leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
301 Moved Permanently 568 B URL HTTP/1.1 leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (564), with no line terminators
Hash 2761b98db33884ab29711096ab315edb
8cea6e53464aea178b72e06a906205d040f14ca5
9f7a07f69d9b9a5af186a79159ccea18935ab4103128ca967e3f3f8ae45fb3ee
GET /leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: ddos-guard
Date: Sat, 04 Feb 2023 23:08:35 GMT
Connection: keep-alive
Keep-Alive: timeout=60
Location: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Content-Type: text/html; charset=utf8
Content-Length: 568
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1cdc095521e9ee2606059be447d1fdd5
02b5d0a5b5823e2338daf7e144700babe2a213af
8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9563
Expires: Sun, 05 Feb 2023 01:47:58 GMT
Date: Sat, 04 Feb 2023 23:08:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c21ba65e44ac95470c314e068e49a9eb
17a13b13738993d889d4afa3d848dc63bf6eba64
9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66"
Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18222
Expires: Sun, 05 Feb 2023 04:12:17 GMT
Date: Sat, 04 Feb 2023 23:08:35 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 04 Feb 2023 22:43:39 GMT
content-type: application/json
age: 1496
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fb7b6b46e708ad73eaaa3c21e74569ae
950663c025acad81556af5aa3022ecc9d55097fe
763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763F58B9FB838378C92033B59907B036F4C33081F5103D9BCC2CA2A8DE500D64"
Last-Modified: Sat, 04 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6434
Expires: Sun, 05 Feb 2023 00:55:49 GMT
Date: Sat, 04 Feb 2023 23:08:35 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: QtsY+lWuEnoyH0Eozxx5pUDRNdwTh4aFaRCLsK2ujvlUGk3ljYG/+Wv8fSGGpdbmxESM1ENjOac=
x-amz-request-id: 0ZDX9TGAWZZ25BQW
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 04 Feb 2023 22:24:12 GMT
age: 2663
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7aad62b035378ff27a0fcc1930540096
42142bc8c2736b022dd520fa0b68fade9cde52b7
f19393452f23bbffd5ac3b18135ee655617e06459c40fc301b9d542a93e72964
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F19393452F23BBFFD5AC3B18135EE655617E06459C40FC301B9D542A93E72964"
Last-Modified: Sat, 04 Feb 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10004
Expires: Sun, 05 Feb 2023 01:55:20 GMT
Date: Sat, 04 Feb 2023 23:08:36 GMT
Connection: keep-alive
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:35 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 04 Feb 2023 23:07:19 GMT
age: 77
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8681
Expires: Sun, 05 Feb 2023 01:33:17 GMT
Date: Sat, 04 Feb 2023 23:08:36 GMT
Connection: keep-alive
leaknudes.com/Template/Css/video-js.css
200 OK 10 kB URL HTTP/2 leaknudes.com/Template/Css/video-js.css
IP
File type Unicode text, UTF-8 text, with very long lines (5844)
Hash 49b7714907e8fb7923e63a10fa72b21a
cb54585a5969e9ef15909c06dfc090186d810a68
b78af35cacd4f75845e55e451095fa115f7ca89365d604e55dcd2d1d55bab11a
GET /Template/Css/video-js.css HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: text/css
last-modified: Sat, 04 Feb 2023 10:48:34 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 10292
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/logoefd8b8470be94b63.png
200 OK 3.3 kB URL HTTP/2 leaknudes.com/logoefd8b8470be94b63.png
IP
File type PNG image data, 75 x 58, 8-bit/color RGBA, non-interlaced\012- data
Hash f91f89b04931d9faf4ca6cac6b5e4aeb
d6b19ebec4ac9942052e2bbe97c411d33ea98893
cbdf85fece6f17a1457d7ea606e0300746c507557d644402fc178edd3e5703a5
GET /logoefd8b8470be94b63.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:38 GMT
content-type: image/png
last-modified: Fri, 11 Nov 2022 03:36:59 GMT
accept-ranges: bytes
content-length: 3255
date: Sat, 04 Feb 2023 23:08:38 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/require.js/2.3.5/require.min.js
200 OK 5.9 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/require.js/2.3.5/require.min.js
IP
File type ASCII text, with very long lines (17536), with no line terminators
Hash 6edb11616167a0f44d5877a0813866f4
92685c66877bdfa5dafb74574d087e6663a6ac71
285780a791cc1dd87a80c336807c33cdb4e1c0c595bdb345eacd82f58b440402
GET /ajax/libs/require.js/2.3.5/require.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 5879
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fbf-4480"
last-modified: Mon, 04 May 2020 16:15:59 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 19638301
expires: Thu, 25 Jan 2024 23:08:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnUNX7MHIneHnVlWshYXKtSfMksRWrxt7LcTehDQXZeYOZOF24OHUZ4gD4wtH1LkJHgJO6iBjc5MpSVCO5Bzr1%2BEaBDrf8%2BgGH3hOdSKTg%2BQI99XMIUm0bOsBYYq4ggXZI4x8FtB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 794711b91bf9b523-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
leaknudes.com/Template/Css/bundle.min.css
200 OK 32 kB URL HTTP/2 leaknudes.com/Template/Css/bundle.min.css
IP
File type Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Hash 44808df115580ab7af5115d332e522e0
f0a6d15e1f73f618c888313be9cf30c455b93baf
36211140e39116f5d47f46cb2352083961273ab70640d3e3f9c26df4019bd71c
GET /Template/Css/bundle.min.css HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: text/css
last-modified: Sat, 04 Feb 2023 20:26:56 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 31737
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Avatars/default-avatar.png
200 OK 1.8 kB URL HTTP/2 leaknudes.com/Uploads/Avatars/default-avatar.png
IP
File type PNG image data, 225 x 225, 8-bit colormap, non-interlaced\012- data
Hash 0d1ecdb8e81fc598a76716da34a5413f
6a2616f8b9bc515d643be52928e92b27206a66a6
fc54c9cfe2d3bcc5ad0bb21b68096baa16bd6bc34fe44b881d25646536ba8c4a
GET /Uploads/Avatars/default-avatar.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:38 GMT
content-type: image/png
last-modified: Wed, 06 Nov 2019 16:31:13 GMT
accept-ranges: bytes
content-length: 1789
date: Sat, 04 Feb 2023 23:08:38 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/starhdsm.png
200 OK 1.3 kB URL HTTP/2 leaknudes.com/starhdsm.png
IP
File type PNG image data, 12 x 12, 8-bit colormap, non-interlaced\012- data
Hash 877dcfc27c7671d55bb1c029f7b33432
209934109af75ab1c847ab3c6c7134dff06af87b
28c2f95955371a4e18697da0972ade0f87c99b890c084507ca8a9e9a8559f8f8
GET /starhdsm.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:38 GMT
content-type: image/png
last-modified: Fri, 03 Feb 2023 12:58:31 GMT
accept-ranges: bytes
content-length: 1261
date: Sat, 04 Feb 2023 23:08:38 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/tpd-b-24px.png
200 OK 2.4 kB URL HTTP/2 leaknudes.com/tpd-b-24px.png
IP
File type PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash abbfc76d055cdcc328045f3aa74e8a6e
6fc57c476e8b524aa244a57cfdea32b45401b43a
da12d3951fbbeaae494541313ccf71787d64d36656f39b80d7d85573494f565c
GET /tpd-b-24px.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:38 GMT
content-type: image/png
last-modified: Mon, 14 Nov 2022 09:44:18 GMT
accept-ranges: bytes
content-length: 2363
date: Sat, 04 Feb 2023 23:08:38 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 153d0de36959c722c00df71ba86daca2
305f56a3134879ebf0828e169e903e560540c070
0cf533a798d42d1e97fb6619a411afadf9a68c92302ba852869b0c0555a47987
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
leaknudes.com/Template/Js/video.min.js
200 OK 157 kB URL HTTP/2 leaknudes.com/Template/Js/video.min.js
IP
File type Unicode text, UTF-8 text, with very long lines (48447)
Size 157 kB (157305 bytes)
Hash 0c50d5d6bcd1c26f0ee2800f4fcea8b8
8cae2d51dd76a2bb7d0355cc946396840f19c723
e5a6cf20a2b7c27d5906345b411c08829cda058526b321e897836ecf7e3b7270
GET /Template/Js/video.min.js HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: application/javascript
last-modified: Thu, 29 Sep 2022 01:13:22 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 157305
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/starhd.png
200 OK 1.6 kB IP
File type PNG image data, 18 x 18, 8-bit colormap, non-interlaced\012- data
Hash 1dc8ef2a806779e10ef22f37cf6f5246
df0e7b8f89aa0a738d18c64b7db243d20c7dc0ce
387a9371574d1f8ceccc4611a08fe47f7f2d8b0d7303aca0b364375886f04cb1
GET /starhd.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:38 GMT
content-type: image/png
last-modified: Fri, 03 Feb 2023 12:48:50 GMT
accept-ranges: bytes
content-length: 1566
date: Sat, 04 Feb 2023 23:08:38 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b2109fc6490c78bf0f4e8d9c2f19f62f
de413307ee2ca4c6c534efff3ddfa484ccd6303f
8b7ac76b662cf4e100eaea8ed0b8ae509b5a78d9f3653188c04437bb4356698c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B7AC76B662CF4E100EAEA8ED0B8AE509B5A78D9F3653188C04437BB4356698C"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6243
Expires: Sun, 05 Feb 2023 00:52:39 GMT
Date: Sat, 04 Feb 2023 23:08:36 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 98be7fe21d059e46146a43d20c4eea92
1ec58129fea75085588be7b8baec05b0874b5274
7bb2eb5ffcd88a3b6ba7b210bdbcd4469134c9708f06befb6c616beebf8dae46
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:36 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
leaknudes.com/newskin.js
200 OK 718 B IP
File type ASCII text, with very long lines (1842), with CRLF line terminators
Hash bff9ca68f04cd9dae789e3826b7820e2
38fe45e0f004565cc6af58772743f45deb793d3d
396dffea85c2465b06724cca90dcc05e9e5b843c7a93893651872c98357f294d
GET /newskin.js HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: application/javascript
last-modified: Tue, 15 Nov 2022 07:30:28 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 718
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-QVV6LWHMJT
200 OK 78 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-QVV6LWHMJT
IP
File type ASCII text, with very long lines (21849)
Hash e655a8b6d07f3c25136b7067a78d9cdf
5f029a9a8aac5468c9491356856cb14eb3d88f7c
e0ab17c4021a72768c94a0689bae1514418681a384b085985fc18b20afedf388
GET /gtag/js?id=G-QVV6LWHMJT HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 04 Feb 2023 23:08:36 GMT
expires: Sat, 04 Feb 2023 23:08:36 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 77657
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
leaknudes.com/Template/Css/icon-font.min.css
200 OK 1.5 kB URL HTTP/2 leaknudes.com/Template/Css/icon-font.min.css
IP
File type ASCII text, with very long lines (7191)
Hash 9a32fe39327fc394b96c099fbedcb07d
183fe886ceaff8ff02a76b4727c43ea126f6f2ce
56096e62beba3bd5c8ee4dc50bc94bec90beab22fa3670f09cdb1ef91abf01c6
GET /Template/Css/icon-font.min.css HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: text/css
last-modified: Wed, 28 Sep 2022 02:50:32 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1517
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Template/Css/post.min.css
200 OK 6.7 kB URL HTTP/2 leaknudes.com/Template/Css/post.min.css
IP
File type Unicode text, UTF-8 text, with very long lines (26004), with no line terminators
Hash 6171304b53b1ad2b05521bc2f7edf82c
dc7274baf704d35e48723c26184e863fc1dcd571
7c444239a15215e2908de69155e3615198bbecd289e2f99d5555ebd41f144c08
GET /Template/Css/post.min.css HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: text/css
last-modified: Wed, 28 Sep 2022 23:47:33 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 6665
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/aas/r45d/vki/1845010/30627ec4.js
200 OK 29 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/aas/r45d/vki/1845010/30627ec4.js
IP
Hash 395bb0bab31eafee0d0d5cbd6061fb39
9b9870f80b267d69f01751c0d490b60451022b1b
3c202388c903de1c1b61e51dd1875903b0027779c6e26e7e24c1cd86208e9e5a
Analyzer Verdict Alert quad9 Sinkholed
GET /aas/r45d/vki/1845010/30627ec4.js HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: application/javascript
last-modified: Tue, 31 Jan 2023 12:41:59 GMT
vary: Accept-Encoding
etag: W/"63d90c97-1213d"
x-js-ab1: var4
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/LoginModal/loginmodal.css?3.1
200 OK 471 B URL HTTP/2 leaknudes.com/Libs/Javascript/LoginModal/loginmodal.css?3.1
IP
Hash 98be7fe21d059e46146a43d20c4eea92
1ec58129fea75085588be7b8baec05b0874b5274
