compositioncontemplation.cn/vale-brasil/tb.php?mb=cp1664212911104
200 OK 565 B URL HTTP/1.1 compositioncontemplation.cn/vale-brasil/tb.php?mb=cp1664212911104
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (479), with CRLF line terminators
Hash e54ac5bf6c86dd98e4d337e40e81d193
eb4f284c2f9a702b75846b00e50e699a1d0eca1b
4ee41e46b9935ed223c1f3d07b3cf6b84db0e410f934db1a7e75269e29f95506
Analyzer Verdict Alert fortinet Phishing
GET /vale-brasil/tb.php?mb=cp1664212911104 HTTP/1.1
Host: compositioncontemplation.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dMAhgaGLFdXIemKYmoDzga7bNeXKw2%2F50Jc5htNF0UYlXA8yx%2BN1H2SUBxF%2F7yT2GNH9nwsg%2Fcg7rxQN1zyQmqWYhX7ysse%2BxXT%2Bl7mmn5b0pY%2Bw2CeNjVZIsaQx5GO8oJtTd65cL9f1uLhUatM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 750ebea6fb780b51-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash d2560f62890e75b8de444fed96c22f52
334ce0c48e606ee029f31eeb1463af87b1024bb9
4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4397E6B45B5822FBAB9B83ABE0B96EE70EFBA7CD2160B51936159865EDE5FDB1"
Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7832
Expires: Mon, 26 Sep 2022 22:38:45 GMT
Date: Mon, 26 Sep 2022 20:28:13 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 26 Sep 2022 20:15:21 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 9aKSYViGOyhmop6qWQTunceLPJNdnSwk_IbHMUFXCPNTetRxXDH0gg==
Age: 772
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
File type PEM certificate\012- , ASCII text
Hash 6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Mon, 26 Sep 2022 04:35:16 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 8e6dce34fd223e0c9d89fd938d1784a2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: pumSKTz3jNaOA-TF5iaFXQLkrYiGSM1cF8lRJg4NGGYciSpvzfgrag==
age: 57178
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 26 Sep 2022 20:28:13 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
compositioncontemplation.cn/favicon.ico
200 OK 455 B URL HTTP/1.1 compositioncontemplation.cn/favicon.ico
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 3c5d244b8b6b192c76a2c4331450c235
7e53f5ad871fcd67705eaf77f1ca9ff247143e1e
e0f26b6349453a86cd1f0f87cfd80559ef7edb6d88ff0af9ced7d7e413c548e3
GET /favicon.ico HTTP/1.1
Host: compositioncontemplation.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://compositioncontemplation.cn/vale-brasil/tb.php?mb=cp1664212911104
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:13 GMT
Content-Type: image/x-icon
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 27 Dec 2016 03:54:11 GMT
ETag: W/"5861e5e3-1b0"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gzxIatqV%2BIIfW2obsbqgwbI26%2BJjz0Ei4Q%2FBZeUgHZBmU8brxKozPX2xKBQdbibEK17j%2F%2BrcrLmwJ1at4iloYWWRgIboArjC%2BhBb2QBMMOB5HHfAIag1sLb8QWZLvMfG9dRjvwNFAu9dI6gSZBw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750ebea89d900b51-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
compositioncontemplation.cn/j/og2.js?_t=1664224091737
200 OK 942 B URL HTTP/1.1 compositioncontemplation.cn/j/og2.js?_t=1664224091737
IP
File type ASCII text, with CRLF line terminators
Hash bad1af26351d2e87c035596233940ab0
9ac0e34dcbfd29ca3070c506c200777a8016b161
bc734ed6fc97cbcbaa0ed5236ce8aa46754596a9a79eef96684242d231d0644e
Analyzer Verdict Alert fortinet Phishing
GET /j/og2.js?_t=1664224091737 HTTP/1.1
Host: compositioncontemplation.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://compositioncontemplation.cn/vale-brasil/tb.php?mb=cp1664212911104
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sat, 11 Jun 2022 06:57:07 GMT
Vary: Accept-Encoding
ETag: W/"62a43cc3-850"
Expires: Tue, 27 Sep 2022 08:28:13 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fz6U3zN7xjUHHdix05zDbLIrWbm%2FUR6KYoJygqhfMHYKT%2FR%2BcIYGTyLbGn3%2F%2BhXi223Az2feFFUdSShhOs0MUybJp6rS9zznwGBItqLTiZUGVYwT5IDtPzqQzrv%2BZN3zSqXjPA2XsMcgPX0FvXI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 750ebea94e880b51-OSL
alt-svc: h2=":443"; ma=60
compositioncontemplation.cn/j/og2.php?_t=1664224091833
200 OK 99 B URL HTTP/1.1 compositioncontemplation.cn/j/og2.php?_t=1664224091833
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 8e673d70be995f7dec517e8136642739
f4879d5486010b33e7b2f72549076d7843aed6c5
408763bee1754ed61ab49fdaab116408c6a3bd77c7d28286efec34c09611c39f
Analyzer Verdict Alert fortinet Phishing
POST /j/og2.php?_t=1664224091833 HTTP/1.1
Host: compositioncontemplation.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 51
Origin: http://compositioncontemplation.cn
Connection: keep-alive
Referer: http://compositioncontemplation.cn/vale-brasil/tb.php?mb=cp1664212911104
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:13 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xwqVOXsja7uQBjHNG50mXT1KyxmeOI5c9j4baAE7v1kyiaNtj1tdw5iiMZC4llDpfs7TrGqahA923zj0ausLOMnwfxLjcWpLhRuRwb%2Fz8YOFhXP9Q2SR2qo%2Bo%2BIN%2B5ygv3H38jmp3oU2LXwvt0M%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 750ebea9ff5b0b51-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 7ee5fcbb2841f9d07e8d936fbdbb9617
651c2f621aa071a41f17ed5df7470c99cf5735c7
bc37a429409669dd53739694e8fb913b5536e2193f95ec2d16e88e8c31d5b1d7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "BC37A429409669DD53739694E8FB913B5536E2193F95EC2D16E88E8C31D5B1D7"
Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3336
Expires: Mon, 26 Sep 2022 21:23:49 GMT
Date: Mon, 26 Sep 2022 20:28:13 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Mon, 26 Sep 2022 20:10:46 GMT
Expires: Mon, 26 Sep 2022 20:29:36 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 1SbS2XngQHQ4py6nU-kDceertscrn1OZDlznHBiH0Ms_al0VFk47lQ==
Age: 1047
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 7ee5fcbb2841f9d07e8d936fbdbb9617
651c2f621aa071a41f17ed5df7470c99cf5735c7
bc37a429409669dd53739694e8fb913b5536e2193f95ec2d16e88e8c31d5b1d7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "BC37A429409669DD53739694E8FB913B5536E2193F95EC2D16E88E8C31D5B1D7"
Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3335
Expires: Mon, 26 Sep 2022 21:23:49 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 5adb7eb1d103eadeeafac36e663ffdd3
23b784388dd634fa736cd60aed71570661e73d02
5c95ba48bc342887b4f7ef697bd4def50f6f2f472f654169179e5ac44df883d9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2381
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Last-Modified: Mon, 26 Sep 2022 19:48:33 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c939f97c8bcbfea356e92036803714bc
608c795e7c4fb943a4db49a4e4533c41ea717023
b05b38c78c15c259720bfc6783ac65ab60ceb1e6037b45b08113f183554f08cb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 1db3e1d6bf7a5e2d0c87eab75a6e52fe
b923a169beb9248ea6a5070a04b57bc0aa44799b
f35aafc9c21937ac03d9b711aa18ef518aaaec6d0f9dbcecb42f757a0e70915c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c939f97c8bcbfea356e92036803714bc
608c795e7c4fb943a4db49a4e4533c41ea717023
b05b38c78c15c259720bfc6783ac65ab60ceb1e6037b45b08113f183554f08cb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-LW7434MYMN
200 OK 75 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-LW7434MYMN
IP
File type ASCII text, with very long lines (17807)
