path=/; SameSite=None; secure
IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLH_Q=#[75906,41673,41674,41956]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
CHN=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
MSRH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILP=null; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure
ILPLU=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILEALC=#1/1/0001 12:00:00 AM; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ILMPF=#False; expires=Sun, 19-Nov-2023 01:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMPLU=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPMUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
BSWUID=#; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IKSR={}; path=/; SameSite=None; secure
IBL=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IPLSH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IZH_Q=#[41938]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMCH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
IMH_Q=#[97906,62271,62279,62318]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH=#{}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISH_Q=#[]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ISPH_Q=#[7003]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
ICH_Q=#[44243,23846,23846,23846]; expires=Fri, 18-Nov-2033 21:40:43 GMT; path=/; SameSite=None; secure; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6OK2x2bwnpv7PZJfzvxfmgNm%2B4pjVT9B9mBL%2Ftz5dJeXMD5qclua97RuGCZYZRPoy1wovzV1%2By7BKs30kxXrMQENc1OEeW0d%2BW0Wa1ynTENrN9G0%2FeKMHsjWTSUClKQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f9a6938b505-OSL
alt-svc: h3=":443"; ma=86400
s.magsrv.com/splash.php?idzone=4646896
95.211.229.245200 OK 5.7 kB URL GET HTTP/1.1 s.magsrv.com/splash.php?idzone=4646896
IP 95.211.229.245:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectmagsrv.com
FingerprintC5:BC:C0:62:0C:DC:A9:D2:61:A6:77:A9:6C:31:19:AD:CD:2E:00:67
ValidityThu, 05 Oct 2023 15:26:28 GMT - Wed, 03 Jan 2024 15:26:27 GMT
File type XML document, ASCII text, with very long lines (5812), with no line terminators
Hash 3d2343f3419c37f61edeb0bcca84dbec
02190031e9aa44ae2de49ee27f8fe01f9349d4b1
c5b68ece62a6cd88fe279aeeee876c6842216f544a08647aef0a5e80286db2c0
GET /splash.php?idzone=4646896 HTTP/1.1
Host: s.magsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:44 GMT
Content-Type: text/xml;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: X-CH-VALUES
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A33%3A%2265592f5c576f94.735580491103176069%22%3B%7D; expires=Mon, 17 Nov 2025 21:40:44 GMT; path=; domain=.magsrv.com; Secure; SameSite=none
c-tag=%7B%22tag-video%22%3A%22v4%7C%7CNOR%7C4646896%7C81873074%7C0%7C%7C508%7C41%7C3%7C15%7C0%7C0%7C0%7C25344%7C3143242%7C3143244%7C0%7C1%7C0%7C0%7C0%7C0%7C1%7C0%7C0%7C1%7C%7C%7C0%7Cxxxfiles.tv%7C%7C%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C0%7C1700343644%7Ce2bfec5a7b64cdefae7bf4fad0e9272e%7Cok%22%7D; expires=Sun, 19 Nov 2023 21:40:44 GMT; path=/; domain=.magsrv.com; Secure; SameSite=none
Cache-Control: no-store
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://www.xxxfiles.tv
Access-Control-Allow-Credentials: true
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
135.181.208.216200 OK 17 kB URL GET HTTP/2 game.starswalker.site/api/spots/329585?p=1&s1=%subid1%&kw=
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source, ASCII text, with very long lines (3198)
Hash 1e3022540c69fb32ceb7677b3338cfb1
417068712a200ee25f89dddc88c7b05316b9f8df
5d05dfde494bbcced13f16abecd8819ce03726b016a0eb789837061e43372920
GET /api/spots/329585?p=1&s1=%subid1%&kw= HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: nauid=GLXKx7aVVuchwnuKrZwc; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
tsyndicate.com/do2/4f374a23cf56497b89d53e89be5502a2/vast?