7bb2eb5ffcd88a3b6ba7b210bdbcd4469134c9708f06befb6c616beebf8dae46
GET /Libs/Javascript/LoginModal/loginmodal.css?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: text/css
last-modified: Fri, 03 Feb 2023 12:31:44 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1711
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Jan23/Mon30/27043/m_f056502d.jpg
200 OK 37 kB URL HTTP/2 theporngrid.com/Uploads/Media/Jan23/Mon30/27043/m_f056502d.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", progressive, precision 8, 300x533, components 3\012- data
Hash 14c54ee68c901e38029f04c438a32269
f71138cb2cf117d878dc02773594107ce80ced02
c2184f7c41ddc656846e5f6ef5ac9f7419b45f2017320f9628241c2cfafcd8a0
GET /Uploads/Media/Jan23/Mon30/27043/m_f056502d.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=ptAvZiXBF2i7ng4uBn3l; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:36 GMT
date: Tue, 31 Jan 2023 08:48:19 GMT
content-type: image/jpeg
content-length: 37302
last-modified: Tue, 31 Jan 2023 08:41:19 GMT
etag: "63d8d42f-91b6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 397217
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: jB6XUIaDrXgvZrfOixiIbg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: IrxzMPxOePPLHJQRuEDNPQic3Cc=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 07f8b7c0460f2f18e4c0423c79d40c12
846964453eed6bf31e36061711f40d3110151110
5e12be389c6d5454483d483ae8ded52f6e56f259b9398b4f83a899aad8ab5d5a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5E12BE389C6D5454483D483AE8DED52F6E56F259B9398B4F83A899AAD8AB5D5A"
Last-Modified: Fri, 03 Feb 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5871
Expires: Sun, 05 Feb 2023 00:46:28 GMT
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
leaknudes.com/Template/Fonts/icomoon.ttf?hk79cy
200 OK 24 kB URL HTTP/2 leaknudes.com/Template/Fonts/icomoon.ttf?hk79cy
IP
File type TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icomoon \012- data
Hash 9c882c87c4a2b92865c5b251b7313e1f
f73b8c97b3f0d3b9ef05d9ab04a57b63e9b75015
daddfd58f5077fb62171f3bacc4753b6187bd6f32fa61ccce39614d1a3e009d4
GET /Template/Fonts/icomoon.ttf?hk79cy HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/Template/Css/bundle.min.css
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: application/x-font-ttf
last-modified: Wed, 06 Nov 2019 16:30:17 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 23979
date: Sat, 04 Feb 2023 23:08:39 GMT
x-frame-options: DENY
access-control-allow-origin: *
age: 1
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
cdn.linearicons.com/free/1.0.0/Linearicons-Free.woff2
200 OK 22 kB URL HTTP/2 cdn.linearicons.com/free/1.0.0/Linearicons-Free.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 21780, version 1.0\012- data
Hash 03e91f122aa5fd425abbe23c85546eb0
c87a3db06c5db4e75e639382f174eafa439aeb27
296945e5922e764eef17b1b4a3ee3e60dc202b3c7f074150b62158915bf74e33
GET /free/1.0.0/Linearicons-Free.woff2 HTTP/1.1
Host: cdn.linearicons.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 21780
date: Thu, 25 Aug 2022 06:14:21 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
last-modified: Thu, 18 Jun 2015 09:10:36 GMT
etag: "03e91f122aa5fd425abbe23c85546eb0"
cache-control: max-age=31000000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: kjgSf7Ni0wtPQ8JW746eCqgbZGSbb0yVTR29TWgsikzq0CCG57S1qQ==
age: 14144057
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/raleway/v28/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
200 OK 21 kB URL HTTP/2 fonts.gstatic.com/s/raleway/v28/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 21280, version 1.0\012- data
Hash 16911581ab7ea10687a5aee74cbc5612
b0b24248345739209d753a4ac77ccfc1f627b219
c78a1da5fd0868a547cf285748c7fb73006571190385eb71c0d601b6b240ffaf
GET /s/raleway/v28/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 21280
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 Feb 2023 00:56:00 GMT
expires: Fri, 02 Feb 2024 00:56:00 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 18 Jul 2022 19:57:59 GMT
content-type: font/woff2
age: 252757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/rajdhani/v15/LDIxapCSOBg7S-QT7p4HM-Y.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/rajdhani/v15/LDIxapCSOBg7S-QT7p4HM-Y.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 14976, version 1.0\012- data
Hash cac31f26b77ee8053a76a54ce2f8ce48
c92bcfc9121164049c1b30655db9481d0e454464
759a9000e47b028799d7a4ca602634a7ac7adf415775df070a335d18d9b66f38
GET /s/rajdhani/v15/LDIxapCSOBg7S-QT7p4HM-Y.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 14976
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 Feb 2023 02:07:53 GMT
expires: Sat, 03 Feb 2024 02:07:53 GMT
cache-control: public, max-age=31536000
age: 162044
last-modified: Wed, 27 Apr 2022 15:42:00 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
200 OK 7.9 kB URL HTTP/2 fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 7884, version 1.0\012- data
Hash 9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
GET /s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 04:05:29 GMT
expires: Tue, 30 Jan 2024 04:05:29 GMT
cache-control: public, max-age=31536000
age: 500588
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Jan23/Wed11/23102/m_5d2f0c3d.jpg
200 OK 13 kB URL HTTP/2 theporngrid.com/Uploads/Media/Jan23/Wed11/23102/m_5d2f0c3d.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", progressive, precision 8, 300x168, components 3\012- data
Hash 637b6b7657c2a0789c0888ce1b8cc4d0
da2cf2047dbbfb15afdac0e5773fd3067f5230e0
e3f7c76d15a99857b6fad370d60e2324bc4386a325ced2338a06d6ab7dbf8de0
GET /Uploads/Media/Jan23/Wed11/23102/m_5d2f0c3d.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=RGD0xy6mxdW48pU5LGo5; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sun, 29 Jan 2023 17:31:56 GMT
content-type: image/jpeg
content-length: 13437
last-modified: Wed, 11 Jan 2023 03:13:21 GMT
etag: "63be2951-347d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 538601
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-1.png
200 OK 5.3 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-1.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 4ee329676a23b240d9e7777ed5c496ce
3c20ccfeda1efba2fe06b28af324f4158ffd16d8
4b84d2b09e3bd6bd48ee8b53f691be5801779772b5e4cd86fe6e9897c15165e8
GET /Uploads/Icons/cat-1.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:25:07 GMT
accept-ranges: bytes
content-length: 5291
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Jan23/Wed11/23103/m_816dff4c.jpg
200 OK 13 kB URL HTTP/2 theporngrid.com/Uploads/Media/Jan23/Wed11/23103/m_816dff4c.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 300x168, components 3\012- data
Hash a500fba861a16892b2e3a0bc5b466066
e34a8968c9632a1487bf2f90798cdd7dc31be880
033539decbab5c0ab0ddff3f5be55199c3c6a1371c138ee9d6213388b9e0d2dc
GET /Uploads/Media/Jan23/Wed11/23103/m_816dff4c.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=8JNteJTShAQwETvzHpa3; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Thu, 02 Feb 2023 20:12:02 GMT
content-type: image/jpeg
content-length: 13164
last-modified: Mon, 30 Jan 2023 14:20:28 GMT
etag: "63d7d22c-336c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 183395
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
200 OK 45 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 44856, version 1.0\012- data
Hash 565ce506190ad3af920b40baf1794cec
ad3cba5d06100e09449a864d3b5e58403b478b3d
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
GET /s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 44856
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 18:52:41 GMT
expires: Tue, 30 Jan 2024 18:52:41 GMT
cache-control: public, max-age=31536000
age: 447356
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-8.png
200 OK 3.2 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-8.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 83c9e6c3b6378303283d7bfa50260fff
a759bd92f8b128f434a0b92cebe6a09a99b83ff6
445ed7ea6a73e872347bd98aa64a6a9e1eee666d823369c23dc494a3c0039362
GET /Uploads/Icons/cat-8.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:32:38 GMT
accept-ranges: bytes
content-length: 3174
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Sat04/27766/m_51b51337.jpg
200 OK 22 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Sat04/27766/m_51b51337.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x400, components 3\012- data
Hash 2e638706fcb855bb667f737f8a82d21b
ad4272215f00a4aae5972e7ed0b8cd1771a821f5
9ea27a6453acc0d567fbaa161e10643e15cf3528547899d93067a5fd449fc397
GET /Uploads/Media/Feb23/Sat04/27766/m_51b51337.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=Ztw6qBXXpJ6aSWNqlJxA; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 04 Feb 2023 05:53:05 GMT
content-type: image/jpeg
content-length: 21958
last-modified: Sat, 04 Feb 2023 05:41:49 GMT
etag: "63ddf01d-55c6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 62132
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-5.png
200 OK 9.2 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-5.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash d344810ccc6c97e531273132c0363082
3c85f1f92b1a891bbfe82951f46e010e379f77a9
07f9045fd63e17fd9065a4af53fa9baa1004ddeaa68cdddebb8bfc8e727082b3
GET /Uploads/Icons/cat-5.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:27:04 GMT
accept-ranges: bytes
content-length: 9232
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Sat04/27767/m_6317226d.jpg
200 OK 23 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Sat04/27767/m_6317226d.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x397, components 3\012- data
Hash c4545d4d494db4428525c07b91b1f83c
c39e0d107deb8a107e5742c681196543114c729b
40f8c4f7ab54de078a3a690710f26668191e02cb1f765dd22495b20ac25d64b4
GET /Uploads/Media/Feb23/Sat04/27767/m_6317226d.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=7xMu7AyYT2HZ6GPzJtJF; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 04 Feb 2023 05:53:05 GMT
content-type: image/jpeg
content-length: 23381
last-modified: Sat, 04 Feb 2023 05:41:51 GMT
etag: "63ddf01f-5b55"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 62132
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-10.png
200 OK 4.7 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-10.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 8e7d304b00fc5534bd2c30d8b39e1c78
3bc5fbac6eb210f540141964e32991c89902c938
334edf51111372a33c7261f6bf67aecd8af37f769e900e9d8b598bf07a30ec10
GET /Uploads/Icons/cat-10.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:30:40 GMT
accept-ranges: bytes
content-length: 4680
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5452c58c07ce8d3cade93b323b271c35
581b1e438daeb32a12feaf50f2aab17dcf3e3171
b99ea2af71e697f45db51732f7d3e8d3e50258c9c96e50a772b8c4638577140a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
leaknudes.com/Uploads/Icons/cat-11.png
200 OK 7.6 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-11.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 82475de8d7329bedf21a34dea891865c
46ba0d95f608cd4d37b6a9200709e5c9db3d1ded
276536fef1d707c1e158b0be467583a31227eb7d8598632e92949ae6503dd018
GET /Uploads/Icons/cat-11.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:31:24 GMT
accept-ranges: bytes
content-length: 7619
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-12.png
200 OK 5.6 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-12.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash f6404456fb72e6af153a145b4ee513f8
ebef201c25cbd8250a74eef3a668bdfaaf03cd2a
14c9e517e3b543bbdfbe46751b3547a15794d9497ecf309aa6d94d85a1dcc9f0
GET /Uploads/Icons/cat-12.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Mon, 03 Sep 2018 12:44:27 GMT
accept-ranges: bytes
content-length: 5600
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-2.png
200 OK 3.4 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-2.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 05e63182f447f30c2125e06b119e2fe7
1252f51660f3568230cc12de6273639561f1f164
5febf31f517e18ec5a6f397675652c4470a35ce4d168b0e4ecb28d72895a3230
GET /Uploads/Icons/cat-2.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:30:11 GMT
accept-ranges: bytes
content-length: 3422