Hash d975f5d370c8c21a2bb628fb6926a990
e1956dbe8dcd29556a9ed9224706eac3f4fdfdab
c90e94b2f5ed0de0f027ba3a2de921e113f71e1ac463737db34ea85753fdeb69
GET /gtag/js?id=G-LW7434MYMN HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 26 Sep 2022 20:28:14 GMT
expires: Mon, 26 Sep 2022 20:28:14 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 74646
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-0C230YDF7G
200 OK 75 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-0C230YDF7G
IP
File type ASCII text, with very long lines (17807)
Hash bc3886ae8d76509c336d7dbfb3584530
a92116674b1e738b842bd733a334268f0c03dfd4
f20bea05f082a4b7dfe9e3e5bdad119e438853d27c0e26202e2d228fb9083177
GET /gtag/js?id=G-0C230YDF7G HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 26 Sep 2022 20:28:14 GMT
expires: Mon, 26 Sep 2022 20:28:14 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 74711
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-0L8HWYE022
200 OK 75 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-0L8HWYE022
IP
File type ASCII text, with very long lines (20189)
Hash 4bb8f99df96736ebac4949e936444b1a
34c2aace087ee92a58f072653a247ce10d8a540f
11561299b334260eab0c0a7ff9776004cbd6ba22a775f5f2e331b28433a3450e
GET /gtag/js?id=G-0L8HWYE022 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 26 Sep 2022 20:28:14 GMT
expires: Mon, 26 Sep 2022 20:28:14 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75273
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash a66f24d2194f85e2ec84375985242859
61090e8b1051346bbdc550bd3cadaa9f15dd18ae
eb9724774a8e0681aaf0be7644b1a433dc6d5dd17701c6317bc0054d898d4f7c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EB9724774A8E0681AAF0BE7644B1A433DC6D5DD17701C6317BC0054D898D4F7C"
Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10752
Expires: Mon, 26 Sep 2022 23:27:26 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash a66f24d2194f85e2ec84375985242859
61090e8b1051346bbdc550bd3cadaa9f15dd18ae
eb9724774a8e0681aaf0be7644b1a433dc6d5dd17701c6317bc0054d898d4f7c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EB9724774A8E0681AAF0BE7644B1A433DC6D5DD17701C6317BC0054D898D4F7C"
Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10752
Expires: Mon, 26 Sep 2022 23:27:26 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash a66f24d2194f85e2ec84375985242859
61090e8b1051346bbdc550bd3cadaa9f15dd18ae
eb9724774a8e0681aaf0be7644b1a433dc6d5dd17701c6317bc0054d898d4f7c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EB9724774A8E0681AAF0BE7644B1A433DC6D5DD17701C6317BC0054D898D4F7C"
Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10752
Expires: Mon, 26 Sep 2022 23:27:26 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash a66f24d2194f85e2ec84375985242859
61090e8b1051346bbdc550bd3cadaa9f15dd18ae
eb9724774a8e0681aaf0be7644b1a433dc6d5dd17701c6317bc0054d898d4f7c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EB9724774A8E0681AAF0BE7644B1A433DC6D5DD17701C6317BC0054D898D4F7C"
Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10752
Expires: Mon, 26 Sep 2022 23:27:26 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
200 OK 20 kB URL HTTP/2 cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
IP
File type ASCII text, with very long lines (48058), with CRLF line terminators
Hash 417160ddfad1fdd5c3badcebdc80e1e7
8943e57d21fe64d6146fc9953d79d47c9d210c4b
b33415c560cf27993374d0465517c1bcffcb2af8e84f4e21701a9b69cb44f625
GET /npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycds-jCnt-H9uv1oLQs9nieyoX3L4c0HfGo53RWfpVbIg517w6ygFOMulfCCYPbJG0NSjP3CPTNsA-EzQAxumTjyo8Q
x-goog-generation: 1647502839791727
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 72765
x-goog-hash: crc32c=8ZRUYw==, md5=gJJLYuWzrHOqSEl3a0OXcA==
x-goog-storage-class: STANDARD
expires: Mon, 26 Sep 2022 19:52:22 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:40:39 GMT
etag: W/"80924b62e5b3ac73aa4849776b439770"
age: 1873
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vk09gkdoPfB0OOP%2FklCpyFtzuyBIePU9lk0bSzdps7Z6Biqwb%2FmZafAJ%2FPjii2TdgEX6UYlTVLpOODPSj31Ip2SijyTuHkHzjVC%2FYCN1%2B7Dm2KnyYz15Zni0Idm9jijfVAc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeacaa7fe658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5081dc1508d43c1e614957b7a94bab1a
4eecce92d0ed0a867a5c6545238b8ec255aded8b
17aeec36af397aa62a479b610a5dd05987c22cbb58d26d4e79b3e403af5cf9b1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
263cdn.com/upload/yhde1.jpg
200 OK 13 kB URL HTTP/2 263cdn.com/upload/yhde1.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 8bb7f41971b23f34648e6b4797df26f3
3a2732b4bd2c9e45291f66a9872ef2d780fe831b
df4dd6d2b21fd5d5bedc1259cedab7ace2eeec381c18ca487f47fb26af6792b6
GET /upload/yhde1.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 12610
x-guploader-uploadid: ADPycdtfh5DxpmIF1ZBFMdDeNUHaAcmJwZZnl8TpGufA0Lx38-eukhWrRNLsr5__EH3aiNqL13_ZnYiBtvD0zjiaeD2Cvg
expires: Mon, 26 Sep 2022 20:42:01 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "8bb7f41971b23f34648e6b4797df26f3"
x-goog-generation: 1657560169688143
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12610
x-goog-hash: crc32c=/laZCQ==, md5=i7f0GXGyPzRkjmtHl98m8w==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1325
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DxU%2BiuDwf%2BI96bN4S%2FJJCv1weM%2B7e0dnbJ%2B9hjVwTV%2FZ6DGY8WzR3I13xxO9wArU6WyWNLQxDCvPHGF%2FBXGoqMccFgN4BVNywwFJYIoSQwepSc9xwVlsZkN8l08o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8f371d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde8.jpg
200 OK 7.9 kB URL HTTP/2 263cdn.com/upload/yhde8.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash b8b61d66db60a707e147d51f80cd7caf
9caeead5c434baf1feb311daf7ce1aa19fa21863
a17ccb0824fbac80cc0d82f280573c2e214876756d8e597e8fa10c9b83e4e342
GET /upload/yhde8.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 7939
x-guploader-uploadid: ADPycdveBphS_-pnKVzVFrummhVL4y-rwqrwPVvaeO5NigvucM2zoaYmtGTNgXYnAF61jn0RJAVLp2v2T0qNnSyKgeMNAg
expires: Mon, 26 Sep 2022 19:49:02 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "b8b61d66db60a707e147d51f80cd7caf"
x-goog-generation: 1657560171890012
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7939
x-goog-hash: crc32c=VOlkAw==, md5=uLYdZttgpwfhR9UfgM18rw==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 705
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KhUsfMY9hPTjp1UMmRqAKcFhrjllG60%2FlKy0GpF%2FAx1Awwn8Mw2F6rLXiGwGeqhIfVWMSOBxuLfcSJEiffVSzPKg%2FEgAmDhTlWexSHLh594uE4d5Cs0rCfGBtlGS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8f171d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde6.jpg
200 OK 9.0 kB URL HTTP/2 263cdn.com/upload/yhde6.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash ee5371e6976fe9bb8b6d46278279f89d
c246da7df163264acac382d4a83ba162b08637a8
ad1533c7cdb68e5cb8b5123a6775d6d5e67836e7187b46e27d5009a70a251ad4
GET /upload/yhde6.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 8953
x-guploader-uploadid: ADPycdv6aTAfGE_NNJ9LFMmqbTa7I8ZlS9xuzrxDxFnnDrRAPB3FeIvsSoqVxdk6Y3JIm-lo7Hn4uloAWkqaHAckwDe3LQ
expires: Mon, 26 Sep 2022 20:51:31 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "ee5371e6976fe9bb8b6d46278279f89d"