159.69.137.49200 OK 5.7 kB URL GET HTTP/2 tsyndicate.com/do2/4f374a23cf56497b89d53e89be5502a2/vast?
IP 159.69.137.49:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecttsyndicate.com
FingerprintF2:3C:80:FB:F4:C8:BF:02:DD:BF:23:DD:27:74:AB:0B:89:F6:13:5E
ValiditySun, 12 Nov 2023 09:06:58 GMT - Sat, 10 Feb 2024 09:06:57 GMT
File type XML document, ASCII text, with very long lines (5714), with no line terminators
Hash 6ba52d34feb4d19f94ced8dd67665830
41a6e85c3d986e0f7d3c73a2e8e6d1ffdb183849
ea9a70dd6d7179f43dbab5591fed96bd18f1a441e7773a5ab18da51f7e52435e
GET /do2/4f374a23cf56497b89d53e89be5502a2/vast? HTTP/1.1
Host: tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: application/xml; charset=utf-8
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-methods: POST, GET, HEAD
access-control-allow-headers: Accept, X-Requested-With, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Legacy
access-control-allow-credentials: true
pragma: no-cache
expires: 0
vary: Accept-Encoding, *
x-api-version: 2
x-vast: 3.0
x-request-id: ba1f54ec87250b74
set-cookie: ts_uid=a80902fb-8e10-462b-bf67-509c446b3926; expires=Sat, 18 May 2024 21:40:44 GMT; domain=.tsyndicate.com; path=/; HttpOnly; secure; SameSite=None
bfq=APeIECNCx5YZN2TEsJEjRhcWIsYU3OIQYpmJMW7AgEFjxkYaNLr0URAQ; expires=Sun, 19 Nov 2023 21:40:44 GMT; domain=.tsyndicate.com; path=/; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
content-encoding: gzip
X-Firefox-Spdy: h2
twinrdsrv.com/preroll.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&zid=52151&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight}
172.66.40.197200 OK 7.6 kB URL GET HTTP/3 twinrdsrv.com/preroll.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&zid=52151&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight}
IP 172.66.40.197:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint44:DC:AB:AD:02:68:C6:90:3B:A8:AF:E2:FD:7E:D7:F2:0E:5D:AC:2E
ValidityTue, 18 Apr 2023 00:00:00 GMT - Wed, 17 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (7648), with no line terminators
Hash 193333a997fc421633a68291355c3d9d
0074bac1a200bc2b54df4933356f0f14da62ef0a
9bf8f820a7b08d967be0738d2b8b7c443d84e6b0f3b17a71f764c6fab63c493a
GET /preroll.engine?id=4ce47ff2-c2e3-47a1-a9be-931241b17841&zid=52151&cvs={ClientVideoSupport}&time={TimeOffset}&stdtime={StdTimeOffset}&abr={IsAdblockRequest}&pageurl={PageUrl}&tid={TrackingId}&res={Resolution}&bw={BrowserWidth}&bh={BrowserHeight}&kw=Creampie%2Cfacial%2CAmateur%2Cdeep+throat%2Cpublic+sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle+-+standing%2Chair+pulling%2Cblowjob+-+pov%2Cwork+fantasies%2Cdoggystyle+-+pov%2Ccum+on+ass%2Cpark%2Cpussy+creampie%2CFake+Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic+Agent%2CPublicAgent&referrerUrl={ReferrerUrl}&pw={PlayerWidth}&ph={PlayerHeight} HTTP/1.1
Host: twinrdsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Cookie: IKSR={}; INF_DFL8=false; IUID=a98a4070-d120-46f3-87a9-9010e5ebdb49; ISSH=6F6454; VMI=85fb3f53-723c-4064-9c5e-334be61b8f1f; IPLH=#{"75906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41673":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41674":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"41956":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IPLH_Q=#[75906,41673,41674,41956]; CHN=#[]; MSSH=#{}; MSRH=#{}; ILP=null; ILPLU=#1/1/0001 