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-14.png
200 OK 12 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-14.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash 60e0ac91d3e575afe8db1db6fdd2dbfd
bfb8512a314de82ff4414f4d3fa90d6244641e8c
3f1f4be1720755eac04977a8aefce21263459fb439222ff6f2d956405aaa9cc4
GET /Uploads/Icons/cat-14.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Tue, 15 Oct 2019 14:59:43 GMT
accept-ranges: bytes
content-length: 11546
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-9.png
200 OK 14 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-9.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 3b5ba603c866e607427b064b4f230167
78b697af19d148f6b51172985b575ab722cfb27f
4885368c7fa4d162da5b96d62f3e83396d33bfba05f9f0b0d59783947656ad28
GET /Uploads/Icons/cat-9.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:27:46 GMT
accept-ranges: bytes
content-length: 14212
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-16.png
200 OK 4.1 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-16.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash ae0b71b14287f0302783511d12650787
2bb411a88faa6a5da7e69b83fb8c8ee172d6e7ac
706453ec1af1cbe36e35b048020952d0ffaddde196a6c88696ece922e62feb7d
GET /Uploads/Icons/cat-16.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Thu, 25 Jun 2020 13:34:27 GMT
accept-ranges: bytes
content-length: 4064
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Sat04/27764/m_65667b51.jpg
200 OK 16 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Sat04/27764/m_65667b51.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x400, components 3\012- data
Hash c4a419342476180b2f153fa81d85bec9
d37941fed3c8f37614570a2734b4daaf85570828
c0a2f466f4395a17627e5d3476c981bc58a47136df0a18392a83cd551d3ccd07
GET /Uploads/Media/Feb23/Sat04/27764/m_65667b51.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=Kh2v0IgRyg7qLNtnZ4QM; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 04 Feb 2023 05:53:05 GMT
content-type: image/jpeg
content-length: 16122
last-modified: Sat, 04 Feb 2023 05:41:48 GMT
etag: "63ddf01c-3efa"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 62132
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-4.png
200 OK 5.9 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-4.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 58a844947bb2dddc69968bd5a1a92bdc
401f875d8363760ed26d9fa438de4af850808753
34f377a3ff342dd2d2c6bbe598a48871f3beb00f6f20db37805e279466c60d02
GET /Uploads/Icons/cat-4.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 02 Sep 2018 16:31:56 GMT
accept-ranges: bytes
content-length: 5903
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-19.png
200 OK 4.1 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-19.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash 5cc26606876953fad6e069ee47d791ac
10dc49b8f41d76929c5aaf5cc2b75333d21bf1bf
b6909b92aadbd2b3104fcbf8ac54fc0e5a959a1cecaaa8df7e2b1c49dab982a1
GET /Uploads/Icons/cat-19.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Sun, 11 Sep 2022 16:51:52 GMT
accept-ranges: bytes
content-length: 4074
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-15.png
200 OK 3.7 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-15.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash 90ffdb8b3f54f8530c2c3cde619d9794
31af49fe82eaa73b22cc07331d1f0d15aa610942
292ec9b16dd1807f09e03af5f17d2910bc8fc8c0b867e73a12dd27ce4341697a
GET /Uploads/Icons/cat-15.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:14 GMT
content-type: image/png
last-modified: Sat, 16 May 2020 01:00:22 GMT
accept-ranges: bytes
content-length: 3740
date: Sat, 04 Feb 2023 23:08:14 GMT
vary: User-Agent
x-frame-options: DENY
age: 23
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-18.png
200 OK 6.0 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-18.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash d86cd55a573567c5135aa8a33a860cb8
55cc99bbce908f837db595e46463414c05f876ca
80f48172de54052f9bfa27ce00c72e5e33716abac6aab4e82a34c0558aa0b7b4
GET /Uploads/Icons/cat-18.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Fri, 27 May 2022 23:59:16 GMT
accept-ranges: bytes
content-length: 5968
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Sep22/Fri30/15394/m_888ce615.jpg
200 OK 20 kB URL HTTP/2 theporngrid.com/Uploads/Media/Sep22/Fri30/15394/m_888ce615.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 60", baseline, precision 8, 300x534, components 3\012- data
Hash 95e3cf6d73ef99886cf2e0b9f808bb81
b59e17d9f8e7282438bcc2085b14ae4ca06abb70
ab00aa64d20ac78beed9c4b446c07468267f4575cfbb70d640b4dd7fe7c2bddd
GET /Uploads/Media/Sep22/Fri30/15394/m_888ce615.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=dFn4NentKpPhrFJrb77t; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sun, 29 Jan 2023 13:40:19 GMT
content-type: image/jpeg
content-length: 19752
last-modified: Tue, 25 Oct 2022 14:17:18 GMT
etag: "6357efee-4d28"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 552498
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Thu02/27401/m_e9acdbde.jpg
200 OK 18 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Thu02/27401/m_e9acdbde.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x449, components 3\012- data
Hash d4e11a420a89e15372f39800abc08245
9e5c7705ff655ab009d4c5f882f800f9eaf3249e
c352aef6c7dbe91081b51cccdb7594abb4d8e7505b6e0c7b8ae6a692c16ecfe7
GET /Uploads/Media/Feb23/Thu02/27401/m_e9acdbde.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=wGmsvGHshbmm1Dk1sejR; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Thu, 02 Feb 2023 07:42:45 GMT
content-type: image/jpeg
content-length: 18540
last-modified: Thu, 02 Feb 2023 06:36:36 GMT
etag: "63db59f4-486c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 228353
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Fri03/27616/m_2aa5c33d.jpg
200 OK 27 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Fri03/27616/m_2aa5c33d.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x533, components 3\012- data
Hash f0adfe6658e92cbfe7842c9ec2ca82d7
c36ea9fac49af2bdd4fba14246d1e905ce0b0eeb
d86373985a0680563c39f7a832f158f707a9a547a863bcad4ced8a02da2e57dc
GET /Uploads/Media/Feb23/Fri03/27616/m_2aa5c33d.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=4tY0TAESbrW6bSjrMU5K; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Fri, 03 Feb 2023 05:38:06 GMT
content-type: image/jpeg
content-length: 26766
last-modified: Fri, 03 Feb 2023 05:19:28 GMT
etag: "63dc9960-688e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 149431
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Sep21/Fri10/8686/m_0a41f0f3.jpg
200 OK 36 kB URL HTTP/2 theporngrid.com/Uploads/Media/Sep21/Fri10/8686/m_0a41f0f3.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 100", baseline, precision 8, 500x395, components 3\012- data
Hash bcb81af5b642f7fb943b5f60ca7a5411
dc06842a1c29bd64292fec01939fdf68e786471d
0c36a4cbe9f7ef5f35b73ccc9a1a259123ada7c6e3b887927f6fdd4f38d23916
GET /Uploads/Media/Sep21/Fri10/8686/m_0a41f0f3.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=MTCrGZ3fwpxmmO6bYOXE; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sun, 29 Jan 2023 14:35:48 GMT
content-type: image/jpeg
content-length: 36459
last-modified: Fri, 23 Sep 2022 15:12:31 GMT
etag: "8e6b-5e9599b57b1e2"
accept-ranges: bytes
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 549169
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-13.png
200 OK 12 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-13.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, interlaced\012- data
Hash 943ad4b320f34c79f91b3ca3cfbfe3c1
5ac6b394c3838cc853d32233cd3c3faa53d1c699
2ab9be3a710f30a944e3d9d4de03fdcdbb438d066e8954d07e641d048391afeb
GET /Uploads/Icons/cat-13.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Mon, 03 Sep 2018 16:41:26 GMT
accept-ranges: bytes
content-length: 12424
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Apr20/Mon27/2021/m_f330919b.jpg
200 OK 5.5 kB URL HTTP/2 theporngrid.com/Uploads/Media/Apr20/Mon27/2021/m_f330919b.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 80", baseline, precision 8, 256x144, components 3\012- data
Hash e49014856ac446ba26d5e2887a57698a
654461fdb26463360f69ff9577a36d3867998f30
af810bf89b59dc7d3e512bfb9d9a2de23b54609d76255c4632192d84b937b9ca
GET /Uploads/Media/Apr20/Mon27/2021/m_f330919b.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=gw9oQ7uO9PDwpr8Jq8KM; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 28 Jan 2023 11:07:05 GMT
content-type: image/jpeg
content-length: 5532
last-modified: Fri, 23 Sep 2022 07:54:19 GMT
etag: "159c-5e9537c4365ea"
accept-ranges: bytes
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 648092
ddg-cache-status: HIT,HIT
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Sat04/27763/m_0dc51ac0.jpg
200 OK 16 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Sat04/27763/m_0dc51ac0.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x402, components 3\012- data
Hash 999aaaacb386e7aff99d7b73ac4f6caf
8928d0f4875742232f1c470173364a9fdaeccb69
c3caab13f09a3e78fb2524d92560c64ab5ab201c24076b8682f2532ffb537f7a
GET /Uploads/Media/Feb23/Sat04/27763/m_0dc51ac0.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=S10cVyMS7qktKgZVrG7H; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 04 Feb 2023 05:53:05 GMT
content-type: image/jpeg
content-length: 16499
last-modified: Sat, 04 Feb 2023 05:41:45 GMT
etag: "63ddf019-4073"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 62132
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
theporngrid.com/Uploads/Media/Feb23/Sat04/27765/m_a23f1675.jpg
200 OK 31 kB URL HTTP/2 theporngrid.com/Uploads/Media/Feb23/Sat04/27765/m_a23f1675.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85", progressive, precision 8, 300x557, components 3\012- data
Hash 360bce82231682c345f90a858f78bf8c
ce1c38086787a8048e808bd6396e4a00591e8cce
82c9ba5848ea4b2266cccd9a505cd4d6a188125ee5100046d07ee47f040419c4
GET /Uploads/Media/Feb23/Sat04/27765/m_a23f1675.jpg HTTP/1.1
Host: theporngrid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg1_=p4qQDcOMpxJRoVsjCk7d; Domain=.theporngrid.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:37 GMT
date: Sat, 04 Feb 2023 05:53:05 GMT
content-type: image/jpeg
content-length: 31386
last-modified: Sat, 04 Feb 2023 05:41:49 GMT
etag: "63ddf01d-7a9a"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: upgrade-insecure-requests;, default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
age: 62132
ddg-cache-status: HIT,MISS
X-Firefox-Spdy: h2
leaknudes.com/Uploads/Icons/cat-17.png
200 OK 3.5 kB URL HTTP/2 leaknudes.com/Uploads/Icons/cat-17.png
IP
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash 06847777c3b030cec93413eda7f40f52
c40fe72fd9ee8a6ddd201d35d508b50b0e1937e1
9c80f39303e284e8a9170c7bf73346f35db50de3b6be136f6ffff567e50c34e7
GET /Uploads/Icons/cat-17.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:39 GMT
content-type: image/png
last-modified: Wed, 24 Nov 2021 14:27:53 GMT
accept-ranges: bytes
content-length: 3465
date: Sat, 04 Feb 2023 23:08:39 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
rallydisprove.com/0a/9a/ec/0a9aec252ec8cc83b9f56ec6b45fa3a9.js
200 OK 13 kB URL HTTP/1.1 rallydisprove.com/0a/9a/ec/0a9aec252ec8cc83b9f56ec6b45fa3a9.js
IP
File type ASCII text, with very long lines (37156), with no line terminators
Hash a08db813cd6a3fc7d5dba9fcac957965
d6ea4eb9e47a174f872f8c0c4f809cfa4992105c
7797df4a2b5c09a63948bc41c4d83f5ee13fa5fa8af2696232f3094d5eabc96a
Analyzer Verdict Alert quad9 Sinkholed
GET /0a/9a/ec/0a9aec252ec8cc83b9f56ec6b45fa3a9.js HTTP/1.1
Host: rallydisprove.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 Feb 2023 23:08:37 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 46bd349fe295cc9ffbb53d8bc5435d45
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
kw3y5otoeuniv7e9rsi.com/solid.gif?z=1845010&abvar=4
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/solid.gif?z=1845010&abvar=4
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
POST /solid.gif?z=1845010&abvar=4 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash b5a404b308fa06356367c560e850e1bc
62a5d88a31451b0387e6444c079b6175fa8065a0