x-goog-generation: 1657560171630757
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8953
x-goog-hash: crc32c=YDJ99Q==, md5=7lNx5pdv6buLbUYngnn4nQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1540
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bv9uNK3Gnhdif%2BVjGZsI3HWfdWLqCOFp%2FLJYfoEeHjSuoR7F3skZV%2BPwrRizoLZ5Ba4Zdpj%2F1faFVCgD%2FARaA5mxVYaBfHoVr3pvaVkv0OSKsPrXNxeBEAjKxMxD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8fa71d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde5.jpg
200 OK 8.0 kB URL HTTP/2 263cdn.com/upload/yhde5.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash bf26d0b78d013f526a5f8eb153f9fd56
5cb71ae75ad4a45e482570a02cf919bbc65fa135
c0e0b2ed3e4352d31c1672785a0df72fa809063ac9383643ebb78f0e1486535f
GET /upload/yhde5.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 7984
x-guploader-uploadid: ADPycdvMJOsLLv7YZp9JJ7Nzbri01O_pcyfVMwt6oT7abD5cC4UHwhRI5mQvusf6y2fEqPnzdSm70xVbqv4VGVt-J7o300YKxwpb
expires: Mon, 26 Sep 2022 19:49:03 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "bf26d0b78d013f526a5f8eb153f9fd56"
x-goog-generation: 1657560170814014
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7984
x-goog-hash: crc32c=2hDYJw==, md5=vybQt40BP1JqX46xU/n9Vg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 554
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JZe74xdJsA%2BwQhRoMH4hBgmkpBkbs6zFTD3TEE%2BY3PTqKIhFTCKbB1LXw5YT2DJtFUj%2FQ4XAbVB8k2u2OeKY1%2BrgidnsbzHHy0PVGMAxr9RGFqUjmOpwD%2BjkLI1z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8ea71d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 18582588e03d93bd7c9ceaff8a905b2b
97d1375d8c24b1ede8383e366200ab34ee45cc7d
29279a6462ad80623966af32af0de21c3b07c569d5f38d90876e70abf653acd8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "29279A6462AD80623966AF32AF0DE21C3B07C569D5F38D90876E70ABF653ACD8"
Last-Modified: Mon, 26 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1738
Expires: Mon, 26 Sep 2022 20:57:12 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c7ea09de6e63af53ed131169fd56eb1d
439eefa30aa1e3a5ee21b1981deb39328289c98d
938e772fbea16de4c0976358ff8b7b607dcdb21a3af63220beaa66cc77d89c71
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 18582588e03d93bd7c9ceaff8a905b2b
97d1375d8c24b1ede8383e366200ab34ee45cc7d
29279a6462ad80623966af32af0de21c3b07c569d5f38d90876e70abf653acd8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "29279A6462AD80623966AF32AF0DE21C3B07C569D5F38D90876E70ABF653ACD8"
Last-Modified: Mon, 26 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1738
Expires: Mon, 26 Sep 2022 20:57:12 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
263cdn.com/upload/yhde9.jpg
200 OK 9.2 kB URL HTTP/2 263cdn.com/upload/yhde9.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 011b2ea22f52406af58b64d1665f8452
180974bd7ba0be0bea57119080b3071f9e3b19d9
0681be4c83ebd047dbea1e6df073cf020d407d75fabe8ffcc40bb57ef9a19358
GET /upload/yhde9.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 9205
x-guploader-uploadid: ADPycdvs0YK_rB9cQAHfmCT10X7f703AoIsM5_nQgNFawqca9TnO20W2aLKHwElUxq13Ol0neBD-Joho_9RA7ksxgpb7ww
expires: Mon, 26 Sep 2022 21:08:56 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:52 GMT
etag: "011b2ea22f52406af58b64d1665f8452"
x-goog-generation: 1657560172678807
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 9205
x-goog-hash: crc32c=9Zk+WA==, md5=ARsuoi9SQGr1i2TRZl+EUg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 654
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yi6ZiraBKkGyCQaXpt2Drrtmg6SkGsg3wYOY79njR%2BqS4DIbznqd6YJqTx1nsX75Yfow3bwTENtCo%2B4gUqrAwhExBrL3IRA8IwIGpHJDB72pO5JyKxCkIU79Swpc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8f971d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
200 OK 2.4 kB URL HTTP/2 cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
IP
File type ASCII text, with very long lines (4720), with CRLF line terminators
Hash 82b8500a175504f91fa28f18675bbcb5
9d5039c8e19b2e90581846513af0bde5ef7bf6db
b6327e54f3df25614b2c60e8654bbf31cc2d3cc855a8270c20b8b29f0a8d4fa0
GET /npm/lazyload@2.0.0-rc.2/lazyload.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycduIPxBxn9HV1RvlxQW5n8gWMNt2gH6LJACR5zSppFALBLzrzJxa_8ctHWVRnxFIChP9qRRTmrjDnfJ9VGLfuaiuefHrtsZR
expires: Mon, 26 Sep 2022 19:53:51 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:42:43 GMT
etag: W/"dc6de9813c714ba99733ca4fb5d3a1fa"
x-goog-generation: 1647502963816044
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4798
x-goog-hash: crc32c=lted8w==, md5=3G3pgTxxS6mXM8pPtdOh+g==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3038
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B73FLPryWticcvYp%2BUGU%2FecHsozZZyaV7sPssL8x4d%2FGbMD0gW9Kp%2FXUh6eBA1jYU3phrJ3G8yx6YLTM7MgZoWd2xV8s%2BcIVj%2FYzUN6RWarpX8d6Iu2iAJgs2frMHPkakrI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeacaa81e658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde7.jpg
200 OK 7.2 kB URL HTTP/2 263cdn.com/upload/yhde7.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash e6973ef8b9321ae09803ede73ca9047d
7b93053d922fa89065796614f7183c7baefcb558
7593afdd1a987ff5a18338787f1e75f403739752cf357c4d4f3b32205d9606ac
GET /upload/yhde7.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 7197
x-guploader-uploadid: ADPycdus7Kc4sKChII0BY1iUPjmFEANxkpPzE04pv5Nq__GnTS69Fx58wcfHW23_NNibZmKQ6ivYL_VyW1I8Y7dH-YO1uQ
expires: Mon, 26 Sep 2022 20:33:53 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:51 GMT
etag: "e6973ef8b9321ae09803ede73ca9047d"
x-goog-generation: 1657560171874943
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7197
x-goog-hash: crc32c=LD3HAg==, md5=5pc++LkyGuCYA+3nPKkEfQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3261
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uw3mQ4ZafHpZpIQG%2BCHiu5iCUn3fiCQOm6cQJimS8YO9uFnz7aZFZCB%2BkZjzUmTiCUi5D8PamHhiB8OHw3xzugFsYIJn8R76p1SHRbjWW%2Fvb33RAIQP4dNbrQtR%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8f771d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde4.jpg
200 OK 8.5 kB URL HTTP/2 263cdn.com/upload/yhde4.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 97c0fcc47524398cecf7d89e8854a01c
bef604fbc4381f689b97ae2216acf1ea260f09e1
bb56e2ea161221ac5e4c671d3d124cf5b1e50f64a412960baf51523679f37444
GET /upload/yhde4.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 8521
x-guploader-uploadid: ADPycdt_ozSjN2fKESi70osKTi-xq17s39b1KvmqNz3lSLY3gqfENQAIAVIaSnMyExLv7NICF_ANlViyvScq_yeG_JGsUA
expires: Mon, 26 Sep 2022 19:05:19 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "97c0fcc47524398cecf7d89e8854a01c"
x-goog-generation: 1657560170770744
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8521
x-goog-hash: crc32c=NqkxVw==, md5=l8D8xHUkOYzs99ieiFSgHA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2281
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DjgA0IgxSxjYLHUdTpus%2BAf64mY6wo5CWkhYU5OWpgtxWMAXYCN1awTz24Kp5zerHuNRN%2B2ZTfdDtLPCgdHWKUYtld%2FzznjjPwVTayThvQT9g6JElqHsNbXSRpPz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8ef71d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
200 OK 344 B IP
ASN #20940 Akamai International B.V.