12:00:00 AM; ILEALC=#1/1/0001 12:00:00 AM; ILMPF=#False; IPMPLU=#; IPMUID=#; BSWUID=#; IBL=#[]; IPLSH=#{}; IPLSH_Q=#[]; IZH=#{"41938":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IZH_Q=#[41938]; IMCH=#{}; IMCH_Q=#[]; IMH=#{"97906":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62271":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62279":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"62318":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; IMH_Q=#[97906,62271,62279,62318]; ISH=#{}; ISH_Q=#[]; ISPH=#{"7003":[{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ISPH_Q=#[7003]; ICH=#{"44243":[{"SId":"6F6454","D":"23/11/18T13:40:42"}],"23846":[{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"},{"SId":"6F6454","D":"23/11/18T13:40:42"}]}; ICH_Q=#[44243,23846,23846,23846]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-transform
access-control-allow-credentials: true
content-encoding: gzip
p3p: CP="CAO PSA OUR IND"
access-control-allow-origin: https://www.xxxfiles.tv
set-cookie: IKSR={}; path=/; SameSite=None; secure
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6dJNXjHw0n%2B7tXf0jIlB1kN8%2BghFSYSY1G1ifV6YW62XNCdL1tElgVgT%2FRwdClB355YoXlS7EbedRrmA9fYH4k4Lly2h42vNcPmh7QW2TpOVAHlfDf2q23vHHIRD768%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835fa09e3db505-OSL
alt-svc: h3=":443"; ma=86400
cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
8.247.219.249206 Partial Content 1.6 MB URL GET HTTP/2 cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
IP 8.247.219.249:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerSectigo Limited
Subject*.zblkqa.com
Fingerprint78:E7:B2:86:25:92:88:24:6D:8D:51:1E:AC:78:AC:9C:F3:91:E1:EA
ValidityTue, 17 Oct 2023 00:00:00 GMT - Sat, 16 Nov 2024 23:59:59 GMT
Size 1.6 MB (1572864 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457 HTTP/1.1
Host: cdn.zblkqa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: binary/octet-stream
content-length: 2335351
content-security-policy: block-all-mixed-content
etag: "b635158d9f8bd49e0c7a0e5e2ab4b425"
expires: Sat, 18 Nov 2023 22:37:36 GMT
last-modified: Sat, 18 Nov 2023 21:37:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-request-id: 1798D55DF2E6F90E
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=28800
cf-cache-status: HIT
server: cloudflare
cf-ray: 82835b2cad681c7e-AMS
alt-svc: h3=":443"; ma=86400
age: 185
content-range: bytes 0-2335350/2335351
X-Firefox-Spdy: h2
s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAA01PW2oDMRC7Si8QM2NrvHa+m98WUnIA7yOhtElKNtAUdPjOLhRqYRCDNNJEiWmjutHypHkL2SKyaqgSEIMa+PK6J5Rf19vldA3D9UygwJQxaddFFqmldERSoBaa+I+5Zs0sqJAchWpMFEe0BCwsiCg74+6w5+Ht2Qc1WaZShUnkoeKuNZvuh3N5LAtwFJu6Hto8YGxtynnsx9Rcn2zoVyFP7TyF+d5u83f7/JhuYX6/T2v+mrxc5fX/Bo7N4vIDUvR2/oTruM0/l4H8J1xgq1XBWJ35KmDpytSs5TxAgC4eK6yUVpvpceytova/bGUtAWoBAAA=
95.211.229.247200 OK 0 B URL GET HTTP/1.1 s.orbsrv.com/cimp.php?t=api&data=H4sIAAAAAAAAA01PW2oDMRC7Si8QM2NrvHa+m98WUnIA7yOhtElKNtAUdPjOLhRqYRCDNNJEiWmjutHypHkL2SKyaqgSEIMa+PK6J5Rf19vldA3D9UygwJQxaddFFqmldERSoBaa+I+5Zs0sqJAchWpMFEe0BCwsiCg74+6w5+Ht2Qc1WaZShUnkoeKuNZvuh3N5LAtwFJu6Hto8YGxtynnsx9Rcn2zoVyFP7TyF+d5u83f7/JhuYX6/T2v+mrxc5fX/Bo7N4vIDUvR2/oTruM0/l4H8J1xgq1XBWJ35KmDpytSs5TxAgC4eK6yUVpvpceytova/bGUtAWoBAAA=
IP 95.211.229.247:443
ASN #60781 LeaseWeb Netherlands B.V.