f0896232da72586ab3db7427040e653b271df7da7f4c192f44d1b38392702598
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "F0896232DA72586AB3DB7427040E653B271DF7DA7F4C192F44D1B38392702598"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5027
Expires: Sun, 05 Feb 2023 00:32:24 GMT
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash dccebcfaad6c97d820364ec92d4a511b
a1adef127bad0f85751b5a7b47025c33d40083c4
6be12cee36873a68c71f277876470b5a3807acf44b39a92b575595e9aa95c973
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sat, 04 Feb 2023 23:08:37 GMT
Last-Modified: Sat, 04 Feb 2023 22:04:16 GMT
Server: ECS (bsa/EB1E)
X-Cache: Miss from cloudfront
Via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: DDicC-gNgbkSS6Jn1ujNNDtwvetgLtSa0psUm1f6ctESz8PBSYf2aQ==
Age: 3861
ocsp.digicert.com/
200 OK 279 B IP
Hash 3ab15beceaabe8ee88f3aceb012fc063
b23cc7ea4883102928c1ef515609fdcfebbad07b
e8de3ddd4fecfef061b86d8f0a9db1983f15625a1e5b02aa048569a82549443b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4844
Cache-Control: max-age=154122
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Etag: "63de8993-117"
Expires: Mon, 06 Feb 2023 17:57:19 GMT
Last-Modified: Sat, 04 Feb 2023 16:36:35 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 279
cdn.bncloudfl.com/bn/d72/57c/872/d7257c872cf09e6feb0eb555b20920ff28aea08f.gif
200 OK 270 kB URL HTTP/2 cdn.bncloudfl.com/bn/d72/57c/872/d7257c872cf09e6feb0eb555b20920ff28aea08f.gif
IP
File type GIF image data, version 89a, 300 x 100\012- data
Size 270 kB (269988 bytes)
Hash bf697efd67c7bc916699a5cfe1dd005f
d7257c872cf09e6feb0eb555b20920ff28aea08f
39fce10f59ebb9da307d8f32d1b3827cc7a580a31dfe2e2a4397d595ff1badba
GET /bn/d72/57c/872/d7257c872cf09e6feb0eb555b20920ff28aea08f.gif HTTP/1.1
Host: cdn.bncloudfl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 269988
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cache-control: max-age=432000
cf-bgj: imgq:100,h2pri
cf-polished: status=not_needed
etag: bf697efd67c7bc916699a5cfe1dd005f
expires: Sun, 05 Feb 2023 16:37:30 GMT
last-modified: Thu, 12 Jan 2023 16:20:25 GMT
x-openstack-request-id: txca243b4299ce4be1b000e-0063c033b3
x-proxy-cache: HIT
x-timestamp: 1673540424.69581
x-trans-id: txca243b4299ce4be1b000e-0063c033b3
cf-cache-status: HIT
age: 109867
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 794711bfabb90b65-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/get/1846521?zoneid=1846521&jp=_clnaw4b62ebis0dmq97ptk&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=2361608799664149
200 OK 1.4 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/get/1846521?zoneid=1846521&jp=_clnaw4b62ebis0dmq97ptk&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=2361608799664149
IP
Hash cd88da51dfe9624d1ba0052223915ea5
055c92248fb5aa8696dbcb0edbb208c7cd29b0df
781bf6046b58c72af65fdb8db62580d1efa5820b1c84838ae44e3783f8b2f5c3
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846521?zoneid=1846521&jp=_clnaw4b62ebis0dmq97ptk&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=2361608799664149 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846521
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: UID=2302041808e5f0f35814cd410fb66bf11008; Path=/; Expires=Sun, 04 Feb 2024 23:08:37 GMT; HttpOnly; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
cdn.bncloudfl.com/bn/8bb/9f7/8bf/8bb9f78bf7d01a053ac73b34735468c1c488b3cc.jpg
200 OK 25 kB URL HTTP/2 cdn.bncloudfl.com/bn/8bb/9f7/8bf/8bb9f78bf7d01a053ac73b34735468c1c488b3cc.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], progressive, precision 8, 300x250, components 3\012- data
Hash 86cb270cc41259bae3cb57b58853a364
105f5dab91e4fe599cf57d788d480ff3adb5f944
e76b1868cedc8517a332b92f76b022550dce5d9f6da597d94d52fa441735c88c
GET /bn/8bb/9f7/8bf/8bb9f78bf7d01a053ac73b34735468c1c488b3cc.jpg HTTP/1.1
Host: cdn.bncloudfl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/jpeg
content-length: 24956
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cache-control: max-age=432000
cf-bgj: imgq:100,h2pri
cf-polished: origSize=25602, status=webp_bigger
etag: 8111d6709b49f39d21f280836ae2b038
expires: Mon, 06 Feb 2023 13:55:01 GMT
last-modified: Fri, 30 Dec 2022 09:28:13 GMT
x-openstack-request-id: txb4f123edf91e42e286674-0063aeaf77
x-proxy-cache: HIT
x-timestamp: 1672392492.78160
x-trans-id: txb4f123edf91e42e286674-0063aeaf77
cf-cache-status: HIT
age: 33216
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 794711bfabc00b65-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash 3ab15beceaabe8ee88f3aceb012fc063
b23cc7ea4883102928c1ef515609fdcfebbad07b
e8de3ddd4fecfef061b86d8f0a9db1983f15625a1e5b02aa048569a82549443b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4844
Cache-Control: max-age=154122
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:37 GMT
Etag: "63de8993-117"
Expires: Mon, 06 Feb 2023 17:57:19 GMT
Last-Modified: Sat, 04 Feb 2023 16:36:35 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 279
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1882688&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=xMWqcTjsHFz71bY4NH114JNKC9oU6aqnV7s6ZX8I6rNh0tbaWFgGKzJrjb1-gyYITgrfOihXCWbVpiF0a-JwEUVkaUciP1VkISMx876uCknLTz1C8F3BIHaprgpz-dljbRq8Dt5WuRs_TgUU02vh4tFrgmCZ4q8MfABpzz51Qhr5mRvP_c3ngnDhllfvTiWo9-gFnTuHQORxBibUjzeC1eXP8Fgh_xpi2PhKbcAsDYFzTgWtmbXsZOvoJVXlhbs6EyQkQXFnFpQen95fNn4135l4h5xqKDwVQ11N2eltxpCGWv_6Rp5lzl7ioIqAlaKZXI2DkmG73ckoQKEfcBSKCO0kHTeuqYufZz5jwVKEGZbpKRJ6oyBDfkJ9Ahl_n3php2x10XS3-_Sk1ika9F71qQjxrYdl-583O7-Xk_AxvWvjd83a_lNVvGPJqCN0-ljQxhk7mw4tNpDxPdGfZTXO973aYwVR_Sx_BPj4oImG5ijBZUva6hFaG6lw2tj8M44s4y4lZLyPVGNENKBLBaxGcICJ8e2aD-5C1oyjjLDewRkru8vNHLG8g90MTP7Xzp3bU7l4BJa1UXPqP75MfXoUnZehlfKwBpr7k6V0ZM-VYb33CPdMW_Ps8M1uL8R8qgx8xfDqZF73n917OqPptYugFdVCYfdF7ZtDTUVip50EJm1eCcBHBbAGNrnl4zrq0q3N_ud3qY8__qMeEqZhk7GOet3KQRzMtAZeZTcr8hoVIyFLLS55mZYnnzqPCCUU4-H90FYujhGkiw7cFUFithAjtHsBokyi40BQa37QVXL3suPJ_bLRjmmCc97OWuNyC3RGz9r0CnueH0gIg0dkjrwFI9oCU5ZFaG0iAh5BhtG77PX_dg4aE_P9KzTLgHKBuENVyz2HoMGWJf4N5Icx3YxzBHdDz1aSFyCllSTFgrT2pI5h0-HNkZZPUiiajd7Zfx8_V3d-OZqUvPYTGXhEJCEUBJBj6oi62jqv&abvar=2&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1882688&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=xMWqcTjsHFz71bY4NH114JNKC9oU6aqnV7s6ZX8I6rNh0tbaWFgGKzJrjb1-gyYITgrfOihXCWbVpiF0a-JwEUVkaUciP1VkISMx876uCknLTz1C8F3BIHaprgpz-dljbRq8Dt5WuRs_TgUU02vh4tFrgmCZ4q8MfABpzz51Qhr5mRvP_c3ngnDhllfvTiWo9-gFnTuHQORxBibUjzeC1eXP8Fgh_xpi2PhKbcAsDYFzTgWtmbXsZOvoJVXlhbs6EyQkQXFnFpQen95fNn4135l4h5xqKDwVQ11N2eltxpCGWv_6Rp5lzl7ioIqAlaKZXI2DkmG73ckoQKEfcBSKCO0kHTeuqYufZz5jwVKEGZbpKRJ6oyBDfkJ9Ahl_n3php2x10XS3-_Sk1ika9F71qQjxrYdl-583O7-Xk_AxvWvjd83a_lNVvGPJqCN0-ljQxhk7mw4tNpDxPdGfZTXO973aYwVR_Sx_BPj4oImG5ijBZUva6hFaG6lw2tj8M44s4y4lZLyPVGNENKBLBaxGcICJ8e2aD-5C1oyjjLDewRkru8vNHLG8g90MTP7Xzp3bU7l4BJa1UXPqP75MfXoUnZehlfKwBpr7k6V0ZM-VYb33CPdMW_Ps8M1uL8R8qgx8xfDqZF73n917OqPptYugFdVCYfdF7ZtDTUVip50EJm1eCcBHBbAGNrnl4zrq0q3N_ud3qY8__qMeEqZhk7GOet3KQRzMtAZeZTcr8hoVIyFLLS55mZYnnzqPCCUU4-H90FYujhGkiw7cFUFithAjtHsBokyi40BQa37QVXL3suPJ_bLRjmmCc97OWuNyC3RGz9r0CnueH0gIg0dkjrwFI9oCU5ZFaG0iAh5BhtG77PX_dg4aE_P9KzTLgHKBuENVyz2HoMGWJf4N5Icx3YxzBHdDz1aSFyCllSTFgrT2pI5h0-HNkZZPUiiajd7Zfx8_V3d-OZqUvPYTGXhEJCEUBJBj6oi62jqv&abvar=2&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1882688&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=xMWqcTjsHFz71bY4NH114JNKC9oU6aqnV7s6ZX8I6rNh0tbaWFgGKzJrjb1-gyYITgrfOihXCWbVpiF0a-JwEUVkaUciP1VkISMx876uCknLTz1C8F3BIHaprgpz-dljbRq8Dt5WuRs_TgUU02vh4tFrgmCZ4q8MfABpzz51Qhr5mRvP_c3ngnDhllfvTiWo9-gFnTuHQORxBibUjzeC1eXP8Fgh_xpi2PhKbcAsDYFzTgWtmbXsZOvoJVXlhbs6EyQkQXFnFpQen95fNn4135l4h5xqKDwVQ11N2eltxpCGWv_6Rp5lzl7ioIqAlaKZXI2DkmG73ckoQKEfcBSKCO0kHTeuqYufZz5jwVKEGZbpKRJ6oyBDfkJ9Ahl_n3php2x10XS3-_Sk1ika9F71qQjxrYdl-583O7-Xk_AxvWvjd83a_lNVvGPJqCN0-ljQxhk7mw4tNpDxPdGfZTXO973aYwVR_Sx_BPj4oImG5ijBZUva6hFaG6lw2tj8M44s4y4lZLyPVGNENKBLBaxGcICJ8e2aD-5C1oyjjLDewRkru8vNHLG8g90MTP7Xzp3bU7l4BJa1UXPqP75MfXoUnZehlfKwBpr7k6V0ZM-VYb33CPdMW_Ps8M1uL8R8qgx8xfDqZF73n917OqPptYugFdVCYfdF7ZtDTUVip50EJm1eCcBHBbAGNrnl4zrq0q3N_ud3qY8__qMeEqZhk7GOet3KQRzMtAZeZTcr8hoVIyFLLS55mZYnnzqPCCUU4-H90FYujhGkiw7cFUFithAjtHsBokyi40BQa37QVXL3suPJ_bLRjmmCc97OWuNyC3RGz9r0CnueH0gIg0dkjrwFI9oCU5ZFaG0iAh5BhtG77PX_dg4aE_P9KzTLgHKBuENVyz2HoMGWJf4N5Icx3YxzBHdDz1aSFyCllSTFgrT2pI5h0-HNkZZPUiiajd7Zfx8_V3d-OZqUvPYTGXhEJCEUBJBj6oi62jqv&abvar=2&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
set-cookie: OACICAP=ACQzCgAAAAAAAAAB; Path=/; Expires=Mon, 06 Mar 2023 23:08:37 GMT; Secure; SameSite=None
OACIBLOCK=ACQzCgAAAABj3uNw; Path=/; Expires=Mon, 06 Mar 2023 23:08:37 GMT; Secure; SameSite=None
ppucnt=0; Path=/; Expires=Sun, 05 Feb 2023 23:08:37 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1882687&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=QWJKZlgvPYANooeVhs9Nay8kO0dPvQjFtOknbigVjIh8vYql-XVmCzOqGN13qJx5Mw7tOjXm3dqUf50GtD7Z2OfZAQJW2ZH8YLR1EmCnTKNqsMd6oFdMjpolmF2_TK0SWKL8sc_siOnAvG7VDihhhH9EejoNwoJY2KBaABZ-g5DSaVRVgySi1UjZwuSSCBiZKO7XgDKtcl9eDlmQrwGm0t3CwjDx0u7vCOUX03BrsXujTzNBLYDliYj6e0cE5uZo3xUzsmrx-iS_1fYZgR8wDz_764N5kigonTu20cyXXGl_ctVavJuK_eJD5EfZbYqbmhn0U_bql54FD9KlaOE12TAKV5CHyIMHZIJl4eQArvgugkal2vx6Z3g8cJIB0QrnfECGfhAQHrcsrEjbFL-QAiKJZRbGMwbbNr3ezA_49LN71x3ZeL18AqBZSo1_2bVySzvcZ7pUGq2FSQ8DOqH87cdvIj8jFpmVT7pnZoly-YqLKcbKKY737RzPJV-rLT_4vOOc-EA_j_51mSF-8jcO9LWv3338-GS0P5Y5S_e2XOP0MYV64RnXQZKa7ndpMePXzqsW8fP5BZgf1TFs1CkRJsrNGuy0xQU9_LHD0-hgEuxJ152EcbFKQ91LTwng7doY3aovVkkT2aBqXY7-O0Yjzz2eljpazXkRZUp-GRuEwEXzJ5aDnxi1WAlJzmXG2UD9Vg32Urd_8TAJ_AoxVS1OtdGtule_fQQzjfWCHy94YKThcCzLUiXyL03h9Xxlnn2z9ZF0Nj-iOtl9Kmt-9Znu-ax6uSE7-gI1FeJk_KaSu0Dazq81-CMVrhy-6RN5sJ-yvHN3GuL9Neyif0387nsDb-yBogTxOsDzjSohrr64G7Yy7qXHu1mQeHGOl6DvbxxJLO5PBMaSx4wub_ljbOB1bkYOQl18Dw1T5bydDqunZqrftm6prh1Cs_3OjNPJseiDnGbgXy3PGZ8yyfgbaXS9bPPVUgjSRXO5&abvar=4&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1882687&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=QWJKZlgvPYANooeVhs9Nay8kO0dPvQjFtOknbigVjIh8vYql-XVmCzOqGN13qJx5Mw7tOjXm3dqUf50GtD7Z2OfZAQJW2ZH8YLR1EmCnTKNqsMd6oFdMjpolmF2_TK0SWKL8sc_siOnAvG7VDihhhH9EejoNwoJY2KBaABZ-g5DSaVRVgySi1UjZwuSSCBiZKO7XgDKtcl9eDlmQrwGm0t3CwjDx0u7vCOUX03BrsXujTzNBLYDliYj6e0cE5uZo3xUzsmrx-iS_1fYZgR8wDz_764N5kigonTu20cyXXGl_ctVavJuK_eJD5EfZbYqbmhn0U_bql54FD9KlaOE12TAKV5CHyIMHZIJl4eQArvgugkal2vx6Z3g8cJIB0QrnfECGfhAQHrcsrEjbFL-QAiKJZRbGMwbbNr3ezA_49LN71x3ZeL18AqBZSo1_2bVySzvcZ7pUGq2FSQ8DOqH87cdvIj8jFpmVT7pnZoly-YqLKcbKKY737RzPJV-rLT_4vOOc-EA_j_51mSF-8jcO9LWv3338-GS0P5Y5S_e2XOP0MYV64RnXQZKa7ndpMePXzqsW8fP5BZgf1TFs1CkRJsrNGuy0xQU9_LHD0-hgEuxJ152EcbFKQ91LTwng7doY3aovVkkT2aBqXY7-O0Yjzz2eljpazXkRZUp-GRuEwEXzJ5aDnxi1WAlJzmXG2UD9Vg32Urd_8TAJ_AoxVS1OtdGtule_fQQzjfWCHy94YKThcCzLUiXyL03h9Xxlnn2z9ZF0Nj-iOtl9Kmt-9Znu-ax6uSE7-gI1FeJk_KaSu0Dazq81-CMVrhy-6RN5sJ-yvHN3GuL9Neyif0387nsDb-yBogTxOsDzjSohrr64G7Yy7qXHu1mQeHGOl6DvbxxJLO5PBMaSx4wub_ljbOB1bkYOQl18Dw1T5bydDqunZqrftm6prh1Cs_3OjNPJseiDnGbgXy3PGZ8yyfgbaXS9bPPVUgjSRXO5&abvar=4&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1882687&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=QWJKZlgvPYANooeVhs9Nay8kO0dPvQjFtOknbigVjIh8vYql-XVmCzOqGN13qJx5Mw7tOjXm3dqUf50GtD7Z2OfZAQJW2ZH8YLR1EmCnTKNqsMd6oFdMjpolmF2_TK0SWKL8sc_siOnAvG7VDihhhH9EejoNwoJY2KBaABZ-g5DSaVRVgySi1UjZwuSSCBiZKO7XgDKtcl9eDlmQrwGm0t3CwjDx0u7vCOUX03BrsXujTzNBLYDliYj6e0cE5uZo3xUzsmrx-iS_1fYZgR8wDz_764N5kigonTu20cyXXGl_ctVavJuK_eJD5EfZbYqbmhn0U_bql54FD9KlaOE12TAKV5CHyIMHZIJl4eQArvgugkal2vx6Z3g8cJIB0QrnfECGfhAQHrcsrEjbFL-QAiKJZRbGMwbbNr3ezA_49LN71x3ZeL18AqBZSo1_2bVySzvcZ7pUGq2FSQ8DOqH87cdvIj8jFpmVT7pnZoly-YqLKcbKKY737RzPJV-rLT_4vOOc-EA_j_51mSF-8jcO9LWv3338-GS0P5Y5S_e2XOP0MYV64RnXQZKa7ndpMePXzqsW8fP5BZgf1TFs1CkRJsrNGuy0xQU9_LHD0-hgEuxJ152EcbFKQ91LTwng7doY3aovVkkT2aBqXY7-O0Yjzz2eljpazXkRZUp-GRuEwEXzJ5aDnxi1WAlJzmXG2UD9Vg32Urd_8TAJ_AoxVS1OtdGtule_fQQzjfWCHy94YKThcCzLUiXyL03h9Xxlnn2z9ZF0Nj-iOtl9Kmt-9Znu-ax6uSE7-gI1FeJk_KaSu0Dazq81-CMVrhy-6RN5sJ-yvHN3GuL9Neyif0387nsDb-yBogTxOsDzjSohrr64G7Yy7qXHu1mQeHGOl6DvbxxJLO5PBMaSx4wub_ljbOB1bkYOQl18Dw1T5bydDqunZqrftm6prh1Cs_3OjNPJseiDnGbgXy3PGZ8yyfgbaXS9bPPVUgjSRXO5&abvar=4&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846179&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=KJSkT0CrjId0mcHP2Im8wUB06StjTZUtO3H-bcTyS2JmaAkHiAfEw0m_j8RjGutZY0HIbZDsFamkqpFSMqweI5A0vyHokbqHX-43jcRt4YROv-Jyh7pLYujNliNZKGuDLaNcpayBUMPhr1NoQtBL5A3DmJ71O32rzZM7MPuzS3d2PwtJUCcjs2AaRi03cFW47df9F2MIyKJ6fq2UaYx5UoHIZpTFQ1v8u-NHEMSfKdmCzTcDK53P5yG3Yp3Ll9Xzueo6p-56njy_v8XBwJqBweEudZF-EZIxBMaASKhygRz8KaH4TsM2Y7wME28NhFpgn8B4M9XpL03oJOXWR9PG8ljbHsHk_CuOBXyXpVDOJmfzVIYtYvo2aFFxDcQahe5yJSj9eacvyCJWdzjG7kQS1fN1rTZNwNmigEsSc6ldOHusEh-zE7q2v0aIc6HNc-2ufDKaSbClDHzqH2MMRp7NRbsidumr1biM_-cyaYZWQy18J-bwsMas3VbBx0N5xOOITTw1A9mRHTgqd_irtuu9cetKVDtckW07ouRlbpAUiKsR5mTxNlZCQQekoVizM_pq2WcJGrDv5mF_TeO4YOt-W-bNSLaT3rTwC7e2nb3zcb6Yc5ZuKk9UYS-qlVC0WDGcW_aWzk9XX9CCFNT1lKbI79q_utvYm1TXkGLKAFwFbBzBm3fn3Cd6sJIv5ENUC4TeTZlU_bj_aCy6VAJYdOBQaVkvXijupu_j0X2MfixP-r55Cquc-jR_7x0KREwmIVOgD-BSwV61xN4TL-HsxUCFO1xiUKF7GjtnmNmJcdDmK3DbttOw7HZvTkFQT-Bhxg0-eyRBIUV2VsFFR2mNJSfEmD3HJTH11EHn0A_qsckVAjQMvlxGloVMUVWrkQBiqSwhtjA1wU1-d6Y1fiRdgaPsRPV-9_w7sZm3xHyy4q6_tjHcmEA7q69JlZLgKIMahgMfCU3Rlz4fb8OuJ1WRI9Ruvcfe-vCptBDx&abvar=2&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846179&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=KJSkT0CrjId0mcHP2Im8wUB06StjTZUtO3H-bcTyS2JmaAkHiAfEw0m_j8RjGutZY0HIbZDsFamkqpFSMqweI5A0vyHokbqHX-43jcRt4YROv-Jyh7pLYujNliNZKGuDLaNcpayBUMPhr1NoQtBL5A3DmJ71O32rzZM7MPuzS3d2PwtJUCcjs2AaRi03cFW47df9F2MIyKJ6fq2UaYx5UoHIZpTFQ1v8u-NHEMSfKdmCzTcDK53P5yG3Yp3Ll9Xzueo6p-56njy_v8XBwJqBweEudZF-EZIxBMaASKhygRz8KaH4TsM2Y7wME28NhFpgn8B4M9XpL03oJOXWR9PG8ljbHsHk_CuOBXyXpVDOJmfzVIYtYvo2aFFxDcQahe5yJSj9eacvyCJWdzjG7kQS1fN1rTZNwNmigEsSc6ldOHusEh-zE7q2v0aIc6HNc-2ufDKaSbClDHzqH2MMRp7NRbsidumr1biM_-cyaYZWQy18J-bwsMas3VbBx0N5xOOITTw1A9mRHTgqd_irtuu9cetKVDtckW07ouRlbpAUiKsR5mTxNlZCQQekoVizM_pq2WcJGrDv5mF_TeO4YOt-W-bNSLaT3rTwC7e2nb3zcb6Yc5ZuKk9UYS-qlVC0WDGcW_aWzk9XX9CCFNT1lKbI79q_utvYm1TXkGLKAFwFbBzBm3fn3Cd6sJIv5ENUC4TeTZlU_bj_aCy6VAJYdOBQaVkvXijupu_j0X2MfixP-r55Cquc-jR_7x0KREwmIVOgD-BSwV61xN4TL-HsxUCFO1xiUKF7GjtnmNmJcdDmK3DbttOw7HZvTkFQT-Bhxg0-eyRBIUV2VsFFR2mNJSfEmD3HJTH11EHn0A_qsckVAjQMvlxGloVMUVWrkQBiqSwhtjA1wU1-d6Y1fiRdgaPsRPV-9_w7sZm3xHyy4q6_tjHcmEA7q69JlZLgKIMahgMfCU3Rlz4fb8OuJ1WRI9Ruvcfe-vCptBDx&abvar=2&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1846179&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=KJSkT0CrjId0mcHP2Im8wUB06StjTZUtO3H-bcTyS2JmaAkHiAfEw0m_j8RjGutZY0HIbZDsFamkqpFSMqweI5A0vyHokbqHX-43jcRt4YROv-Jyh7pLYujNliNZKGuDLaNcpayBUMPhr1NoQtBL5A3DmJ71O32rzZM7MPuzS3d2PwtJUCcjs2AaRi03cFW47df9F2MIyKJ6fq2UaYx5UoHIZpTFQ1v8u-NHEMSfKdmCzTcDK53P5yG3Yp3Ll9Xzueo6p-56njy_v8XBwJqBweEudZF-EZIxBMaASKhygRz8KaH4TsM2Y7wME28NhFpgn8B4M9XpL03oJOXWR9PG8ljbHsHk_CuOBXyXpVDOJmfzVIYtYvo2aFFxDcQahe5yJSj9eacvyCJWdzjG7kQS1fN1rTZNwNmigEsSc6ldOHusEh-zE7q2v0aIc6HNc-2ufDKaSbClDHzqH2MMRp7NRbsidumr1biM_-cyaYZWQy18J-bwsMas3VbBx0N5xOOITTw1A9mRHTgqd_irtuu9cetKVDtckW07ouRlbpAUiKsR5mTxNlZCQQekoVizM_pq2WcJGrDv5mF_TeO4YOt-W-bNSLaT3rTwC7e2nb3zcb6Yc5ZuKk9UYS-qlVC0WDGcW_aWzk9XX9CCFNT1lKbI79q_utvYm1TXkGLKAFwFbBzBm3fn3Cd6sJIv5ENUC4TeTZlU_bj_aCy6VAJYdOBQaVkvXijupu_j0X2MfixP-r55Cquc-jR_7x0KREwmIVOgD-BSwV61xN4TL-HsxUCFO1xiUKF7GjtnmNmJcdDmK3DbttOw7HZvTkFQT-Bhxg0-eyRBIUV2VsFFR2mNJSfEmD3HJTH11EHn0A_qsckVAjQMvlxGloVMUVWrkQBiqSwhtjA1wU1-d6Y1fiRdgaPsRPV-9_w7sZm3xHyy4q6_tjHcmEA7q69JlZLgKIMahgMfCU3Rlz4fb8OuJ1WRI9Ruvcfe-vCptBDx&abvar=2&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=m_a8Xtas06XIZTVt3SrWQ_NftD4DwSVtvf_vuF80Io3YPR8w1l5cK-EA9mhRnZ_H-n-26lp3OjMyZ26oEAa7riJlk0nSEmSBDC7J8CEm5U42OsT1xqGyzNEaWbTPolRaoOdq_dlRCdufqYtcPxAVOdIrB96SnKUpL7EMpketjXjbb4l7TXuoBwKEEuMgmeBiotAi87YfPFFo2CwpOuaeluDY2786QaFFdLfoME85uU3DnduhiBj2PHq2iEFICUNYx0ICkUMEA92BRsqnZKZWPNUtaqJEGF48Sm6BqhjKSlzu0OCIG_1dVjO92fJGT3Xh_wt_2CkPHeiDiLSOUyyRQZ9hoMbpnCwMs6g13CquvsDZp4670Fb6XkRUH39WDfg28MDe3ZjePRe20tnah899-QLX2ekG1BcRvFwip1h5FIXD13iqzCImV50vGQhW-6XJCuofeh0GxyVmoHE6NBBbffv4cM70jVRIvf7uESFC8zias6gOpIcTpCpLFHApdIPJDxipwadaTK4UuOnDNbv2qrlzE_IWIsly3482PKd_Az8SwHlwkw2FmtpBZRH2zt55iGoORrGmgVx_x0QPm0gOfz7xfbL3Q7JZYBbkzoS-o-r-CtxZ_S4G0_zs9gexwv7l89EN7zGC9SO2Uej8A4d-t3fjq1D9nsFcLnPNZMdL8YZw8Y67vM9SPiQ-RolSYB08E6QeD9qbElbjml7eGbDDRP3vcmXA2uWGfWt4wYWhnf5OoHzjafLN9tc4A-pKq9C9rD1o9Ty-STs5z3AujejeFtAYEY6bpbEyt-9kNm0-bKpW90EWzHL8BxbqbCPDpZialsQfl0GgjKDBN1Hdk1JbZwqj0z_8owNIjaOfC5cptVS9TtW7Rcq0h7WgvYV6lGXkmeLw006oxD07I_86A8vGvT6DKIKrBD29uHXai6qKwsxopUm2U2WJNPpvyEX8XeTWna4NqQRUxBy1cVqCzIJsx007WvghOtyO&abvar=2&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=m_a8Xtas06XIZTVt3SrWQ_NftD4DwSVtvf_vuF80Io3YPR8w1l5cK-EA9mhRnZ_H-n-26lp3OjMyZ26oEAa7riJlk0nSEmSBDC7J8CEm5U42OsT1xqGyzNEaWbTPolRaoOdq_dlRCdufqYtcPxAVOdIrB96SnKUpL7EMpketjXjbb4l7TXuoBwKEEuMgmeBiotAi87YfPFFo2CwpOuaeluDY2786QaFFdLfoME85uU3DnduhiBj2PHq2iEFICUNYx0ICkUMEA92BRsqnZKZWPNUtaqJEGF48Sm6BqhjKSlzu0OCIG_1dVjO92fJGT3Xh_wt_2CkPHeiDiLSOUyyRQZ9hoMbpnCwMs6g13CquvsDZp4670Fb6XkRUH39WDfg28MDe3ZjePRe20tnah899-QLX2ekG1BcRvFwip1h5FIXD13iqzCImV50vGQhW-6XJCuofeh0GxyVmoHE6NBBbffv4cM70jVRIvf7uESFC8zias6gOpIcTpCpLFHApdIPJDxipwadaTK4UuOnDNbv2qrlzE_IWIsly3482PKd_Az8SwHlwkw2FmtpBZRH2zt55iGoORrGmgVx_x0QPm0gOfz7xfbL3Q7JZYBbkzoS-o-r-CtxZ_S4G0_zs9gexwv7l89EN7zGC9SO2Uej8A4d-t3fjq1D9nsFcLnPNZMdL8YZw8Y67vM9SPiQ-RolSYB08E6QeD9qbElbjml7eGbDDRP3vcmXA2uWGfWt4wYWhnf5OoHzjafLN9tc4A-pKq9C9rD1o9Ty-STs5z3AujejeFtAYEY6bpbEyt-9kNm0-bKpW90EWzHL8BxbqbCPDpZialsQfl0GgjKDBN1Hdk1JbZwqj0z_8owNIjaOfC5cptVS9TtW7Rcq0h7WgvYV6lGXkmeLw006oxD07I_86A8vGvT6DKIKrBD29uHXai6qKwsxopUm2U2WJNPpvyEX8XeTWna4NqQRUxBy1cVqCzIJsx007WvghOtyO&abvar=2&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=m_a8Xtas06XIZTVt3SrWQ_NftD4DwSVtvf_vuF80Io3YPR8w1l5cK-EA9mhRnZ_H-n-26lp3OjMyZ26oEAa7riJlk0nSEmSBDC7J8CEm5U42OsT1xqGyzNEaWbTPolRaoOdq_dlRCdufqYtcPxAVOdIrB96SnKUpL7EMpketjXjbb4l7TXuoBwKEEuMgmeBiotAi87YfPFFo2CwpOuaeluDY2786QaFFdLfoME85uU3DnduhiBj2PHq2iEFICUNYx0ICkUMEA92BRsqnZKZWPNUtaqJEGF48Sm6BqhjKSlzu0OCIG_1dVjO92fJGT3Xh_wt_2CkPHeiDiLSOUyyRQZ9hoMbpnCwMs6g13CquvsDZp4670Fb6XkRUH39WDfg28MDe3ZjePRe20tnah899-QLX2ekG1BcRvFwip1h5FIXD13iqzCImV50vGQhW-6XJCuofeh0GxyVmoHE6NBBbffv4cM70jVRIvf7uESFC8zias6gOpIcTpCpLFHApdIPJDxipwadaTK4UuOnDNbv2qrlzE_IWIsly3482PKd_Az8SwHlwkw2FmtpBZRH2zt55iGoORrGmgVx_x0QPm0gOfz7xfbL3Q7JZYBbkzoS-o-r-CtxZ_S4G0_zs9gexwv7l89EN7zGC9SO2Uej8A4d-t3fjq1D9nsFcLnPNZMdL8YZw8Y67vM9SPiQ-RolSYB08E6QeD9qbElbjml7eGbDDRP3vcmXA2uWGfWt4wYWhnf5OoHzjafLN9tc4A-pKq9C9rD1o9Ty-STs5z3AujejeFtAYEY6bpbEyt-9kNm0-bKpW90EWzHL8BxbqbCPDpZialsQfl0GgjKDBN1Hdk1JbZwqj0z_8owNIjaOfC5cptVS9TtW7Rcq0h7WgvYV6lGXkmeLw006oxD07I_86A8vGvT6DKIKrBD29uHXai6qKwsxopUm2U2WJNPpvyEX8XeTWna4NqQRUxBy1cVqCzIJsx007WvghOtyO&abvar=2&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=AJCJZIWBHU0uEJNIQfjNtLb9cnbpl5z01TvMzYa3NfYQJVCJPgKuNgi_gJXYeQnQcfb9g5hKfPptIB49lOElijtrarSmsUBOfad3c_k1XHst0u58JOqbb7hRa4UWi0j8b4CyNhGUgzgn7kjSyuPrswVK92O0KVtst9z-gjkZhTmjdQ-TcHOmLiIF2pCoSV_kG9M1LRiVT5EBnJiZhXp3S6W7ejWvZm1tgWTCMZWIVmpaKjnE8A20KT7ANuVlllkb98xCUzPI0GncHNZRfldkHk5c9vvsq7yx42AqBQFEezuk33K2p4tuZnkzi9EyBi75Fgr-6EEaWhKHGfg3EHTCuhFQOGNGOhwcK_34HGvFri3KOmK3u0A9xNqdzkHgro1dX6iatBYDtpFABHiM-7wX77PO3qqP6VaCHdO2YvTAzVs8KS-Jl0MOc5rxFakr-qF1WRsC6Wjd1BcOirvlb0bbvEgSb79X_l-hiVhkUJ84TURb7jFhMxZy7avMGtFxYk4P1035ZmA2Jw-vV_dx0xp3cgOC6-m6ybGRJeXAi3HaCo562rATvRqVc3_vyVQJ6vKjpCeAnvYw8HICT-9DYcqrkG-BoxKNpluD4qs__iaReDSckwICm6yyNiFkA_nMXssmqK8nH5-1B0wY51kkHvr7f1A0SOSbHek8VNjFgAme6rsDKJSLzt9VGQLo8hKMCHgYkdHe66A14beyAP618D_rZK-nGS4LaFHXM_bCt-6dk08RXVgsIr0NR8km90C5tzy-YLzj38wgAf1Ku8BpLOHnXlNT84uF-ZDp79fF1PKU0SX_Y8jvfm1anSTtmN_gAbUELBqVnSLRzInGIAZBhgDNthDmadzvBIUSP_pGBFpFHPVA3tNhxgD3E-jvwRwnSJ2H2J23Dwurjx7Y5wtar-1jPAkv_95BEraLd3nkHDJJ2eDl7J18cKGkD4GcVMre0l3n8ONwrJkra4CMsWy_8r1Iagw_wd6xx_Jy&abvar=3&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=AJCJZIWBHU0uEJNIQfjNtLb9cnbpl5z01TvMzYa3NfYQJVCJPgKuNgi_gJXYeQnQcfb9g5hKfPptIB49lOElijtrarSmsUBOfad3c_k1XHst0u58JOqbb7hRa4UWi0j8b4CyNhGUgzgn7kjSyuPrswVK92O0KVtst9z-gjkZhTmjdQ-TcHOmLiIF2pCoSV_kG9M1LRiVT5EBnJiZhXp3S6W7ejWvZm1tgWTCMZWIVmpaKjnE8A20KT7ANuVlllkb98xCUzPI0GncHNZRfldkHk5c9vvsq7yx42AqBQFEezuk33K2p4tuZnkzi9EyBi75Fgr-6EEaWhKHGfg3EHTCuhFQOGNGOhwcK_34HGvFri3KOmK3u0A9xNqdzkHgro1dX6iatBYDtpFABHiM-7wX77PO3qqP6VaCHdO2YvTAzVs8KS-Jl0MOc5rxFakr-qF1WRsC6Wjd1BcOirvlb0bbvEgSb79X_l-hiVhkUJ84TURb7jFhMxZy7avMGtFxYk4P1035ZmA2Jw-vV_dx0xp3cgOC6-m6ybGRJeXAi3HaCo562rATvRqVc3_vyVQJ6vKjpCeAnvYw8HICT-9DYcqrkG-BoxKNpluD4qs__iaReDSckwICm6yyNiFkA_nMXssmqK8nH5-1B0wY51kkHvr7f1A0SOSbHek8VNjFgAme6rsDKJSLzt9VGQLo8hKMCHgYkdHe66A14beyAP618D_rZK-nGS4LaFHXM_bCt-6dk08RXVgsIr0NR8km90C5tzy-YLzj38wgAf1Ku8BpLOHnXlNT84uF-ZDp79fF1PKU0SX_Y8jvfm1anSTtmN_gAbUELBqVnSLRzInGIAZBhgDNthDmadzvBIUSP_pGBFpFHPVA3tNhxgD3E-jvwRwnSJ2H2J23Dwurjx7Y5wtar-1jPAkv_95BEraLd3nkHDJJ2eDl7J18cKGkD4GcVMre0l3n8ONwrJkra4CMsWy_8r1Iagw_wd6xx_Jy&abvar=3&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=AJCJZIWBHU0uEJNIQfjNtLb9cnbpl5z01TvMzYa3NfYQJVCJPgKuNgi_gJXYeQnQcfb9g5hKfPptIB49lOElijtrarSmsUBOfad3c_k1XHst0u58JOqbb7hRa4UWi0j8b4CyNhGUgzgn7kjSyuPrswVK92O0KVtst9z-gjkZhTmjdQ-TcHOmLiIF2pCoSV_kG9M1LRiVT5EBnJiZhXp3S6W7ejWvZm1tgWTCMZWIVmpaKjnE8A20KT7ANuVlllkb98xCUzPI0GncHNZRfldkHk5c9vvsq7yx42AqBQFEezuk33K2p4tuZnkzi9EyBi75Fgr-6EEaWhKHGfg3EHTCuhFQOGNGOhwcK_34HGvFri3KOmK3u0A9xNqdzkHgro1dX6iatBYDtpFABHiM-7wX77PO3qqP6VaCHdO2YvTAzVs8KS-Jl0MOc5rxFakr-qF1WRsC6Wjd1BcOirvlb0bbvEgSb79X_l-hiVhkUJ84TURb7jFhMxZy7avMGtFxYk4P1035ZmA2Jw-vV_dx0xp3cgOC6-m6ybGRJeXAi3HaCo562rATvRqVc3_vyVQJ6vKjpCeAnvYw8HICT-9DYcqrkG-BoxKNpluD4qs__iaReDSckwICm6yyNiFkA_nMXssmqK8nH5-1B0wY51kkHvr7f1A0SOSbHek8VNjFgAme6rsDKJSLzt9VGQLo8hKMCHgYkdHe66A14beyAP618D_rZK-nGS4LaFHXM_bCt-6dk08RXVgsIr0NR8km90C5tzy-YLzj38wgAf1Ku8BpLOHnXlNT84uF-ZDp79fF1PKU0SX_Y8jvfm1anSTtmN_gAbUELBqVnSLRzInGIAZBhgDNthDmadzvBIUSP_pGBFpFHPVA3tNhxgD3E-jvwRwnSJ2H2J23Dwurjx7Y5wtar-1jPAkv_95BEraLd3nkHDJJ2eDl7J18cKGkD4GcVMre0l3n8ONwrJkra4CMsWy_8r1Iagw_wd6xx_Jy&abvar=3&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /chicken.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash b5a404b308fa06356367c560e850e1bc
62a5d88a31451b0387e6444c079b6175fa8065a0
f0896232da72586ab3db7427040e653b271df7da7f4c192f44d1b38392702598
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "F0896232DA72586AB3DB7427040E653B271DF7DA7F4C192F44D1B38392702598"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5027
Expires: Sun, 05 Feb 2023 00:32:24 GMT
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
ocsp.buypass.com/
200 OK 1.7 kB IP
ASN #20940 Akamai International B.V.
Hash fa069b936581d95e9853d507f61b79df
86591a5492bfdc51f4de9bd9e1941e71e9bb9959
6e5d1e5cdd5bde5d1a1f045f86fa9c2a10a1d71bcbff2b1918358344d6c19fff
POST / HTTP/1.1
Host: ocsp.buypass.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 78
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Access-Control-Allow-Origin: https://www.buypass.no
Access-Control-Allow-Headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Buypass-Session-Id,X-Buypass-Locale
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
MDC-correlationId: d136c0b0-4aee-4ed1-b093-e3098653198c
Content-Length: 1701
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
ocsp.buypass.com/
200 OK 1.7 kB IP
ASN #20940 Akamai International B.V.
Hash fa069b936581d95e9853d507f61b79df
86591a5492bfdc51f4de9bd9e1941e71e9bb9959
6e5d1e5cdd5bde5d1a1f045f86fa9c2a10a1d71bcbff2b1918358344d6c19fff
POST / HTTP/1.1
Host: ocsp.buypass.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 78
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Access-Control-Allow-Origin: https://www.buypass.no
Access-Control-Allow-Headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Buypass-Session-Id,X-Buypass-Locale
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
MDC-correlationId: 2504e21a-63b3-471e-9740-fdec3b0dfbb7
Content-Length: 1701
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
ocsp.buypass.com/
200 OK 1.7 kB IP
ASN #20940 Akamai International B.V.
Hash 3078ab9c169626d9e42742b047154551
2e8b7ea768e97358e676540d9c5f037a728ca287
bf604b5cb4a50a7c179b97ab0ec53f8b96cacba2c70b68aabbd82c64c241a988
POST / HTTP/1.1
Host: ocsp.buypass.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 78
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Access-Control-Allow-Origin: https://www.buypass.no
Access-Control-Allow-Headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Buypass-Session-Id,X-Buypass-Locale
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
MDC-correlationId: 5ac775c4-c8b6-48b4-b78a-4409a1f7e977
Content-Length: 1701
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
ocsp.buypass.com/
200 OK 1.7 kB IP
ASN #20940 Akamai International B.V.