Hash 18582588e03d93bd7c9ceaff8a905b2b
97d1375d8c24b1ede8383e366200ab34ee45cc7d
29279a6462ad80623966af32af0de21c3b07c569d5f38d90876e70abf653acd8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "29279A6462AD80623966AF32AF0DE21C3B07C569D5F38D90876E70ABF653ACD8"
Last-Modified: Mon, 26 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1738
Expires: Mon, 26 Sep 2022 20:57:12 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
263cdn.com/upload/yhde.jpg
200 OK 12 kB URL HTTP/2 263cdn.com/upload/yhde.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash c7401cbdc82cca5689669a88a41608fb
366e93242c88d9fdd3d58f5f3b46a1db75ed8d47
94508fbf165fff7477c232e0a1069f2aa87316b71b0499b1d687021c24142ae0
GET /upload/yhde.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 11716
x-guploader-uploadid: ADPycdtrCXUu3d-5kC44p7A_3XhywiwvgDNsU_Q1PPvqjzgPe0-OYLPaHoUmfmxxPatrrmj8ze8_uDbLlZO_RiFdhRXQ7g
expires: Mon, 26 Sep 2022 19:35:05 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "c7401cbdc82cca5689669a88a41608fb"
x-goog-generation: 1657560169763046
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 11716
x-goog-hash: crc32c=Vi3taA==, md5=x0AcvcgsylaJZpqIpBYI+w==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1282
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j6SY7kD%2Bh5RTOc2CFkn8V2tfp6os6YhcSqK14%2B550a7oBkOzO2mLmBH6R8O9Dqox4oQnEMlOprTexF5cWR49psdnH52RnIFr8zBdxAIQY06I2%2BLdmuoSNxP5YUf0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeadf90971d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/yhde2.jpg
200 OK 7.5 kB URL HTTP/2 263cdn.com/upload/yhde2.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash 1e4cd34e22133192edbfdce16e8ba3a0
0b975b36fee9e81118378e4d7f70860edfe80bd3
8f71eadc0e6e9d3c4e20bdab6122f130199f099c47933a8f9c31856b5c5a0842
GET /upload/yhde2.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 7500
x-guploader-uploadid: ADPycdvXJA2JymEnbnIrNCBRWfSdUIbx5ZpgaHNYrAmqSAEu2EJuOpzSzuaFRF72xSuPb5BMLeC9nUJG0Y2OXwgMKyVRog
expires: Mon, 26 Sep 2022 21:08:38 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:49 GMT
etag: "1e4cd34e22133192edbfdce16e8ba3a0"
x-goog-generation: 1657560169681386
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7500
x-goog-hash: crc32c=UJX5hQ==, md5=HkzTTiITMZLtv9zhboujoA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 937
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sU%2B6VHzhoDtITPTqT6DMGxzQ8%2Bur%2B9fTDvw9Mdb2c9wvaAAG8L0h3IgrS%2F9YEynbfs1acZTjeOKgBB2CVPyyJi5PFT0a1PEn4UVm8QDUE2%2F4PALRrh91oK8Snd52"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae093471d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
200 OK 181 kB URL HTTP/2 1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
IP
File type PNG image data, 497 x 308, 8-bit/color RGBA, non-interlaced\012- data
Size 181 kB (180954 bytes)
Hash fd835c1f326d3e7da0d9839550f66723
5004618bc15011d7d0f569f60f900d076b164b3d
b2286c3ed452ee4eeb15d2044a90cfc456d4789b2fdbe42bb9e023c9da18e4a8
GET /-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_outbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 180954
x-xss-protection: 0
date: Mon, 26 Sep 2022 18:47:31 GMT
expires: Wed, 17 Nov 2021 05:57:49 GMT
cache-control: public, max-age=86400, no-transform
age: 6043
etag: "v632"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
263cdn.com/upload/yhde3.jpg
200 OK 8.4 kB URL HTTP/2 263cdn.com/upload/yhde3.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 290x300, components 3\012- data
Hash d8f2b1db826a85b3d6a77f65c2eb8aa9
f2a5f76ea88f4f374ea2ed63a2d56262746f11b7
ec87a4f107fab84a11b07c51a0c16da260136be7e9312267e9ac53ee1faac9cb
GET /upload/yhde3.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 8391
x-guploader-uploadid: ADPycduWGHoLIReJ2xiY1GVnOQ8Sn9-KO7a6VsLLFXT22xI0vdlIYJE6iIGVGBgqPrwjPpjaqkI118qosrIiLUda8XtWAQ
expires: Mon, 26 Sep 2022 20:36:18 GMT
cache-control: public, max-age=14400
last-modified: Mon, 11 Jul 2022 17:22:50 GMT
etag: "d8f2b1db826a85b3d6a77f65c2eb8aa9"
x-goog-generation: 1657560170668162
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8391
x-goog-hash: crc32c=ow+ZSQ==, md5=2PKx24JqhbPWp39lwuuKqQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2862
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vOTjFyxTkQ9HJuQMGOjUlrJmth4UaSctc2pTKS0oR1OSvg0Ig%2BcZ5FxIIQQzZJWpLKRoXuOd%2FU7E1TkIHdtatJRrHxlWUyVN%2FQvhGh0Lwi6Lsp7A0aTyph26%2BfsC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeade8fb71d5-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
200 OK 14 kB URL HTTP/2 1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
IP
File type PNG image data, 350 x 251, 8-bit colormap, non-interlaced\012- data
Hash ff055162c5d233506eece3fb69a47e74
49812e303ae6674819b6a7a6e0721d555ef64df4
7e46c8bcf219a0d6f0f3d5c5b027ed613678a0c54d637172d6495f428ff80150
GET /-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_inbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 13695
x-xss-protection: 0
date: Mon, 26 Sep 2022 18:47:31 GMT
expires: Mon, 22 Nov 2021 12:23:38 GMT
cache-control: public, max-age=86400, no-transform
age: 6043
etag: "v630"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c939f97c8bcbfea356e92036803714bc
608c795e7c4fb943a4db49a4e4533c41ea717023
b05b38c78c15c259720bfc6783ac65ab60ceb1e6037b45b08113f183554f08cb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdnbun.com/upload/vale-brasil-left.png
200 OK 1.1 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-left.png
IP
File type PNG image data, 36 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 7194d8f3771a6d8566ff203bf81ab061
9d802f302c3b3117f61396830cf48dd1ce43415b
4675c0fea6de78a641b6c74184a16c05bb3ac6257eb7fb3f46e4eb06a286ba4f
GET /upload/vale-brasil-left.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/png
content-length: 1054
x-guploader-uploadid: ADPycduPmk3jjWMUHwPka-Txa81V0cERnf-SloZD1aa4irlMbOcIt7E-kyWHePUdvfyxsniBljzVwn1ksUQOe8kmagD7Gg
x-goog-generation: 1664029762158303
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1054
x-goog-hash: crc32c=0JMaMw==, md5=cZTY83cabYVm/yA7+BqwYQ==
x-goog-storage-class: STANDARD
expires: Mon, 26 Sep 2022 20:53:59 GMT
cache-control: public, max-age=14400
age: 2055
last-modified: Sat, 24 Sep 2022 14:29:22 GMT
etag: "7194d8f3771a6d8566ff203bf81ab061"
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5FSZvgg4TczwHCNgA2ha%2FnA%2B6dEUaiHCiVBspx49czYWsqnIOMLYIZxtSu6ypCg%2BPh%2FbZHUGmmz4h1yQj4qz2sq4ujH%2BFhqlTJCBjJlcs5YGkGGBJtLH2BiA7eZp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae789f0075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e2b0e2a0e4d31967fbe7264b95784031
208ba2485ed3985956e77f478584b404641adb1e
d0237279812199df65ef10bd82c85399f953af39830f6376627e033c3081e7c7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D0237279812199DF65EF10BD82C85399F953AF39830F6376627E033C3081E7C7"
Last-Modified: Sun, 25 Sep 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14620
Expires: Tue, 27 Sep 2022 00:31:54 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: /METK5742rVeBoDsT9a9Ew==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: REDt7hgYOdIMdGhJ9HKNaCQQ9Qs=
e1.o.lencr.org/
200 OK 346 B IP
ASN #20940 Akamai International B.V.