Requested by https://game.starswalker.site/api/spots/329587?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cimp.php?t=api&data=H4sIAAAAAAAAA01PW2oDMRC7Si8QM2NrvHa+m98WUnIA7yOhtElKNtAUdPjOLhRqYRCDNNJEiWmjutHypHkL2SKyaqgSEIMa+PK6J5Rf19vldA3D9UygwJQxaddFFqmldERSoBaa+I+5Zs0sqJAchWpMFEe0BCwsiCg74+6w5+Ht2Qc1WaZShUnkoeKuNZvuh3N5LAtwFJu6Hto8YGxtynnsx9Rcn2zoVyFP7TyF+d5u83f7/JhuYX6/T2v+mrxc5fX/Bo7N4vIDUvR2/oTruM0/l4H8J1xgq1XBWJ35KmDpytSs5TxAgC4eK6yUVpvpceytova/bGUtAWoBAAA= HTTP/1.1
Host: s.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://game.starswalker.site
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%2265592f5a1a30f4.65625540325315022%22%3B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 21:40:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: https://game.starswalker.site
Access-Control-Allow-Credentials: true
Set-Cookie: __upt=%7B%22v%22%3A1%2C%22id%22%3A%220%22%2C%22pcma%22%3A%22%22%2C%22acma%22%3A%22508.0199%22%7D; expires=Mon, 17 Nov 2025 21:40:42 GMT; path=/; domain=.orbsrv.com; Secure; SameSite=none
Accept-CH:
X-Robots-Tag: noindex, follow
Content-Encoding: gzip
game.starswalker.site/api/users/456014?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
135.181.208.216200 OK 592 B URL GET HTTP/2 game.starswalker.site/api/users/456014?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type ASCII text, with very long lines (662), with no line terminators
Hash 108b8fbec1f906a3718c98bd4bdfb135
ebc8ee57a13a6b0a175505c3a7b58e761082c3e1
8d7e4dfd429041d578b9da9df1c94bf4e9beaf60125bcc2fe6a4606f97c5e4e4
GET /api/users/456014?host=www.xxxfiles.tv&ev=210&wh=1024&ww=1280&uuid=&i=1&kw=Creampie%2Cfacial%2CAmateur%2Cdeep%20throat%2Cpublic%20sex%2CPOV%2Coutdoors%2Csex%2Cdoggystyle%20-%20standing%2Chair%20pulling%2Cblowjob%20-%20pov%2Cwork%20fantasies%2Cdoggystyle%20-%20pov%2Ccum%20on%20ass%2Cpark%2Cpussy%20creampie%2CFake%20Hub%2Cfakehub.com%2Cpublicagent.com%2CFakeHub%2CPublic%20Agent%2CPublicAgent&s1=%25subid1%25 HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc; asgfp=e19e1989b72653a7152c87a7240d524a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
set-cookie: asgfp=e19e1989b72653a7152c87a7240d524a; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
www.xxxfiles.tv/js/plugins.js
104.21.83.6200 OK 131 kB URL GET HTTP/3 www.xxxfiles.tv/js/plugins.js
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
Size 131 kB (130671 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /js/plugins.js HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
last-modified: Tue, 26 Nov 2019 06:40:43 GMT
vary: Accept-Encoding
etag: W/"5ddcc8eb-1fe6f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2127524
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PZijnIVtE1sInuC6E1nRU1V%2FZX%2Bwpc66vQ5SZcDqqnD9L0ua9FcR4rRZkltlGEQY9AuG4MV%2Fsc9od9wNOu77BeZjXQIRFPtHb%2BgF5XPRasdg7WTSJq0z8bmHnTLVg4n1M%2BA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82a8a55688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
unseenreport.com/pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=cc48f4cc72bd1ab0cd76dca8048a896c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
192.243.61.225200 OK 0 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=cc48f4cc72bd1ab0cd76dca8048a896c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21
IP 192.243.61.225:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
FingerprintBE:8C:78:D1:BA:58:B8:88:10:09:32:1D:31:7A:D9:4A:09:BF:6C:7A
ValiditySat, 23 Sep 2023 07:33:12 GMT - Fri, 22 Dec 2023 07:33:11 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=28c7e8cf-920a-425f-b7d7-3ecde0f957de&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=cc48f4cc72bd1ab0cd76dca8048a896c&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 18 Nov 2023 21:40:45 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a01134cbd1f759d978cbd79af304332e