Hash 06d0fce41606cf0a35b8c8b67ea91a2f
2384f84bd330293c84b7e5c1d5f5c9c758bc3186
f4422e9c768fc496b2482e4ee1b32dc4c451805e2c66878d24b14706ca70902f
POST / HTTP/1.1
Host: ocsp.buypass.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 78
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Access-Control-Allow-Origin: https://www.buypass.no
Access-Control-Allow-Headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Buypass-Session-Id,X-Buypass-Locale
Access-Control-Allow-Credentials: false
Access-Control-Allow-Methods: GET,POST
MDC-correlationId: a3fec1a9-af05-4d72-9509-db08f053b6e0
Content-Length: 1701
Date: Sat, 04 Feb 2023 23:08:37 GMT
Connection: keep-alive
limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
200 OK 7 B URL HTTP/2 limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
IP
File type ASCII text, with no line terminators
Hash a97eb6fbe6f13b601d5d48c0eba8baae
736efb938caf3d0edec406932ada889f1a4f2268
a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821
GET /ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24 HTTP/1.1
Host: limurol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript
content-length: 7
x-route-id: ssp.bet
set-cookie: UID=23020418088862d937eaee4583bc86191ebd; Path=/; Expires=Sun, 04 Feb 2024 23:08:37 GMT; HttpOnly; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
leaknudes.com/favicon-32x32.png
200 OK 1.6 kB URL HTTP/2 leaknudes.com/favicon-32x32.png
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 61626cfa4a184548b5073136192b3dae
be7496e044a94bef8cf77ecd19a5741d0b22cf0c
4fc8e803a9db4cd19cdf7ce0038764d4778da8812e57474cc0ad19ac88651259
GET /favicon-32x32.png HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=2592000
expires: Mon, 06 Mar 2023 23:08:40 GMT
content-type: image/png
last-modified: Tue, 25 Oct 2022 20:20:32 GMT
accept-ranges: bytes
content-length: 1629
date: Sat, 04 Feb 2023 23:08:40 GMT
vary: User-Agent
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
go6shde9nj2itle.com/aas/r45d/vki/1846181/e4f5b7dc.js
200 OK 29 kB URL HTTP/2 go6shde9nj2itle.com/aas/r45d/vki/1846181/e4f5b7dc.js
IP
Hash 1a79c3c638050ed16ce8892118c9963d
484127430986367ddeb278880a736fc7056636d7
3400bb5e71f9c4192c5af81f84a04f294018fee603a388786bac02b9691a729f
Analyzer Verdict Alert quad9 Sinkholed
GET /aas/r45d/vki/1846181/e4f5b7dc.js HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: application/javascript
last-modified: Tue, 31 Jan 2023 12:39:48 GMT
vary: Accept-Encoding
etag: W/"63d90c14-120a1"
x-js-ab1: var3
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
200 OK 43 B URL HTTP/2 go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
POST /solid.gif?z=1846181&abvar=3 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kw3y5otoeuniv7e9rsi.com
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
200 OK 43 B URL HTTP/2 go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
POST /solid.gif?z=1846181&abvar=3 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kw3y5otoeuniv7e9rsi.com
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
200 OK 43 B URL HTTP/2 go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
POST /solid.gif?z=1846181&abvar=3 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://kw3y5otoeuniv7e9rsi.com
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
200 OK 43 B URL HTTP/2 go6shde9nj2itle.com/solid.gif?z=1846181&abvar=3
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
POST /solid.gif?z=1846181&abvar=3 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
simplewebanalysis.com/stats
200 OK 40 B URL HTTP/2 simplewebanalysis.com/stats
IP
File type ASCII text, with no line terminators
Hash b1d7db04ac7ed0d47f9e3b42100ed8d2
384128299f29734220d1b733addd2046cac118a4
8af0d1928cb04d3170cbc3187a18f83c5e48e93d4c8fbd050d1f1bcf1195ca10
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Cookie: uid_id2=db2f01c4-0db9-44d8-9782-ae3c6b62770c:3:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://leaknudes.com
access-control-allow-credentials: true
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/whob.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/whob.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /whob.gif?z=1846269&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=IyEykzx6CwA2vDN2TBj95oFb7os5mOr3NpUX1SnOkaotdduI249KUrJanX_7Gwse80rCUA5FVAg2cZoFLiapDfstwaihLPAlNkm0nMR5H1SHVys0-2Htp7GCv3nO3AzrHaIE2xR6Mkrn0qG6Xa_wAHmAr_v68AOMXWqr8s25NVr4RE61i0CvzVPSW4D-6Mw8IbDkPJO3KTWcNmeVKvxamCLT-jIDTqLVFltqWhROntRfvhhs0A53f3Wkd3zATka8tTvrPsLqXkmc16VKmCB9OPBySfZODVh3G0Xlxhp_zqnh2-dN5RxzYYlViB6inf5TiLeKnpBWOhTNp2PEIGCunp2Fi5__IpR763cVkzzaoYmp_XaA7Mspev80tAzEYl1GRhilLQgy_RfkfSHwSLJlixeLhZhl4J1AJkQsnP5O7W9wnyVZ-APRFFLATpRC1zQfPsk9CqIjG9c9IPI1hZkqC8D5WBB3ZEhKIVFDW4kcdEfN_-zYZZmwk-esv5r34pbK9RIZd80CWNJ9ywPYLAzrOhmRGmRc45Ca8CrEMJQjSVN_RYHl7-nQYYr7-hgg2goijnLaB_OqEh36TD-goK4IKX1RX75HHvQUTN0WfDQn6_dE0-rJNpUdyA0VFwX50EphF9niGuQQ2V0zxwAZGNEHN-XlyGPaShtVkPSkHAGzEa9HchsY7xwvuPqQgzwdp7kUXboxZvmFDBEca53lPTB1tNZYxo8wEgkJdrT-N7aykZOReMHJwcuGz_u6E__sElMslXfn6tkem4V8FqzoiDt-1LEM4D4lSePxxwTADY4bCsYtxue3M3z6PHGoiOdpRozj-oBhQY1Mw1LfGhSS7gxxzX3Auo9IIJtRweO_a10fn0ZZM7R7UFB8xkNmTHb3SkNk-UWqWJ1CdlDFVJt7F9XRw-NCB2nFwqhR0FByMEj3qTy7RBxP2yScksYjWXpvAtc5aFEy_XnBpJdsaFpv7VM5Zbk0fG1zhsgG&abvar=1&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008; OACICAP=ACQzCgAAAAAAAAAC; OACIBLOCK=ACQzCgAAAABj3uNw; ppucnt=0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.banner.view
set-cookie: OACICAP=ACQzCgAAAAAAAAACACPunQAAAAAAAAAB; Path=/; Expires=Mon, 06 Mar 2023 23:08:37 GMT; Secure; SameSite=None
OACIBLOCK=ACQzCgAAAABj3uNwACPunQAAAABj3uNw; Path=/; Expires=Mon, 06 Mar 2023 23:08:37 GMT; Secure; SameSite=None
ppucnt=0; Path=/; Expires=Sun, 05 Feb 2023 23:08:37 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/rconfig.js?3.1
200 OK 21 kB URL HTTP/2 leaknudes.com/Libs/Javascript/rconfig.js?3.1
IP
File type ASCII text, with very long lines (62972), with no line terminators
Hash b3bd643eb106c6ad55cd04809341f5f7
1c101c699bb086aaa59b7c45a6d9c9366c6a8f8f
aab3363e4a712da7e89ff066f2f60dd9d6852e1996a6363ef930be6e9e6fb93c
GET /Libs/Javascript/rconfig.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Fri, 23 Sep 2022 07:06:25 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 20841
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 1
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882687
200 OK 44 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882687
IP
Hash ab090a766c39ea7c7a606b6331311e4d
9c1259d3699ce652ff175d39579eaa5a2674f84d
522c346d930f0878be380c4519d93e6be6ea6c005b174ed176566d1763377466
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1882687 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var4
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846269
200 OK 45 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846269
IP
Hash 07450397c2d650752af0fea8231a016f
f1ddc592e94598bd6a5e6115b5dfdaea2ba15dd0
1d2eafc5dbcde64135f0051b99035043c233b4e03dcdf45af5422738030a8c4a
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1846269 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var2
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846269
200 OK 45 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846269
IP
Hash e28617c41eafa9a668b44fa802cd6868
62ea38e60776fc238b661465fe554679d38eaa70
ac9dfcb5a9cc539d91c1068b94413fcd51cf5a8dc7a5f23306d3767c1b73a17b
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1846269 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var3
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12554
Expires: Sun, 05 Feb 2023 02:37:52 GMT
Date: Sat, 04 Feb 2023 23:08:38 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg
200 OK 4.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1f4a8749b09484bfc2a8fe4b33c69624
299d7514cf29c2dbd919581883239ef44c0984dd
22a61b6e7b48eeb44339469a353efdef0dc089be670fb490627dd33adc59168b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4526
x-amzn-requestid: 0942d90f-c9a6-40e6-9439-5da97a42cd35
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fye2wEngoAMFmGQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ddab5e-5d3234d519561b4040eff4c3;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 00:48:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: WqipgPOkYYXuD4D0MYHUEn4Gusno3xTQyHrwq-XlF9mwiPP0BtQGWg==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 09:56:11 GMT
age: 47547
etag: "299d7514cf29c2dbd919581883239ef44c0984dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/get/1846269?zoneid=1846269&jp=_cl85cin1djoqtesbh8kia1&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=3206033729859684
200 OK 5.9 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/get/1846269?zoneid=1846269&jp=_cl85cin1djoqtesbh8kia1&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=3206033729859684
IP
Hash 74070ee53e17be5f2cb4e3f9286ac687
b79350c57a860cb7740eef195ca4c97b2f4d893f
831a6d1c43680d083cbe264ab0971a66656f6cdfc04915c335ffcf3772e9de54
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846269?zoneid=1846269&jp=_cl85cin1djoqtesbh8kia1&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=3206033729859684 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846269
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_cl5wztmwo7z70giekakzow&nojs=0&ix=0&abvar=3&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=3206033729894575
200 OK 9.2 kB URL HTTP/2 go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_cl5wztmwo7z70giekakzow&nojs=0&ix=0&abvar=3&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=3206033729894575
IP
Hash 4274f41a61b7896488f72b7c3f1611d1
116c9fa3c3ea0e21ec68870b10cc711c0c3d259b
a989df741c1d83e8607708bc90fa97030d07f858c4ecd9781af06d78f7ccb98d
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846181?zoneid=1846181&jp=_cl5wztmwo7z70giekakzow&nojs=0&ix=0&abvar=3&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=3206033729894575 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript
vary: Accept-Encoding
x-route-id: config
set-cookie: UID=2302041808fcd2e603f46249e4995126e015; Path=/; Expires=Sun, 04 Feb 2024 23:08:37 GMT; HttpOnly; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846179
200 OK 57 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846179
IP
Hash b1fccb737e23e53f4c3250f8af0a7720
b4ef7b772f61ef42f30a0a57513b55a6d71cfbbd
70edc492a46d05e18543b965316da68d5a9c32a5a7569e0dde47b7a3051f4222
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1846179 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var2
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846521
200 OK 51 kB URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846521
IP
Hash 851c8686d84a61064815cff2780abaea
460f94a20776912a0e1d4d8e5f090c65e23199f5
d415259cdc336b93a8bb933a36c7a59c40c1da0e4a765c6ca83ad2788ba2e9f1
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1846521 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var2
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_clsciltn7l3s84aik1spra&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=8835533264078896
200 OK 7.3 kB URL HTTP/2 go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_clsciltn7l3s84aik1spra&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=8835533264078896
IP
Hash e8dfba20ca87df068c2f3bea1f07e3e2
16bf42b7f00a8dc0a647e602637891ef99830ec3
e1a679b8250ccce90f99c988ced4942d0d225f5eecf8fbdd56daaa91124b637e
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846181?zoneid=1846181&jp=_clsciltn7l3s84aik1spra&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=8835533264078896 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: text/javascript
vary: Accept-Encoding
x-route-id: config
set-cookie: UID=2302041808245dff4b02fe480da175980dc1; Path=/; Expires=Sun, 04 Feb 2024 23:08:38 GMT; HttpOnly; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
200 OK 7 B URL HTTP/2 limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
IP
File type ASCII text, with no line terminators
Hash a97eb6fbe6f13b601d5d48c0eba8baae
736efb938caf3d0edec406932ada889f1a4f2268
a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821
GET /ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24 HTTP/1.1
Host: limurol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Cookie: UID=23020418088862d937eaee4583bc86191ebd
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: text/javascript
content-length: 7
x-route-id: ssp.bet
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/jquery.js?3.1
200 OK 34 kB URL HTTP/2 leaknudes.com/Libs/Javascript/jquery.js?3.1
IP
File type ASCII text, with very long lines (65447)
Hash 37a932aca16a2d55bfc1a1805d0e682c
04416fa422f6a089837aa14c54b4db03d0970c15
b1e9b2b8a33e9be8c10aabcd73cbe47633e92cbacc15c671a09167bdddfcec46
GET /Libs/Javascript/jquery.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sat, 26 Nov 2022 00:32:22 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 33493
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/whob.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0
200 OK 43 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/whob.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84
Analyzer Verdict Alert quad9 Sinkholed
GET /whob.gif?z=1846521&pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=8KOaI-zAEAIrBhar-I6TglHoY0xyQOiYsZqVdcYCCXrDhufQUbtXCYAqE1swkXGfgkTGa8EGSDtkc0QjakARpZggQaDzo3eu7EPsTiVgCGT7DXLc4HyFLyESrZ84FICFoeRwuFgH7vhGNoqGQn1fasWi6vdx5aBYJsExtUamMVD3yg5NgUmEXwmc0K8ZBo6MjXmeRRkZCBwf__2aqTDpyQ0XUYJDMNaeXk914qwgbjyjAhA73dyMEq-31m6v90t79g_zWT7lUxtQRaGUq7YrxG2kwk_zq727jJyBsyFa5M9SfWNeYgwJbpPWUxrzSobxXQmlt3A1rVtQVrKQQfE4mi23bQRXDwgcTWpMNUgfLpQ9UFkmDh6CsScXMPFMV-K_onzNy-4qacJX7Frwc4nXVeTscEFW4Ijw02c8kADLQxUwRcbw0wp532F5WAM1mhgH0ZHS8q60H8a_8vvZ5luum9nEZh-ERV0ayFl24JEBxRVpDee-FKjlpF4ot7gF7vkSE6yZPp-Tb6p23qQmeWosSceo5u4PB1WlEwM3mRvPJZ0GqivAv4QF1-pS4ui2DvBSB9R-nIgsflKvNFdV6lxb-Xq_y8fdXWOq3mK5SbWVakt5psKOldjVFM1pzVPT37vhFD8YB1Sxo5EiTDw9bRpTuICSobr2hTEt9WDk5-lKXN-EOunIzKOUyzw3Cdfkd46mtBfvt4KfnaAXUj8svUScfdFV2gxYw1aPssdIykBgKHb1NTCQM-p-uqmNGyyqMIgURtTa6OfHji_peuQilRoArmKVR-zqY_Nn4K2Z5P7fAHLYdFTSPw3pozdw0sVfEK1CwBIlLZuQ_1rZP4thyO7JJ3mMvVkwNvx3Ao4tVt5bC_rcKObuC-3aygFFPklW8OYtqUY0EJkFYVBuZtPGi87q6PkoGG24aFP5Iye28eoFUqots8JiQG4LsuL6ORfsuzmErt-yIv4A_8KnOO0pI-h9JRV7QW2vGN_p&abvar=2&os=0 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008; OACICAP=ACQzCgAAAAAAAAACACPunQAAAAAAAAAB; OACIBLOCK=ACQzCgAAAABj3uNwACPunQAAAABj3uNw; ppucnt=0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.banner.view
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
200 OK 7 B URL HTTP/2 limurol.com/ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24
IP
File type ASCII text, with no line terminators
Hash a97eb6fbe6f13b601d5d48c0eba8baae
736efb938caf3d0edec406932ada889f1a4f2268
a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821
GET /ssp/req/1845010/?pb=cbb58fce3e491168b0b517ffb19cee461675559317&psp=JetG3obgXSLIBQKYg-pPpkWJsDdcB4lcSVum4gSoxlAV4g__jCF3617hiLuvMeV9l-TpyGlY_w0yAJrjL7jB64YH4Pzq6Oa6JuxsZid5Wr09yBgIRU3q3-xXZ8-PtJtmxA4D9oaOOoDZp5w-bYY6wxtS7dZTZy25bw7rrKsAJ-7RHrwJzddEcLdXLpdcPcQ3N4KEbBIBJmh5VnXuDdkEaLU4JOr0L8_GhXXNg-YDnJrXVSItUpgJakDrHjoFnoPpv7cePoKdPK37h36qtommMszwjrYuUaETrSA2oMKf205cgMuzrPETy3bET2N18yoE3uqY0gvzknwTlwkb_fI_Asl0PbtoDNCaj88MBrbecWs3xF_W8pkrSnUi4hB4XSFD2t5pEXXB7jEyoPcp9TqejI6NU_I3p5XeOQqez5Xi0EXjEAb8HYFyeRa7sTJbxatcToa-qFLSI-wE0JvIXCKxjdzspmrMTZWxUFPvrte4cuufTQR87BOYDew5Y23dz1IlWuZs5pEzC4NRzmB1DqC3Ux1ePVNchiVwI-1rUFcGYcJs5CaRHmMCSUAE8fd_5uJ0zc-4hpKPoJAhbbhw5-bRf3ajswBdiKcf1OINynWFtRyoV8qxwzp5iIyfH-AnqDReFdAxc5Zs8j813XUKPV1Xrh8YOOl4TNPAYFO3-xk_jenQ__xvdyu1xa7xwwp2Uic43G0Uf3joaaIP9Y0=&cb=_clzzd6ikxtwg0jfwhpvqzs&nojs=0&ix=0&abvar=4&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24 HTTP/1.1
Host: limurol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Cookie: UID=23020418088862d937eaee4583bc86191ebd
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: text/javascript
content-length: 7
x-route-id: ssp.bet
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 31ced9359ed0edd56a09608f0ef2fe66
62d577d3b99b0be9d38cffd8e83b0351ee6b93a6
e05a0ba35ee20d920a856974f596e817130ed78369dceaacedd2166ba7c2f732