Hash a66f24d2194f85e2ec84375985242859
61090e8b1051346bbdc550bd3cadaa9f15dd18ae
eb9724774a8e0681aaf0be7644b1a433dc6d5dd17701c6317bc0054d898d4f7c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "EB9724774A8E0681AAF0BE7644B1A433DC6D5DD17701C6317BC0054D898D4F7C"
Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10752
Expires: Mon, 26 Sep 2022 23:27:26 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
cdnbun.com/upload/vale-brasil-show.jpg
200 OK 53 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-show.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 520x295, components 3\012- data
Hash 84d1a1f6c76edba9e7c0b023768ef56e
bdfc956a6a48bf9eac6f0c6d796f4218c68460b7
4a999066a9042f2ce8de597882b8ee21dbb156d407129c55fed5a95e9d5238f0
GET /upload/vale-brasil-show.jpg HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 52864
x-guploader-uploadid: ADPycdv_Wbg9T8fXsygmHTYuQnJF_01KCkagguYBMK7Tv5DSkwVLSjqthOSzmq_d1tbaAo2Ks51x-rrVbuzeDTkpM-0fHw
expires: Mon, 26 Sep 2022 21:10:47 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:23 GMT
etag: "84d1a1f6c76edba9e7c0b023768ef56e"
x-goog-generation: 1664029763606243
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 52864
x-goog-hash: crc32c=uYNEsQ==, md5=hNGh9sdu26nnwLAjdo71bg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 705
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t5TJZ5vrvm4b9QqSOqEnACsYrT5b2Mn2HXSQGoAc%2BrFfYV2Q%2F%2BGDdyASp5KaZbiwuTM%2BDs2nvi%2BB2FH58k0nakR%2Br3giNYWOfZOOx5WKxb9rKKYwcHaQcC8HHCfx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae88a00075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 187f62f6b1db33932d9af3d1e29797f3
6b81b3331f8720fe016ffdf3a1f5b63fbc52b8c1
671825d51e8d736f43cf75285a2b7a109b1a5d0e66bc631fdbc746ec0d8a9be1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "671825D51E8D736F43CF75285A2B7A109B1A5D0E66BC631FDBC746EC0D8A9BE1"
Last-Modified: Sat, 24 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3298
Expires: Mon, 26 Sep 2022 21:23:12 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
cdnbun.com/upload/vale-brasil-m.jpg
200 OK 15 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-m.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 404x162, components 3\012- data
Hash 7a31e4814938b694cd3abedd402f22d8
1d49184d66563a7b36b881320a1d1f62cee112b6
b2e651015678741b60f1e6856e945e58d6f0d80a6bcd27825d501472fa46fee6
GET /upload/vale-brasil-m.jpg HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/jpeg
content-length: 15438
x-guploader-uploadid: ADPycdspcWESSjKgnrgBUKvgJWlM1aO6e-vW3SnMwgKZt5d7yzFrGFSgILZDUW6G8MS6se2N4lL0O4fFyTJ4o8wcbHSITw
expires: Mon, 26 Sep 2022 21:16:29 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:22 GMT
etag: "7a31e4814938b694cd3abedd402f22d8"
x-goog-generation: 1664029762130246
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 15438
x-goog-hash: crc32c=0MeHnw==, md5=ejHkgUk4tpTNOr7dQC8i2A==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 705
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IlJ7q4efzZjGrTH%2FMeJJ%2FCGQ%2FuipUumwcQCj9ETN8JQ99b3Z4ILHo1Y%2FjjsGtiwo3y4CU6Sfm8mCbU4zsmXggnQx9geemghGiL4Oi435y%2BtrhI6xTdVW%2BCIhH89s"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae789d0075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/vale-brasil-right.png
200 OK 1.1 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-right.png
IP
File type PNG image data, 36 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 7085925a47dd4d53f516d4443161ba09
0c58afc1bbb8879e871a705439b6692ac280f731
7372cba0728540e333b34609ac39bc7f7f38e6a60468e2b0374cab52d2644489
GET /upload/vale-brasil-right.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/png
content-length: 1054
x-guploader-uploadid: ADPycdtr-l9BL5Go9ZYqB0whxBp7CbfNNzgI08gNqFI3QJd3iIeqwB3gYI7TxcmQtBpm0PI66YJP6XVa-VIRjMRp0WW9Ww
expires: Mon, 26 Sep 2022 21:16:29 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:23 GMT
etag: "7085925a47dd4d53f516d4443161ba09"
x-goog-generation: 1664029763546433
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1054
x-goog-hash: crc32c=1a24rA==, md5=cIWSWkfdTVP1FtREMWG6CQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 705
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tBSTw8xR2giU%2BIvXUljFUhtTBL%2Be6Au0ELZRplbHgzZ64coTWnT6s%2BYkwJ9WRVy%2BSb5iSAC5dglkxpjaZb1N3E5PEkonPbygG2hSDYGBkr9RajRW5ifoq%2BCUmpPE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae88a10075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/vale-brasil-box3.png
200 OK 17 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-box3.png
IP
File type PNG image data, 300 x 216, 8-bit/color RGBA, non-interlaced\012- data
Hash 9c78d8c38d867f3af6ba2aada2488892
4196f46cffcc1356c0e5163314a256e05ccd4727
befc46b441a8649c4040cef1484fb75387f36cf918884082e3a44ce25c78a99b
GET /upload/vale-brasil-box3.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/png
content-length: 17339
x-guploader-uploadid: ADPycdsMt0XdsYEVSsCQuzKFflssJC3EFSM6W9xT5jAgeH6ILo2V0-5F4gOuRwqaz5zITQKmP3NeqNCFxJwXJQY1tLKZYQ
expires: Mon, 26 Sep 2022 21:12:16 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:20 GMT
etag: "9c78d8c38d867f3af6ba2aada2488892"
x-goog-generation: 1664029760744333
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 17339
x-goog-hash: crc32c=h45ooQ==, md5=nHjYw42Gfzr2uiqtokiIkg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 197
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LTKIZaJKCGYTB30vgyFXdGSSFber%2FzLqaluOa6wYD%2BCEFxuniQeW2cMQOJNwS6aYYNphVpCvSbZpJcmGaNvdolNI%2Boqa1BqawUXVeknBTo7waUOazn97b6JhFwHo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae88a30075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/vale-brasil-box2.png
200 OK 8.9 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-box2.png
IP
File type PNG image data, 300 x 216, 8-bit/color RGBA, non-interlaced\012- data
Hash f0053fcccc6f1e0b516965da8d7f66e4
a9da7979e39629caa0b71c8582b3facd0cf02411
6e86f8ef28808bb871e72b3dc2009f0162a6fbe034b6f5532c1bfe2f12b44a87
GET /upload/vale-brasil-box2.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/png
content-length: 8947
x-guploader-uploadid: ADPycdsc1JYNdF-sdTmPqqMWU99pCdRwchxwM9sovKSwfbgxOMrSu01DUUg_m1OlpcrwBFqllki-CGH2MV3WHr3GAvxI9A