Strict-Transport-Security: max-age=0; includeSubdomains
i.wmgtr.com/cim/XItI_RS7lPmDEw44NRqE-DUkw-CCl04e.png
0.0.0.0 0 B URL GET i.wmgtr.com/cim/XItI_RS7lPmDEw44NRqE-DUkw-CCl04e.png
IP 0.0.0.0:0
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecti.wmgtr.com
FingerprintEC:B5:1E:3E:A4:6B:92:23:E2:9E:1E:FC:99:58:59:8E:23:DD:C1:25
ValidityMon, 23 Oct 2023 00:02:20 GMT - Sun, 21 Jan 2024 00:02:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cim/XItI_RS7lPmDEw44NRqE-DUkw-CCl04e.png HTTP/1.1
Host: i.wmgtr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:44 GMT
content-type: image/png
server: nginx/1.19.0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-option: nosniff
content-encoding: gzip
cache-control: max-age=82800
expires: Sun, 19 Nov 2023 20:40:44 GMT
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
www.xxxfiles.tv/js/videojs.persistvolume.js
104.21.83.6200 OK 3.7 kB URL GET HTTP/3 www.xxxfiles.tv/js/videojs.persistvolume.js
IP 104.21.83.6:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
File type troff or preprocessor input, ASCII text, with very long lines (3877), with no line terminators
Hash edd6ad1ef2da6f411723484aa50efac3
70c85dbcf01f72c46aa4610e5a570103944405f1
a9d35e0c9bf38710dc0f1185b6773ce208312fcb575f068b3f866aac8c801826
GET /js/videojs.persistvolume.js HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; kt_ips=91.90.42.154
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 18 Nov 2023 21:40:39 GMT
content-type: application/javascript
last-modified: Wed, 20 Nov 2019 11:00:42 GMT
vary: Accept-Encoding
etag: W/"5dd51cda-e5f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 2057447
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PW1jPHs11xjrDeAAFPMl8ABqRRoSbdm9gqpAK7nFKgXZV3zNkuylHh%2BWwMpJgpbGSSfK8qvI6FTcsSJf4bVBJJQjhV0IX14SGyu22u9LOIlXJA3boqvZoFWr14HTo%2FTHp5Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f82e8dd5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
m3.twinredads.com/m62318.jpg
69.16.175.10200 OK 79 kB URL GET HTTP/1.1 m3.twinredads.com/m62318.jpg
IP 69.16.175.10:443
Requested by https://twinrdsrv.com/mediahosting.engine?MediaId=62318&AId=9653&CId=23846&PId=41956&SiteId=7003&ZoneId=41938&VolumeMetricId=85fb3f53-723c-4064-9c5e-334be61b8f1f&PassBackUrl=&res=&dcid=3_ctx_6cda973f-f2b8-459d-a7d9-82010e15ec4f&cu=&kw=&mw=150&mh=125&ml=64
Certificate IssuerGoDaddy.com, Inc.
Subjectm3.twinredads.com
FingerprintB2:08:56:DF:D1:03:83:DE:20:1E:DB:6F:01:ED:DD:B8:EB:09:64:FB
ValidityTue, 25 Oct 2022 19:48:27 GMT - Sun, 26 Nov 2023 19:48:27 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], progressive, precision 8, 666x537, components 3\012- data
Hash 1596faeeea46773c150a48b626653be5
60ad669c4ead727e2c155d0cb93d3eb0ee446776
d0be570f3a6def22db794a2fb7200539ebae0bad90982e20356bdb0ba9964e28
GET /m62318.jpg HTTP/1.1
Host: m3.twinredads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twinrdsrv.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 18 Nov 2023 21:40:43 GMT
Connection: Keep-Alive
ETag: "1620903211"
Cache-Control: max-age=879
Content-Length: 78648
Content-Type: image/jpeg
Last-Modified: Thu, 13 May 2021 10:53:31 GMT
Accept-Ranges: bytes
X-HW: 1700343643.dop231.sk1.t,1700343643.cds242.sk1.shn,1700343643.dop231.sk1.t,1700343643.cds010.sk1.c
Access-Control-Allow-Origin: *
lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fstyle.css&l=5788&fd=1403
192.243.59.20200 OK 0 B URL GET HTTP/1.1 lemondependedadminister.com/pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fstyle.css&l=5788&fd=1403