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E05A0BA35EE20D920A856974F596E817130ED78369DCEAACEDD2166BA7C2F732"
Last-Modified: Thu, 02 Feb 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4124
Expires: Sun, 05 Feb 2023 00:17:22 GMT
Date: Sat, 04 Feb 2023 23:08:38 GMT
Connection: keep-alive
region1.google-analytics.com/g/collect?v=2&tid=G-QVV6LWHMJT>m=45je3210&_p=619357691&cid=483232009.1675552155&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675552155&sct=1&seg=0&dl=https%3A%2F%2Fleaknudes.com%2Fleaked%2Fvideo%2F27043%2Fsweetie-fox-moonfleur-video-5-leaked-media&dt=Sweetie%20Fox%20MoonFleur%20Video%20%235%20-%20Leaknudes&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-QVV6LWHMJT>m=45je3210&_p=619357691&cid=483232009.1675552155&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675552155&sct=1&seg=0&dl=https%3A%2F%2Fleaknudes.com%2Fleaked%2Fvideo%2F27043%2Fsweetie-fox-moonfleur-video-5-leaked-media&dt=Sweetie%20Fox%20MoonFleur%20Video%20%235%20-%20Leaknudes&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-QVV6LWHMJT>m=45je3210&_p=619357691&cid=483232009.1675552155&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675552155&sct=1&seg=0&dl=https%3A%2F%2Fleaknudes.com%2Fleaked%2Fvideo%2F27043%2Fsweetie-fox-moonfleur-video-5-leaked-media&dt=Sweetie%20Fox%20MoonFleur%20Video%20%235%20-%20Leaknudes&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://leaknudes.com
date: Sat, 04 Feb 2023 23:08:38 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/Pages/post.js?3.1
200 OK 2.3 kB URL HTTP/2 leaknudes.com/Libs/Javascript/Pages/post.js?3.1
IP
File type ASCII text, with very long lines (6423), with no line terminators
Hash 6fd5fc9e3e8301c4660aea30991b0764
48f5b2e5748ab9ce86b6cafe57c5da24566d48fc
bcc609872264d53079dc81e0b5d7c11846e7276414eabe5e5d451699dfbeec87
GET /Libs/Javascript/Pages/post.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Wed, 17 Mar 2021 02:00:01 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 2276
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/nanoscroller.js?3.1
200 OK 3.3 kB URL HTTP/2 leaknudes.com/Libs/Javascript/nanoscroller.js?3.1
IP
File type ASCII text, with very long lines (10006), with no line terminators
Hash b05d11b5d9a0f9deeb343640edd1ab07
ba08ef9c140cdbfbd1da4a39527fb5b250511303
b37671aac07ccff146e969aecf02ddb18d09881307048cc616e80ead85bd4f9a
GET /Libs/Javascript/nanoscroller.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:38 GMT
content-type: application/javascript
last-modified: Sun, 01 Mar 2020 14:52:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 3304
date: Sat, 04 Feb 2023 23:08:38 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/players.js?3.1
200 OK 1.9 kB URL HTTP/2 leaknudes.com/Libs/Javascript/players.js?3.1
IP
File type ASCII text, with very long lines (5695), with no line terminators
Hash c2944d2f8607ae3ab9b6ccd6705eda33
5bac8ece6ccb2911272a48720ae8944bf1c9d1da
94a95561514d1755887b3c8b2c0a35f17232aa0350ffef8a8a31d5f4e3e0d0c3
GET /Libs/Javascript/players.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sat, 22 Oct 2022 15:07:56 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1910
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/waypoints.js?3.1
200 OK 2.4 kB URL HTTP/2 leaknudes.com/Libs/Javascript/waypoints.js?3.1
IP
File type ASCII text, with very long lines (8835), with no line terminators
Hash 6056309ae353de4841b897fe6db8011c
b882aedea5d8d9ba17c8ca52ecfc4b273baf7102
5e2429536605edcc0d1d1e6a51c672309ce82fb6b175e8d78c3d9e775d20ba94
GET /Libs/Javascript/waypoints.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sun, 01 Mar 2020 14:52:31 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 2441
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/auth.js?3.1
200 OK 1.4 kB URL HTTP/2 leaknudes.com/Libs/Javascript/auth.js?3.1
IP
File type ASCII text, with very long lines (4320), with no line terminators
Hash beaf15b0ce5d70e195b58024da989265
74aa795648b32f4bd2f266f7d4550a83041921e6
4e318af3690e16ea77e013a74128ae912d745f25a3a71d5dde33da2a3a8f0177
GET /Libs/Javascript/auth.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sun, 01 Mar 2020 14:52:31 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 1389
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
leaknudes.com/Libs/Javascript/media.js?3.1
200 OK 12 kB URL HTTP/2 leaknudes.com/Libs/Javascript/media.js?3.1
IP
File type ASCII text, with very long lines (45027), with no line terminators
Hash e71c47019c0e825b31621aa6c8a69326
f310401f2ca4d5e985caf712a25044ec5e605cce
b593356791bd4b5c6b801db898ae3544d059d238f9dc721e00eaa501fe557632
GET /Libs/Javascript/media.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sat, 30 Apr 2022 04:25:19 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 11976
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fee867d660e7db4f404f9d19666d1a06
db98da7eacd4966c62c7f688e10921fc71579bce
6d54bae814fa49d7b9f10b42371f23af095338193032f711af9eef02dd814534
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6D54BAE814FA49D7B9F10B42371F23AF095338193032F711AF9EEF02DD814534"
Last-Modified: Thu, 02 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10014
Expires: Sun, 05 Feb 2023 01:55:32 GMT
Date: Sat, 04 Feb 2023 23:08:38 GMT
Connection: keep-alive
leaknudes.com/Libs/Javascript/fbsdk.js?3.1
200 OK 558 B URL HTTP/2 leaknudes.com/Libs/Javascript/fbsdk.js?3.1
IP
File type ASCII text, with very long lines (1146), with no line terminators
Hash 16257de536576926d5a820a8f596de02
c20ddfc57d774a45c6898f540037617a4b860c9f
303945e576b83c683781722d374d445f86536fb3e6d21b2aaf133413d8e7f5f1
GET /Libs/Javascript/fbsdk.js?3.1 HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
cache-control: public, max-age=31536000
expires: Sun, 04 Feb 2024 23:08:40 GMT
content-type: application/javascript
last-modified: Sun, 01 Mar 2020 14:52:17 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding,User-Agent
content-length: 558
date: Sat, 04 Feb 2023 23:08:40 GMT
x-frame-options: DENY
age: 0
ddg-cache-status: MISS,MISS
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash fc4c59bce61f5e4b513368ef6dfa2f65
ca47bc68450269ef5152411c908b6f8587c249c7
0b3efe80005fa3bf164542fd9f596f9fb6bd8485ef415d6021c379314dcad7c5
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6479
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 04 Feb 2023 23:08:38 GMT
Last-Modified: Sat, 04 Feb 2023 21:20:39 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 279
static.addtoany.com/menu/page.js
200 OK 1.7 kB URL HTTP/2 static.addtoany.com/menu/page.js
IP
File type ASCII text, with very long lines (3076), with no line terminators
Hash e06d3c2441a4eb35a28414518d9936fe
9ad2645394d236b5123cc4254ba68748dc2d5814
def52a147540a4454e38edc64f5b6a7759c947f2d119e2e36006dabcccbec122
GET /menu/page.js HTTP/1.1
Host: static.addtoany.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=172800
cf-bgj: minify
access-control-allow-origin: *
age: 78758
etag: W/"c04-5f1f2ae2e431b"
last-modified: Wed, 11 Jan 2023 01:11:30 GMT
vary: Accept-Encoding
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 794711c6082eb4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
revolveoppress.com/sbar.json?key=0a9aec252ec8cc83b9f56ec6b45fa3a9&uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1
200 OK 4.3 kB URL HTTP/1.1 revolveoppress.com/sbar.json?key=0a9aec252ec8cc83b9f56ec6b45fa3a9&uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (6041), with no line terminators
Hash 6f0c012ee7409ad371fb2a7bf43a6aa6
9031f8fb8af35c3ad497908421d722ee6a2a9082
1822bdd7f88d245ca8175e249f8d7373c17115865ee6c6f597f00ae0c4d4c72c
GET /sbar.json?key=0a9aec252ec8cc83b9f56ec6b45fa3a9&uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1 HTTP/1.1
Host: revolveoppress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 Feb 2023 23:08:38 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://leaknudes.com
Access-Control-Allow-Origin: https://leaknudes.com
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=17037017; expires=Sun, 05 Feb 2023 23:08:38 GMT; secure; SameSite=None
uid_id2=db2f01c4-0db9-44d8-9782-ae3c6b62770c:3:1; expires=Sat, 11 Feb 2023 23:08:38 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 05 Feb 2023 23:08:38 GMT; secure; SameSite=None
uncs=1; expires=Sun, 05 Feb 2023 23:08:38 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sun, 05 Feb 2023 23:08:38 GMT; secure; SameSite=None
uncs29=1; expires=Sun, 05 Feb 2023 23:08:38 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a12b06b568bc67feda1fd668182332a6
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
unseenreport.com/pxf.gif?uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=0a9aec252ec8cc83b9f56ec6b45fa3a9&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=23
200 OK 1 B URL HTTP/1.1 unseenreport.com/pxf.gif?uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=0a9aec252ec8cc83b9f56ec6b45fa3a9&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=23
IP
ASN #39572 DataWeb Global Group B.V.
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert quad9 Sinkholed
GET /pxf.gif?uuid=db2f01c4-0db9-44d8-9782-ae3c6b62770c&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=0a9aec252ec8cc83b9f56ec6b45fa3a9&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=23 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 Feb 2023 23:08:38 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7fd01a1a381ba330474749d05e1898ca
Strict-Transport-Security: max-age=0; includeSubdomains
revolveoppress.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSPW8cVRR9EycNNAHRUCBWQBEQXs%2FMfk4iFGGCkUVwrCTIDc37mvXDM%2FNG783srF1ZREIuEFk6yvFZOxZgIfIDkNCYBrnKUqAtcMcvQKRGu15p4Rbv3vPOLc499355mF8QFzmdbH6i91QU0ZVW3a3d2FKJ0IWtbTyseW7dvVXbUkm7eas2mD6mf9NzW3X37dpHku%2FoFd%2F1XNdzvdqaMjLUg5UZC5WeBl49cOtNv%2B61mhiY%2F2ObO7DUgehfkJehxPja9m9PoXiFJP7pjrQ7mU7f%2FTDOI5ppg744%2BTTZSXSRIF6UoXEQJifzbmg7JuTbK9DJyXwC6P7RdAIwNSbOHx5YcjKXCdY%2FvlTKIsgETLyIol9BRhUUrcD1IyjxjABcYOMekvjJhjYF3b1k6ZQdk6vP%2F4YqxuTqn68giX9cjdSg9kBHeaZ0YjEIS6hBBdWrkOZnyPYcqOIMPPsCShAkcQklJm8J5oeux5vLrmDBcrMpustBp%2BsvU9ngbdb2Ox2Xz6xRqoIKK0RyCGqXkFsHuXKQhw7y1EEsJjXaCkLX7YQsbDS6Tc55o8F5q9sWLdFodkMXOZ9qHyJLh%2BDRENzsIzX72FFDmPwX2O0SVjiwGUFflCgkQWEJCkpQKIIiIyj65bGIrG%2FLJyKyOfPm2Z%2FnRjnSWe%2BQHuusJxNymF6Ql6aGOUvPJ9iRk5pLAyq53%2FIl73LebbAgbLUlb7NmK6QNGsCqEspeAbUO9tSYXHnnTaTTfKMBRs9gozNwdR00fw20GHV8F3R71Oy62EtOFTNU6FjWuY4hdIk0u4Zs1zmMLsirs8XdfO86JD%2B%2FPX782Y1%2FqsfgpkRqSnyufiXoRQej%2B7ogR%2Fd1YcnTe2mmYrVHp0t9kNFMLn3%2FsdwttBHrd%2Bzwu%2Ff5lJiWpw%2Blze7SRKikZ8kPq0oIada04ZL8vG63JNvM7fZqbpI8vbv5wdp6nBpprdJJBaqe2a%2FA1Zi8cPD17Fxff8NAmQomLxHn52QeULoCT%2Fdh04V6qwlMtOhhqYMiL0fGZ4vPSBFEcoEpK2H%2Fg9miPrQH6BkHNHs0O9K%2BKdGPStBoCJsvjbLUnN%2F%2BvTELsMgZscg4Rywy0TeX1lo1qclW6IbS9SULAxZ2qCuCsBkwGniyw1rUQ2bH%2FOKv%2Fr8AAAD%2F%2FwEAAP%2F%2FlzvEBoYEAAA%3D
200 OK 7 B URL HTTP/1.1 revolveoppress.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSPW8cVRR9EycNNAHRUCBWQBEQXs%2FMfk4iFGGCkUVwrCTIDc37mvXDM%2FNG783srF1ZREIuEFk6yvFZOxZgIfIDkNCYBrnKUqAtcMcvQKRGu15p4Rbv3vPOLc499355mF8QFzmdbH6i91QU0ZVW3a3d2FKJ0IWtbTyseW7dvVXbUkm7eas2mD6mf9NzW3X37dpHku%2FoFd%2F1XNdzvdqaMjLUg5UZC5WeBl49cOtNv%2B61mhiY%2F2ObO7DUgehfkJehxPja9m9PoXiFJP7pjrQ7mU7f%2FTDOI5ppg744%2BTTZSXSRIF6UoXEQJifzbmg7JuTbK9DJyXwC6P7RdAIwNSbOHx5YcjKXCdY%2FvlTKIsgETLyIol9BRhUUrcD1IyjxjABcYOMekvjJhjYF3b1k6ZQdk6vP%2F4YqxuTqn68giX9cjdSg9kBHeaZ0YjEIS6hBBdWrkOZnyPYcqOIMPPsCShAkcQklJm8J5oeux5vLrmDBcrMpustBp%2BsvU9ngbdb2Ox2Xz6xRqoIKK0RyCGqXkFsHuXKQhw7y1EEsJjXaCkLX7YQsbDS6Tc55o8F5q9sWLdFodkMXOZ9qHyJLh%2BDRENzsIzX72FFDmPwX2O0SVjiwGUFflCgkQWEJCkpQKIIiIyj65bGIrG%2FLJyKyOfPm2Z%2FnRjnSWe%2BQHuusJxNymF6Ql6aGOUvPJ9iRk5pLAyq53%2FIl73LebbAgbLUlb7NmK6QNGsCqEspeAbUO9tSYXHnnTaTTfKMBRs9gozNwdR00fw20GHV8F3R71Oy62EtOFTNU6FjWuY4hdIk0u4Zs1zmMLsirs8XdfO86JD%2B%2FPX782Y1%2FqsfgpkRqSnyufiXoRQej%2B7ogR%2Fd1YcnTe2mmYrVHp0t9kNFMLn3%2FsdwttBHrd%2Bzwu%2Ff5lJiWpw%2Blze7SRKikZ8kPq0oIada04ZL8vG63JNvM7fZqbpI8vbv5wdp6nBpprdJJBaqe2a%2FA1Zi8cPD17Fxff8NAmQomLxHn52QeULoCT%2Fdh04V6qwlMtOhhqYMiL0fGZ4vPSBFEcoEpK2H%2Fg9miPrQH6BkHNHs0O9K%2BKdGPStBoCJsvjbLUnN%2F%2BvTELsMgZscg4Rywy0TeX1lo1qclW6IbS9SULAxZ2qCuCsBkwGniyw1rUQ2bH%2FOKv%2Fr8AAAD%2F%2FwEAAP%2F%2FlzvEBoYEAAA%3D
IP
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSPW8cVRR9EycNNAHRUCBWQBEQXs%2FMfk4iFGGCkUVwrCTIDc37mvXDM%2FNG783srF1ZREIuEFk6yvFZOxZgIfIDkNCYBrnKUqAtcMcvQKRGu15p4Rbv3vPOLc499355mF8QFzmdbH6i91QU0ZVW3a3d2FKJ0IWtbTyseW7dvVXbUkm7eas2mD6mf9NzW3X37dpHku%2FoFd%2F1XNdzvdqaMjLUg5UZC5WeBl49cOtNv%2B61mhiY%2F2ObO7DUgehfkJehxPja9m9PoXiFJP7pjrQ7mU7f%2FTDOI5ppg744%2BTTZSXSRIF6UoXEQJifzbmg7JuTbK9DJyXwC6P7RdAIwNSbOHx5YcjKXCdY%2FvlTKIsgETLyIol9BRhUUrcD1IyjxjABcYOMekvjJhjYF3b1k6ZQdk6vP%2F4YqxuTqn68giX9cjdSg9kBHeaZ0YjEIS6hBBdWrkOZnyPYcqOIMPPsCShAkcQklJm8J5oeux5vLrmDBcrMpustBp%2BsvU9ngbdb2Ox2Xz6xRqoIKK0RyCGqXkFsHuXKQhw7y1EEsJjXaCkLX7YQsbDS6Tc55o8F5q9sWLdFodkMXOZ9qHyJLh%2BDRENzsIzX72FFDmPwX2O0SVjiwGUFflCgkQWEJCkpQKIIiIyj65bGIrG%2FLJyKyOfPm2Z%2FnRjnSWe%2BQHuusJxNymF6Ql6aGOUvPJ9iRk5pLAyq53%2FIl73LebbAgbLUlb7NmK6QNGsCqEspeAbUO9tSYXHnnTaTTfKMBRs9gozNwdR00fw20GHV8F3R71Oy62EtOFTNU6FjWuY4hdIk0u4Zs1zmMLsirs8XdfO86JD%2B%2FPX782Y1%2FqsfgpkRqSnyufiXoRQej%2B7ogR%2Fd1YcnTe2mmYrVHp0t9kNFMLn3%2FsdwttBHrd%2Bzwu%2Ff5lJiWpw%2Blze7SRKikZ8kPq0oIada04ZL8vG63JNvM7fZqbpI8vbv5wdp6nBpprdJJBaqe2a%2FA1Zi8cPD17Fxff8NAmQomLxHn52QeULoCT%2Fdh04V6qwlMtOhhqYMiL0fGZ4vPSBFEcoEpK2H%2Fg9miPrQH6BkHNHs0O9K%2BKdGPStBoCJsvjbLUnN%2F%2BvTELsMgZscg4Rywy0TeX1lo1qclW6IbS9SULAxZ2qCuCsBkwGniyw1rUQ2bH%2FOKv%2Fr8AAAD%2F%2FwEAAP%2F%2FlzvEBoYEAAA%3D HTTP/1.1
Host: revolveoppress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Cookie: u_pl=17037017; uid_id2=db2f01c4-0db9-44d8-9782-ae3c6b62770c:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 Feb 2023 23:08:38 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a9586268b486ab37b54dc12fd7d9cf26
Strict-Transport-Security: max-age=0; includeSubdomains
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9a2b34a5ab39090966561af64d7a5062
61f66d0325867f7d6218de5825e10a2908ce6cbe
7e3806c006494bcdd4e242c64865357f743a5eaac7e366fade7b98251b5c7838
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7E3806C006494BCDD4E242C64865357F743A5EAAC7E366FADE7B98251B5C7838"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16720
Expires: Sun, 05 Feb 2023 03:47:18 GMT
Date: Sat, 04 Feb 2023 23:08:38 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 6eac904305f0af9ac8425ba6638af743
6cc700dcc996020985e64492e8d9df7c498d861b
97a04042d25ff5aba9e8e6b99828405fc609275c375530f777a4a5d57e4cede3
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "97A04042D25FF5ABA9E8E6B99828405FC609275C375530F777A4A5D57E4CEDE3"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16624
Expires: Sun, 05 Feb 2023 03:45:43 GMT
Date: Sat, 04 Feb 2023 23:08:39 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 6eac904305f0af9ac8425ba6638af743
6cc700dcc996020985e64492e8d9df7c498d861b
97a04042d25ff5aba9e8e6b99828405fc609275c375530f777a4a5d57e4cede3
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "97A04042D25FF5ABA9E8E6B99828405FC609275C375530F777A4A5D57E4CEDE3"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16624
Expires: Sun, 05 Feb 2023 03:45:43 GMT
Date: Sat, 04 Feb 2023 23:08:39 GMT
Connection: keep-alive
static.addtoany.com/menu/sm.24.html
200 OK 1.6 kB URL HTTP/2 static.addtoany.com/menu/sm.24.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (677), with no line terminators
Hash c844badefd6de66232bd71c4ca42a7b7
4693d77cd5011c3949829fee76dc2c606f3a04d5
31f6f99a014260a3296dad8c74775ae7cd5e9186449141df493ef1ddba600e3e
GET /menu/sm.24.html HTTP/1.1
Host: static.addtoany.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: text/html; charset=utf-8
last-modified: Fri, 18 Nov 2022 00:47:55 GMT
etag: W/"2a5-5edb40e6d10d8"
cache-control: max-age=315360000, immutable
vary: Accept-Encoding
via: e2s
cf-cache-status: HIT
age: 1477915
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 794711c63863b4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.cloudimagesb.com/si/ae/aa/f6/aeaaf64c11bf62877f097a925a641d6b/1669388807.png
200 OK 91 kB URL HTTP/2 cdn.cloudimagesb.com/si/ae/aa/f6/aeaaf64c11bf62877f097a925a641d6b/1669388807.png
IP
ASN #39572 DataWeb Global Group B.V.