expires: Mon, 26 Sep 2022 21:17:12 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:20 GMT
etag: "f0053fcccc6f1e0b516965da8d7f66e4"
x-goog-generation: 1664029760547720
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 8947
x-goog-hash: crc32c=qO2U9Q==, md5=8AU/zMxvHgtRaWXajX9m5A==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 510
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0a3geqXZT3QdXfbySBxG%2F2uhe2OcsAf2JCevQ9qrWoLbCP7OWVr%2Bod9J3BH33qCIO9EvcbKo%2Fo6EL432jnlPiZ1AfAi25ZpGVrI1f3yGCmkeNiM%2BjX9eP5H53Dn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae88a50075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/vale-brasil-box1.png
200 OK 41 kB URL HTTP/2 cdnbun.com/upload/vale-brasil-box1.png
IP
File type PNG image data, 300 x 216, 8-bit/color RGBA, non-interlaced\012- data
Hash 3beb1d23a87797651cad87c79c483fe9
492db347fbcd82d92db6b6be66bb56538c621f86
792aef5162c19ebb144b203cb5a023f0eedcde9f6285ecfe8add5baf7c5086f9
GET /upload/vale-brasil-box1.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: image/png
content-length: 40677
x-guploader-uploadid: ADPycdvMTjYMLgzv7be9Bjg-bXCZHQhjEp5MstA8Jk-MTuhcTYpkGhtuc2wL_hoKunnwgIq7dVj3tQbDLmr1vsxnCPFlBA
expires: Mon, 26 Sep 2022 21:16:07 GMT
cache-control: public, max-age=14400
last-modified: Sat, 24 Sep 2022 14:29:20 GMT
etag: "3beb1d23a87797651cad87c79c483fe9"
x-goog-generation: 1664029760698557
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 40677
x-goog-hash: crc32c=LHJCyg==, md5=O+sdI6h3l2UcrYfHnEg/6Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 727
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8Qf%2BdRpXjZV6xU7hji%2FSxB2Nn7HDJC0xt265FWs%2FzzuTOZed25A5uefZ%2F9uk1dYEIEaPGVda5jESLrcXTOD1Tv7q3Dhq3y%2FNac5JJX4V0HWiRq7624dBPdpMnum"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeae88a20075-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash c7ea09de6e63af53ed131169fd56eb1d
439eefa30aa1e3a5ee21b1981deb39328289c98d
938e772fbea16de4c0976358ff8b7b607dcdb21a3af63220beaa66cc77d89c71
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 26 Sep 2022 20:28:14 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash c37131c966f3ea38094a54a2f65f1bba
751c6e0e90d7512db9dc2b52f6825335a071f004
241111a4f78e3dfea233de10bc52acc34090f4671f056f85ee57417ee79ff8a5
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "241111A4F78E3DFEA233DE10BC52ACC34090F4671F056F85EE57417EE79FF8A5"
Last-Modified: Mon, 26 Sep 2022 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9204
Expires: Mon, 26 Sep 2022 23:01:38 GMT
Date: Mon, 26 Sep 2022 20:28:14 GMT
Connection: keep-alive
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 9b1af319e85f54b9a755ecfaf85196da
ac6e54e209299b1a67f357144baac78279bacd82
0af5fe93ae2a233a011d6d2e006b9f767b971760ae5e5122612ef6513c99b5ec
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:15 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Fri, 30 Sep 2022 19:04:11 GMT
ETag: "ac6e54e209299b1a67f357144baac78279bacd82"
Last-Modified: Mon, 26 Sep 2022 19:04:12 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 213
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750ebeb3badab4e8-OSL
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 9b1af319e85f54b9a755ecfaf85196da
ac6e54e209299b1a67f357144baac78279bacd82
0af5fe93ae2a233a011d6d2e006b9f767b971760ae5e5122612ef6513c99b5ec
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:15 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Fri, 30 Sep 2022 19:04:11 GMT
ETag: "ac6e54e209299b1a67f357144baac78279bacd82"
Last-Modified: Mon, 26 Sep 2022 19:04:12 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 213
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750ebeb3b83ab4f4-OSL
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 9b1af319e85f54b9a755ecfaf85196da
ac6e54e209299b1a67f357144baac78279bacd82
0af5fe93ae2a233a011d6d2e006b9f767b971760ae5e5122612ef6513c99b5ec
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:15 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Fri, 30 Sep 2022 19:04:11 GMT
ETag: "ac6e54e209299b1a67f357144baac78279bacd82"
Last-Modified: Mon, 26 Sep 2022 19:04:12 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 213
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750ebeb3bfe0b4f7-OSL
ocsp.globalsign.com/gsrsaovsslca2018
200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP
Hash 9b1af319e85f54b9a755ecfaf85196da
ac6e54e209299b1a67f357144baac78279bacd82
0af5fe93ae2a233a011d6d2e006b9f767b971760ae5e5122612ef6513c99b5ec
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 20:28:15 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Fri, 30 Sep 2022 19:04:11 GMT
ETag: "ac6e54e209299b1a67f357144baac78279bacd82"
Last-Modified: Mon, 26 Sep 2022 19:04:12 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 213
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750ebeb3b98db523-OSL
region1.google-analytics.com/g/collect?v=2&tid=G-0L8HWYE022>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-0L8HWYE022>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-0L8HWYE022>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://31s84g.cn
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://31s84g.cn
date: Mon, 26 Sep 2022 20:28:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
region1.google-analytics.com/g/collect?v=2&tid=G-LW7434MYMN>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-LW7434MYMN>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-LW7434MYMN>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://31s84g.cn
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 204 No Content
access-control-allow-origin: https://31s84g.cn
date: Mon, 26 Sep 2022 20:28:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
region1.google-analytics.com/g/collect?v=2&tid=G-0C230YDF7G>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-0C230YDF7G>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-0C230YDF7G>m=2oe9l0&_p=1750797474&cid=1299689453.1664224093&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664224092&sct=1&seg=0&dl=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948&dr=http%3A%2F%2Fcompositioncontemplation.cn%2F&dt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A&en=page_view&_fv=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://31s84g.cn