IP 192.243.59.20:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectlemondependedadminister.com
Fingerprint9A:0F:AD:E3:03:43:6D:74:75:71:85:24:3C:4E:7C:38:52:C9:E6:7F
ValidityMon, 09 Oct 2023 12:36:30 GMT - Sun, 07 Jan 2024 12:36:29 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=23.43.3723&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fdating%2Fdefault%2Fus%2Fdesk-all%2Fcss%2Fstyle.css&l=5788&fd=1403 HTTP/1.1
Host: lemondependedadminister.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: u_pl=17371676; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1; sleccc48f4cc72bd1ab0cd76dca8048a896c=[4376831]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 18 Nov 2023 21:40:46 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
104.21.83.6200 OK 86 kB URL User Request GET HTTP/2 www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
IP 104.21.83.6:443
Certificate IssuerGoogle Trust Services LLC
Subjectxxxfiles.tv
FingerprintA2:B6:F6:A8:5C:FE:AC:0B:A0:85:09:4D:4C:D8:A6:5A:AC:8D:B4:61
ValidityWed, 27 Sep 2023 14:35:38 GMT - Tue, 26 Dec 2023 14:35:37 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320 HTTP/1.1
Host: www.xxxfiles.tv
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:38 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
set-cookie: PHPSESSID=07s4idtuhavb1ormtrqgvth61f; path=/; domain=.xxxfiles.tv; SameSite=Lax
second_643539=true; expires=Sat, 18-Nov-2023 21:40:37 GMT; Max-Age=0; path=/
kt_qparams=id%3D218473%26dir%3D533daf9ce19d655fc670aee7f59fb191%26sid%3D12320; expires=Sun, 19-Nov-2023 21:40:38 GMT; Max-Age=86400; path=/; domain=.xxxfiles.tv; SameSite=Lax
kt_ips=91.90.42.154; expires=Sun, 19-Nov-2023 21:40:38 GMT; Max-Age=86400; path=/; domain=.xxxfiles.tv; SameSite=Lax
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u22zew7pa53QYrF9stJQwv01g1r1BtZOpw3YEcbwdAztchMjjdmFPas4iF21aNwKF9BMhVV8XXDRAgQx59xAW5TsVZXydMZXEIyaO%2BKsMLo9iMVS56OE8W8330n%2BftjNV34%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82835f7eebc356bd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
a.orbsrv.com/ad-provider.js
185.76.9.26200 OK 122 kB URL GET HTTP/2 a.orbsrv.com/ad-provider.js
IP 185.76.9.26:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329587?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type ASCII text, with very long lines (32959)
Size 122 kB (122106 bytes)
Hash 37a51e5a3e81c06a86896833341c1ecf
075f126ac630e1b7e6c942013891821fe7d5628b
cfc14ad92298562dd4fbd2a033e4eec2d280f988fc4f161cb70deecebe473352
GET /ad-provider.js HTTP/1.1
Host: a.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: application/javascript
vary: Accept-Encoding
etag: W/"075f126ac630e1b7e6c94201389"
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
expires: Thu, 16 Nov 2023 18:01:01 GMT
cache-control: max-age=10800
x-robots-tag: noindex, follow
access-control-allow-origin: *
x-77-nzt: ArlMCRQ3Nzf/OgkAALlMCgE3Nzf/BwAAAA
x-77-nzt-ray: af5856304bd057a7592f5965ad747a27
x-accel-expires: @1700352079
x-accel-date: 1700341279
x-77-cache: HIT
x-77-age: 2369
content-encoding: gzip
server: CDN77-Turbo
x-cache-lb: HIT
x-age-lb: 2362
x-77-pop: stockholmSE
X-Firefox-Spdy: h2
go.sexfortokens.com/easy?campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&sourceId=tstars-outstream-11186-Out-stream+Video+Desktop&tag=-girls%2Fmobile
104.18.63.126302 Found 2.3 kB URL GET HTTP/2 go.sexfortokens.com/easy?campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&sourceId=tstars-outstream-11186-Out-stream+Video+Desktop&tag=-girls%2Fmobile
IP 104.18.63.126:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerCloudflare, Inc.