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Hash c1718772ca810c6c121fa1d02672bb44
22c20701dcd78b1bd41ada8b04576f73d3e42253
91561b48a3e4957afb6aaefbfa5c6463534db30a9bdc2a0f0aabbeef28486a33
GET /si/ae/aa/f6/aeaaf64c11bf62877f097a925a641d6b/1669388807.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:39 GMT
content-type: image/png
content-length: 91434
server: nginx/1.17.6
last-modified: Fri, 25 Nov 2022 15:06:56 GMT
etag: "6380da10-1652a"
expires: Mon, 06 Feb 2023 23:08:39 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 31 Jan 2023 13:09:06 GMT
expires: Wed, 31 Jan 2024 13:09:06 GMT
cache-control: public, max-age=31536000
age: 381573
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 29 Jan 2023 22:02:00 GMT
expires: Mon, 29 Jan 2024 22:02:00 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 522399
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/au/b6/cf/48/b6cf48ca3e8ab4bdbcfaa2279b0fb2bc/1613726822.html
200 OK 543 B URL HTTP/2 cdn.barscreative1.com/sb/au/b6/cf/48/b6cf48ca3e8ab4bdbcfaa2279b0fb2bc/1613726822.html
IP
ASN #39572 DataWeb Global Group B.V.
Hash 6683a64f47ad3da45c4e36ec40fa70b3
6df64504d0a6977e0ef6d50c02e288b2b683f449
65fc80307a8932921ace2d1b1f070961811d18572ef7e5643a80e4eb309e6995
Analyzer Verdict Alert fortinet Phishing
GET /sb/au/b6/cf/48/b6cf48ca3e8ab4bdbcfaa2279b0fb2bc/1613726822.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: text/html; charset=utf-8
server: nginx/1.17.6
last-modified: Fri, 19 Feb 2021 09:27:09 GMT
etag: W/"602f846d-4fa"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sun, 05 Feb 2023 00:08:38 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/js/script.js
200 OK 210 B URL HTTP/2 cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/js/script.js
IP
Hash 14c6a15c2c7729c885b33c990f37d2a5
865d9621a3a4c2b446ec535471412bf491a1e60e
bd7b0405bc197d2564e68c4366fdbfc06c0711a10231877d33c8c6cdd05fe7f0
GET /sb/ssp/utility/social-media/facebook/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:39 GMT
content-type: application/javascript
last-modified: Sat, 20 Feb 2021 08:47:14 GMT
etag: W/"6030cc92-1bc"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 7027861
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eH8D9TEXCqanwxNPusJuZkGcXx%2FTTMC%2BHeqAcJHkhAOP%2BOpeybeL9vZCb0qxteXACyCj2rZ%2FgatLMP1KPfg%2F0KgJaykpNS94lp75f4kTXElnGnNyjYlYBz6sRequ2nu37GwUcJYiuLWX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 794711c8485c72de-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/get/1882688?zoneid=1882688&jp=_cl8tz55e2u45iy5kwa9a3l&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=4613408613349466
200 OK 0 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/get/1882688?zoneid=1882688&jp=_cl8tz55e2u45iy5kwa9a3l&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=4613408613349466
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1882688?zoneid=1882688&jp=_cl8tz55e2u45iy5kwa9a3l&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=4613408613349466 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882688
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
fonts.googleapis.com/css?display=swap&family=Source+Sans+Pro:300,400|Poppins|Open+Sans:300,400|Raleway|Rajdhani|Montserrat:400,700
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?display=swap&family=Source+Sans+Pro:300,400|Poppins|Open+Sans:300,400|Raleway|Rajdhani|Montserrat:400,700
IP
GET /css?display=swap&family=Source+Sans+Pro:300,400|Poppins|Open+Sans:300,400|Raleway|Rajdhani|Montserrat:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 04 Feb 2023 23:08:36 GMT
date: Sat, 04 Feb 2023 23:08:36 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
static.addtoany.com/menu/modules/core.26680508.js
200 OK 0 B URL HTTP/2 static.addtoany.com/menu/modules/core.26680508.js
IP
GET /menu/modules/core.26680508.js HTTP/1.1
Host: static.addtoany.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:38 GMT
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000, immutable
cf-bgj: minify
access-control-allow-origin: *
age: 2152422
etag: W/"11452-5f1f2ae24215b"
last-modified: Wed, 11 Jan 2023 01:11:29 GMT
vary: Accept-Encoding
via: e1s
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 794711c6486bb4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/css/animate.css
200 OK 0 B URL HTTP/2 cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/css/animate.css
IP
GET /sb/ssp/utility/social-media/facebook/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://leaknudes.com
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:39 GMT
content-type: text/css
last-modified: Sat, 20 Feb 2021 08:44:40 GMT
etag: W/"6030cbf8-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 85325
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L2i8dYUc2pgSRzUDt1h70fEg9Qh9mJ5fkWcycoknuSa1s2ZlXtHFE97DabSEEbTulm3uopy9147Fc083J9bi0hFGfvuCdfri0INyd3l7tDQwGNQ1YTIlUhuUd5nlhZggmuoSgs8tfUyn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 794711c8384c72de-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/img/close.svg
200 OK 0 B URL HTTP/2 cdn.creative-bars1.com/sb/ssp/utility/social-media/facebook/img/close.svg
IP
GET /sb/ssp/utility/social-media/facebook/img/close.svg HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 04 Feb 2023 23:08:39 GMT
content-type: image/svg+xml
last-modified: Thu, 11 Feb 2021 15:13:59 GMT
etag: W/"602549b7-52a"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 805778
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhivOGc4AEWxD7RGCdkM05XkWhIqeJ%2FPBbdOl6Pons4z8dU%2FnS3QWOu%2FK%2F%2FkiabW31j8KfxS39vrPIfRlqFTHMVLaay1mXiRB3MY4mxemoTSr3EAeY1DGDfCTmJN1u4Xnz1stM7IfcEf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 794711c8587b72de-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
200 OK 0 B URL HTTP/2 leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
IP
GET /leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
set-cookie: __ddg1_=owavsFAaEknRsBsFRQqw; Domain=.leaknudes.com; HttpOnly; Path=/; Expires=Sun, 04-Feb-2024 23:08:36 GMT
PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; path=/; HttpOnly; secure
hash=7c9cbbf8; expires=Thu, 09-Feb-2023 23:08:38 GMT; Max-Age=432000; path=/; secure
autoplay=0; expires=Thu, 09-Feb-2023 23:08:38 GMT; Max-Age=432000; path=/; secure
pagemode=infinite; expires=Thu, 09-Feb-2023 23:08:38 GMT; Max-Age=432000; path=/; secure
viewmode=icons; expires=Thu, 09-Feb-2023 23:08:38 GMT; Max-Age=432000; path=/; secure
7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; expires=Sun, 05-Feb-2023 23:08:38 GMT; Max-Age=86400; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-encoding: br
vary: Accept-Encoding,User-Agent
date: Sat, 04 Feb 2023 23:08:38 GMT
x-ua-compatible: IE=edge
x-frame-options: DENY
X-Firefox-Spdy: h2
leaknudes.com/Libs/Functions/conf.php
200 OK 0 B URL HTTP/2 leaknudes.com/Libs/Functions/conf.php
IP
GET /Libs/Functions/conf.php HTTP/1.1
Host: leaknudes.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://leaknudes.com/leaked/video/27043/sweetie-fox-moonfleur-video-5-leaked-media
Cookie: __ddg1_=owavsFAaEknRsBsFRQqw; PHPSESSID=c9393a4ceecc4f71bc5e3bb4531dcc9b; hash=7c9cbbf8; autoplay=0; pagemode=infinite; viewmode=icons; 7033c584=a%3A1%3A%7Bi%3A0%3Bi%3A27043%3B%7D; _ga_QVV6LWHMJT=GS1.1.1675552155.1.0.1675552155.0.0.0; _ga=GA1.1.483232009.1675552155; dom3ic8zudi28v8lr6fgphwffqoz0j6c=db2f01c4-0db9-44d8-9782-ae3c6b62770c%3A3%3A1; sb_page_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_onpage_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_main_0a9aec252ec8cc83b9f56ec6b45fa3a9=1; sb_count_0a9aec252ec8cc83b9f56ec6b45fa3a9=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: ddos-guard
strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests;
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: hash=7c9cbbf8; expires=Thu, 09-Feb-2023 23:08:40 GMT; Max-Age=432000; path=/; secure
content-type: text/html; charset=UTF-8
content-encoding: br
vary: Accept-Encoding,User-Agent
date: Sat, 04 Feb 2023 23:08:40 GMT
x-ua-compatible: IE=edge
x-frame-options: DENY
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882688
200 OK 0 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882688
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /lvesnk.html?zoneid=1882688 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:36 GMT
content-type: text/html
last-modified: Fri, 27 Jan 2023 10:31:03 GMT
vary: Accept-Encoding
etag: W/"63d3a7e7-e1"
x-js-ab1: var2
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/get/1882687?zoneid=1882687&jp=_cl26myyjy0b7v5kp5vampz&nojs=0&ix=0&abvar=4&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=6583733450359474
200 OK 0 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/get/1882687?zoneid=1882687&jp=_cl26myyjy0b7v5kp5vampz&nojs=0&ix=0&abvar=4&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=6583733450359474
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1882687?zoneid=1882687&jp=_cl26myyjy0b7v5kp5vampz&nojs=0&ix=0&abvar=4&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=6583733450359474 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1882687
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/aas/r45d/vki/1846181/d3af1cb3.js
200 OK 0 B URL HTTP/2 go6shde9nj2itle.com/aas/r45d/vki/1846181/d3af1cb3.js
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /aas/r45d/vki/1846181/d3af1cb3.js HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://leaknudes.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: application/javascript
last-modified: Tue, 31 Jan 2023 12:39:48 GMT
vary: Accept-Encoding
etag: W/"63d90c14-120a1"
x-js-ab1: var3
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
kw3y5otoeuniv7e9rsi.com/get/1846179?zoneid=1846179&jp=_cluehhuni9otf14k497dgq&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=5176358566787707
200 OK 0 B URL HTTP/2 kw3y5otoeuniv7e9rsi.com/get/1846179?zoneid=1846179&jp=_cluehhuni9otf14k497dgq&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=5176358566787707
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846179?zoneid=1846179&jp=_cluehhuni9otf14k497dgq&nojs=0&ix=0&abvar=2&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0&cid=5176358566787707 HTTP/1.1
Host: kw3y5otoeuniv7e9rsi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/lvesnk.html?zoneid=1846179
Cookie: UID=2302041808e5f0f35814cd410fb66bf11008
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_clee9t2vqzajbw7rwf1wip&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=2924558753190036
200 OK 0 B URL HTTP/2 go6shde9nj2itle.com/get/1846181?zoneid=1846181&jp=_clee9t2vqzajbw7rwf1wip&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=2924558753190036
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /get/1846181?zoneid=1846181&jp=_clee9t2vqzajbw7rwf1wip&nojs=0&ix=0&abvar=3&t=0&x=801&y=801&wcks=0&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=2924558753190036 HTTP/1.1
Host: go6shde9nj2itle.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://kw3y5otoeuniv7e9rsi.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 23:08:37 GMT
content-type: text/javascript
vary: Accept-Encoding
x-route-id: config
set-cookie: UID=2302041808fcdd8504bb69493ba60d3e6c61; Path=/; Expires=Sun, 04 Feb 2024 23:08:37 GMT; HttpOnly; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2
185.178.208.156
173.233.137.44
23.36.77.32
62.122.171.6
93.184.220.29
104.17.25.14
3.120.47.42