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://31s84g.cn
date: Mon, 26 Sep 2022 20:28:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 639785692dc29802e484e1e1d0ec86c4
cf81784351ce6302f540f491f893b44496809677
0e47d6e33fe9f6e588d308b62fa059c960a000c56651713e30baf6cd09b7de41
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10987
Expires: Mon, 26 Sep 2022 23:31:22 GMT
Date: Mon, 26 Sep 2022 20:28:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 639785692dc29802e484e1e1d0ec86c4
cf81784351ce6302f540f491f893b44496809677
0e47d6e33fe9f6e588d308b62fa059c960a000c56651713e30baf6cd09b7de41
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10987
Expires: Mon, 26 Sep 2022 23:31:22 GMT
Date: Mon, 26 Sep 2022 20:28:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 639785692dc29802e484e1e1d0ec86c4
cf81784351ce6302f540f491f893b44496809677
0e47d6e33fe9f6e588d308b62fa059c960a000c56651713e30baf6cd09b7de41
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10987
Expires: Mon, 26 Sep 2022 23:31:22 GMT
Date: Mon, 26 Sep 2022 20:28:15 GMT
Connection: keep-alive
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
200 OK 34 kB URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
IP
File type ASCII text, with very long lines (65321), with CRLF line terminators
Hash e027d54bcec779036e0070b3c75adbb8
980e1aa0126bd98f682481249e3cd0cf5fde6872
ac2f9bc295c3304dbdba3e941d4a358c00df1ea7ed5de4087ea7b4337b0aa6b4
GET /npm/bootstrap@4.6.0/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/css
x-guploader-uploadid: ADPycdu1gxpiPS08v65ejSyWJ6gtfHZpcsepSs3IWtEOIkbdCNyOtcM2ty9EePRH4AYvdz3ej4P_RYV58hFL7Ow21tI
expires: Mon, 26 Sep 2022 19:23:53 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:38:12 GMT
etag: W/"feba0d0760607b9e21393156949afcd9"
x-goog-generation: 1647502692716912
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 161415
x-goog-hash: crc32c=Sb/HMQ==, md5=/roNB2Bge54hOTFWlJr82Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3557
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n4VX42euWy4E7fJbzlRIuUJ0LeTQNZ3l4EFyGh%2BNESM5VWXuPu4Ekw3%2BPxEJmfovZh3CNqDjcq8WhcmCTBVAp2dAe%2Fr9dcSv92mc1XfZGsrdsPZIgyfTGG22UGY3zf0xKaQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeacaa8ae658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bonepa.com/js/responsive.js
200 OK 7.4 kB URL HTTP/2 bonepa.com/js/responsive.js
IP
ASN #201702 skHosting.eu s.r.o.
Hash 37854fc50c37dd60128e0cdf8a17a5c7
0de95df057e9d31ec6015f064bc9f568e4e9698b
fe36bc775d82b7e7b05f9bcf63d5ce9f045b2171d97027cfc521902d7d49def0
GET /js/responsive.js HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: application/javascript
last-modified: Tue, 20 Sep 2022 17:57:57 GMT
etag: W/"6329ff25-cd3"
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7838a122-2b2e-4e4c-9bcc-7c6b46a93b1e.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7838a122-2b2e-4e4c-9bcc-7c6b46a93b1e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 968b9c138702fb5994d1d9eab1a697fa
9660bb2d38079182efbd11d7a687bfc7f9d30751
5ba74820ad451747c8ed25529f06b037bebf4c0616a1f2165c9197c1171db7a6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7838a122-2b2e-4e4c-9bcc-7c6b46a93b1e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11728
x-amzn-requestid: bf60e58f-c4f4-45c7-923b-0d1539f720f5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZCUCGGw7oAMF3wQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6330cd40-32043c1b1411544f5d00edc0;Sampled=0
x-amzn-remapped-date: Sun, 25 Sep 2022 21:50:56 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ZRG0Axnhc5RY5rDbnnbauco9dpPeFdkP01UxkpNYI5pgSbfGKWcikw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 22:16:26 GMT
age: 79909
etag: "9660bb2d38079182efbd11d7a687bfc7f9d30751"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febd85aa2-fe15-49c2-aa3e-38b97cb99849.jpeg
200 OK 5.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febd85aa2-fe15-49c2-aa3e-38b97cb99849.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2fe8c4f0c70fb6c1f4259eabedc7015e
85e378d0fff856832a8dd01743516b9476fed8c6
508a1c7d350fcf82d1ece0b99f8557b2f300c7c1148f28c3ae9fece20530e4b6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febd85aa2-fe15-49c2-aa3e-38b97cb99849.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5157
x-amzn-requestid: b5748f49-693f-4bc3-a850-cb68e770de24
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZCUG9GUHIAMF7pw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6330cd5f-5d2aaa212cf1be2506593746;Sampled=0
x-amzn-remapped-date: Sun, 25 Sep 2022 21:51:27 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 4h9lb_7egxb2hBbxjcS_cpZ5lDq6Lx-c_WUZyRHdUA0YTwr6kgDuiQ==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 22:10:16 GMT
age: 80279
etag: "85e378d0fff856832a8dd01743516b9476fed8c6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3689ec8-63b4-42ae-b7d5-a9b4b63af788.jpeg
200 OK 6.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3689ec8-63b4-42ae-b7d5-a9b4b63af788.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ef17205adb2b478d3bff54b048208d22
12aac1bd22e675f09a220de08b4656e801c2e647
620fe39cf421ed3a21e968570f7e863d69224113be867ec2457ed3850ea113f6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff3689ec8-63b4-42ae-b7d5-a9b4b63af788.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5980
x-amzn-requestid: fbf0c390-da24-49e2-8492-43e29e5d4bb3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZCTHCGJVoAMFgxA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6330cbc6-1f9b1b7d63467c58702e6d7e;Sampled=0
x-amzn-remapped-date: Sun, 25 Sep 2022 21:44:38 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: pt7rJi8EIQFBk0gHQZ1WnjvThPba86XZCGFs83l1ZW2dj-_6bZprAA==
via: 1.1 ec2a2c75c16156e4d43504606c118b90.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 25 Sep 2022 21:49:56 GMT
age: 81499
etag: "12aac1bd22e675f09a220de08b4656e801c2e647"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
200 OK 13 kB URL HTTP/2 uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
IP
ASN #201702 skHosting.eu s.r.o.