Subjectsexfortokens.com
Fingerprint14:74:83:B8:1B:D5:4F:1D:A3:FD:1B:C0:F1:C8:9F:C4:71:56:16:CA
ValiditySat, 23 Sep 2023 00:00:00 GMT - Sat, 21 Sep 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /easy?campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&sourceId=tstars-outstream-11186-Out-stream+Video+Desktop&tag=-girls%2Fmobile HTTP/1.1
Host: go.sexfortokens.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.xxxfiles.tv/
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sat, 18 Nov 2023 21:40:45 GMT
content-length: 0
location: https://go.sexfortokens.com/api/models/vast?action=sbSignupWithModel&campaignId=165b5a68ebe3f40ed7f2079c31445f67709c270c0cfe77fd795c260e80617f41&campaignType=smartpop&creativeId=0fe634b4ed7128d94852002b593185fc904d0c54974e9bbbec389730ba324b3e&domain=stripchat&duration=00%3A00%3A30&iterationId=752054&masterSmartpopId=2683&memberId=jUzJh-ntEwZdHO0yv20rfgaX2vShekhjO1z1o-wJg8kM71JDz7ccRxgFhn1Wo4gT_lJHGZaryLUx4GGyWhcpEncDrEOqWN9KyQg2AOTsjprtw3nf_gUIDRUi&mlView=1&ruleId=29&skipOffset=00%3A00%3A05&smartpopId=10507&sourceId=tstars-outstream-11186-Out-stream%20Video%20Desktop&tag=-girls%2Fmobile&usePreroll=true&userId=17f9365c62dae0392084d66eed45063ce6b41df9976c693e547fc771f6c551fd&variationId=31904
strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
access-control-allow-origin: https://www.xxxfiles.tv
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
set-cookie: _var=68133680.31904_ZTJjNzVhZDk=; Path=/; Expires=Mon, 18 Dec 2023 21:40:45 GMT; HttpOnly; SameSite=Strict
__cflb=04dToajuB2cYa95JPJmk1yQQMjYKLoXMASvRLi2GuA; SameSite=None; Secure; path=/; expires=Sun, 19-Nov-23 21:40:45 GMT; HttpOnly
server: cloudflare
cf-ray: 82835fa58b301c0e-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/css/animate.css
172.64.109.10200 OK 79 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/dating/default/us/desk-all/css/animate.css
IP 172.64.109.10:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint2B:CC:32:FC:17:6F:25:69:2F:F4:A0:D9:DC:9C:C2:09:28:32:AB:34
ValiditySat, 21 Oct 2023 15:38:40 GMT - Fri, 19 Jan 2024 15:38:39 GMT
Hash 80047eaa13ebd50c50e8a9753621e430
9c503e07d130572a0eaf51f7c02cbd4cf6213fe3
3f831a59615f8d5d40b4340b2836f91438c876f8dbce75f78e38360d6fe0f429
GET /sb/notifications/dating/default/us/desk-all/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:46 GMT
content-type: text/css
last-modified: Tue, 14 Apr 2020 14:09:21 GMT
etag: W/"5e95c411-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Omr7Uu3QI%2B0VqsIAbKEJgsL8nm9TpX3oTjEhKeVHvLQz%2F7i1%2BouyD5hnbOcleEjR40bGKvwa1hxqK0CrJ20Tp7c9KsWUcZhYbzfAsX%2B3FCo3V2HDA7Wmt%2BI6ytF9aH2F0tILnglUKDB6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82835faecab46511-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
135.181.208.216200 OK 14 kB URL GET HTTP/2 game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
IP 135.181.208.216:443
ASN #24940 Hetzner Online GmbH
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjecta.kainpopoy.com
FingerprintC3:A0:4A:E1:FD:8F:13:AA:57:82:A1:48:49:49:CA:4B:E3:5C:64:33
ValidityMon, 06 Nov 2023 16:27:10 GMT - Sun, 04 Feb 2024 16:27:09 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source, ASCII text, with very long lines (712)
Hash 31fa39d455cdd6e9d68ef24f5fe2106a
60e99a5848e8c013ff2ac4a935b3a7082f5fce82
35af5cb8a080f665a5527cfbfdd0a7fe04beb89df33aebe797d8175416d6f916
GET /api/spots/329591?p=1&s1=%subid1%&kw= HTTP/1.1
Host: game.starswalker.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Cookie: nauid=GLXKx7aVVuchwnuKrZwc
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 21:40:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-robots-tag: noindex, nofollow
cache-control: private
content-encoding: gzip
X-Firefox-Spdy: h2
a.orbsrv.com/ad-provider.js
185.76.9.26200 OK 122 kB URL GET HTTP/2 a.orbsrv.com/ad-provider.js
IP 185.76.9.26:443
ASN #60068 Datacamp Limited
Requested by https://game.starswalker.site/api/spots/329591?p=1&s1=%subid1%&kw=
Certificate IssuerLet's Encrypt
Subjectorbsrv.com
FingerprintC1:06:45:A2:28:F1:95:0E:76:B9:25:AE:56:75:E5:60:63:2E:D3:34
ValidityThu, 05 Oct 2023 15:32:45 GMT - Wed, 03 Jan 2024 15:32:44 GMT
File type ASCII text, with very long lines (32959)
Size 122 kB (122106 bytes)
Hash 37a51e5a3e81c06a86896833341c1ecf
075f126ac630e1b7e6c942013891821fe7d5628b
cfc14ad92298562dd4fbd2a033e4eec2d280f988fc4f161cb70deecebe473352
GET /ad-provider.js HTTP/1.1
Host: a.orbsrv.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://game.starswalker.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:42 GMT
content-type: application/javascript
vary: Accept-Encoding
etag: W/"075f126ac630e1b7e6c94201389"
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
expires: Thu, 16 Nov 2023 18:01:01 GMT
cache-control: max-age=10800
x-robots-tag: noindex, follow
access-control-allow-origin: *
x-77-nzt: ArlMCRQ3Nzf/OwkAALlMCgE3Nzf/BwAAAA
x-77-nzt-ray: af5856304bd057a75a2f59650bf4db02
x-accel-expires: @1700352079
x-accel-date: 1700341279
x-77-cache: HIT
x-77-age: 2370
content-encoding: gzip
server: CDN77-Turbo
x-cache-lb: HIT
x-age-lb: 2363
x-77-pop: stockholmSE
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
142.250.74.106200 OK 6.8 kB URL GET HTTP/3 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP 142.250.74.106:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (7013), with no line terminators
Hash 49475c425d6c00477bb339179326c49b
bd97deeb753f44f43a21feafa92d98239fa511bd
598841a98ad357d2896d2f093ea3e4e1d44e24b3351268ffd45e61ff8c1d0e09
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 18 Nov 2023 21:40:45 GMT
date: Sat, 18 Nov 2023 21:40:45 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
8.247.218.121206 Partial Content 1.6 MB URL GET HTTP/2 cdn.zblkqa.com/video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457
IP 8.247.218.121:443
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerSectigo Limited
Subject*.zblkqa.com
Fingerprint78:E7:B2:86:25:92:88:24:6D:8D:51:1E:AC:78:AC:9C:F3:91:E1:EA
ValidityTue, 17 Oct 2023 00:00:00 GMT - Sat, 16 Nov 2024 23:59:59 GMT
Size 1.6 MB (1572864 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /video/e84658893477097d07758d9516efa4fe.mp4?cb=1700343457 HTTP/1.1
Host: cdn.zblkqa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=262144-
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 206 Partial Content
date: Sat, 18 Nov 2023 21:40:47 GMT
content-type: binary/octet-stream
content-length: 2073207
content-security-policy: block-all-mixed-content
etag: "b635158d9f8bd49e0c7a0e5e2ab4b425"
expires: Sat, 18 Nov 2023 22:37:36 GMT
last-modified: Sat, 18 Nov 2023 21:37:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-request-id: 1798D55DF2E6F90E
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=28800
cf-cache-status: HIT
server: cloudflare
cf-ray: 82835b2cad681c7e-AMS
alt-svc: h3=":443"; ma=86400
age: 186
content-range: bytes 262144-2335350/2335351
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/au/24/54/4e/24544ed07f7394384bbb75023b9b0b3a/1591713925.html
45.133.44.4200 OK 1.3 kB URL GET HTTP/2 cdn.barscreative1.com/sb/au/24/54/4e/24544ed07f7394384bbb75023b9b0b3a/1591713925.html
IP 45.133.44.4:443
ASN #39572 DataWeb Global Group B.V.
Requested by https://www.xxxfiles.tv/videos/218473/533daf9ce19d655fc670aee7f59fb191/?sid=12320
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
Fingerprint55:06:B7:F1:EF:E9:55:FB:7C:8C:4F:5D:DB:05:C9:15:19:90:9B:2F
ValiditySat, 11 Nov 2023 03:00:51 GMT - Fri, 09 Feb 2024 03:00:50 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (1388), with no line terminators
Hash 1e11fba825d4244ebfc11b9784c9744f
86f24edfd397e9f4d65e589ceb97196b71d2d828
7737a119c12f495c4f32f75686c087c59387d5f851ec8c5443a385dda8c5df76
GET /sb/au/24/54/4e/24544ed07f7394384bbb75023b9b0b3a/1591713925.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.xxxfiles.tv
DNT: 1
Connection: keep-alive
Referer: https://www.xxxfiles.tv/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 Nov 2023 21:40:45 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Sat, 07 May 2022 03:21:27 GMT
etag: W/"6275e5b7-4fa"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sat, 18 Nov 2023 22:40:45 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2