Hash 797b7f37981c1d6ca12d31d0ca786572
1159f930826a2b0e876f9bd9f68da7a7e320937a
3833b88dc29217197d1c8e5ac050b6b990985f4ee241c101a35792b604e8ffc6
GET /bnr.php?section=General&pub=593174&format=300x50&ga=g HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: application/javascript
expires: Mon, 26 Sep 2022 20:28:14 GMT
last-modified: Mon, 26 Sep 2022 20:28:14 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
hm.baidu.com/hm.js?62e2da9e7a345a0e9f507fc38de123de
200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?62e2da9e7a345a0e9f507fc38de123de
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (674)
Hash fb06bec409e040adb26c1141b075d1cb
e5ecec159a32a0739c6718af356482340884298e
e0901a755f9c206ef88dc8c9866bec78aa32b275845348d029f7eafcb3308ab3
GET /hm.js?62e2da9e7a345a0e9f507fc38de123de HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11387
Content-Type: application/javascript
Date: Mon, 26 Sep 2022 20:28:15 GMT
Etag: fc65eaf885d8b7443f4fef86afbe8c93
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=E7A40984C6216FB0; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (665)
Hash 6ff7737a8a1375c79314a4eef0bd7a32
0291baa105bd994136ba37805e0bd7def9659db6
d95448a875441e0f2438d64c8c5a99d2ddfe928eef3bfcbf031a259ddfabef04
GET /hm.js?b521817f22507716e364b3fe28644f8b HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11378
Content-Type: application/javascript
Date: Mon, 26 Sep 2022 20:28:15 GMT
Etag: 8c6f065ea4fb6dee1c468e06b680291f
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=029BD97323D6132F; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?ba99808308e7272d58c43367a11d1204
200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?ba99808308e7272d58c43367a11d1204
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (637)
Hash 69a1392f181d49ca543216a29d43e3fc
8e194d2f3adbd0566afc34e23f5605a73798e77b
7f2eb934593621826b044d7c3e14fd5fc5f3676943928c9dea38b829cfc3a5a9
GET /hm.js?ba99808308e7272d58c43367a11d1204 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11350
Content-Type: application/javascript
Date: Mon, 26 Sep 2022 20:28:15 GMT
Etag: c6b5ed82d07f02dabd734fb856d7ab9a
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=4103E86F671B1E7E; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?8b68846a3ac1709b0ec7199084ee5ea8
200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?8b68846a3ac1709b0ec7199084ee5ea8
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (628)
Hash fdff91b51b3110f6ef7185cd682b2348
4d785f962a4c84dcb0b49b6a89fc8f094673ac65
9af0e0ee7590e817e630d37ef47f661945647c9c26f8dbabd572eb90bac596ba
GET /hm.js?8b68846a3ac1709b0ec7199084ee5ea8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11341
Content-Type: application/javascript
Date: Mon, 26 Sep 2022 20:28:15 GMT
Etag: 86847e8147b4ee631523b55c62c6d0bf
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=F689AF0EEB9DC556; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=331114548&si=62e2da9e7a345a0e9f507fc38de123de&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28304&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=331114548&si=62e2da9e7a345a0e9f507fc38de123de&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28304&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=331114548&si=62e2da9e7a345a0e9f507fc38de123de&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28304&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Mon, 26 Sep 2022 20:28:16 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=2E5B738B903B111D; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1043431956&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1043431956&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1043431956&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Mon, 26 Sep 2022 20:28:16 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=53A79713B79A3BBD; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1054116448&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1054116448&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1054116448&si=ba99808308e7272d58c43367a11d1204&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Mon, 26 Sep 2022 20:28:16 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=4C90A97D18F34A0E; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=375794753&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=375794753&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=375794753&si=8b68846a3ac1709b0ec7199084ee5ea8&su=http%3A%2F%2Fcompositioncontemplation.cn%2F&v=1.2.97&lv=1&sn=28305&r=0&ww=1280&ct=!!&u=https%3A%2F%2F31s84g.cn%2FZ0NMheBY%2Fvale-brasil%2F%3F_t%3D1664224091948%231664224093222&tt=%F0%9F%8E%89%E2%9B%8F%EF%B8%8F%EF%B8%8FVale%2080th%20Anniversary%20Mining%20Safety%20Subsidy%F0%9F%8F%AD%EF%B8%8F%EF%B8%8F%F0%9F%8E%8A HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Mon, 26 Sep 2022 20:28:16 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=EEE0497B2F818484; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP
GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycduvncBLA0gxm2jhB0xBiFcB9ljkEJNPjkQtZv47AnL5fPX0bMXS2cf5SLGxbSyGNf7QQBvdtKZagx9cccWcvqeCNqbuvQ
expires: Mon, 26 Sep 2022 21:27:55 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:44:44 GMT
etag: W/"31c898c6d2ea13c30441657ff1900d81"
x-goog-generation: 1647503084523089
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 21236
x-goog-hash: crc32c=7cW0Gg==, md5=MciYxtLqE8MEQWV/8ZANgQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 19
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J9FphXtKBblvuZlf%2FFDEBwMMWdveWQUXaJTUOfKQ7IhVPq8IjFJdpySp7iAhPEEHO6hF4T4XoMlP60ab4Yaepj4tyrd%2BghyBmo2ziqW%2BjJV8KkIj1nzKDUHhL6Hn%2FMFYoZY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeacaa84e658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166422409479934&xtt=4333295
200 OK 0 B URL HTTP/2 uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166422409479934&xtt=4333295
IP
ASN #201702 skHosting.eu s.r.o.
GET /bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=166422409479934&xtt=4333295 HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/html; charset=UTF-8
expires: Mon, 26 Sep 2022 20:28:14 GMT
last-modified: Mon, 26 Sep 2022 20:28:14 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
31s84g.cn/Z0NMheBY/vale-brasil/?_t=1664224091948
200 OK 0 B URL HTTP/2 31s84g.cn/Z0NMheBY/vale-brasil/?_t=1664224091948
IP
Analyzer Verdict Alert fortinet Phishing
GET /Z0NMheBY/vale-brasil/?_t=1664224091948 HTTP/1.1
Host: 31s84g.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://compositioncontemplation.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:13 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: vale-brasil-tthh1=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.31s84g.cn
vale-brasil-tthh2=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.31s84g.cn
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ip6kodAwAspPoqAeWZzLMlosb%2BWZ6hTXQOZpD5aNaEIXCSF4je%2B5LrjDTE2djx8EOe%2BVE3dUXzPrKOYOS3ijJWYpFbDF%2BoXW5%2Bi4GQjn3eDYwDTfHGRboABTXVE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 750ebeaada96b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
IP
GET /npm/bootstrap@4.6.0/dist/js/bootstrap.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdtaXO8Pt4mYxS4tkg36SiMjVR6jjL7hB9EkK5aPNXJ0rrhhBXOw5gRmhJXZ1IYlvDk2NYpvsCE76nxT_QCLJq2KEg
x-goog-generation: 1647502614200576
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 63473
x-goog-hash: crc32c=x2l+AA==, md5=yZIw0ldTgNf5X/YmYG0kJg==
x-goog-storage-class: STANDARD
expires: Mon, 26 Sep 2022 19:53:51 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:36:54 GMT
etag: W/"c99230d2575380d7f95ff626606d2426"
cf-cache-status: HIT
age: 2370
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sVk1FGT%2BxZpud6w%2BEOjTVXN8AUrKNBhWn3xENmmMHXhrlH0Lk3sdSbAH4lWdFzz37qLSpkMJpoDm%2FyM%2FIA3DBrFg5zE4aMAV3pZCTVIFb3UugHtklagikRjQJxaY0DFyykQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeacaa87e658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/sr.css
200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/sr.css
IP
GET /npm/bootstrap@4.6.0/dist/css/sr.css HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 26 Sep 2022 20:28:14 GMT
content-type: text/css
x-guploader-uploadid: ADPycdttiiwhLzsk4vWcdrey5O1ipd9BLjvinz-rVR-7Qh9A2cNZYaXFNISaN1dlbiUJVf7lZtfEuV-HAAQooLwTMEs8pv3Bfem1
expires: Mon, 26 Sep 2022 20:29:09 GMT
cache-control: public, max-age=3600
last-modified: Fri, 22 Apr 2022 09:51:08 GMT
etag: W/"75710b7c7ae0013c5cda99a0053ec3d9"
x-goog-generation: 1650621068399108
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 20647
x-goog-hash: crc32c=3qMyMQ==, md5=dXELfHrgATxc2pmgBT7D2Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 318
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tdhfTgO8Recgo9IXkePMSNXind6bk%2FqAsbcb9Ww5k49UUz%2BARDGNq29IkT6xiQnk%2B6VUzFQfgG2ib%2FUDStC1iWMzmznEwDlFSwQKQoMouTYrwCtcvNJ60lrNpzRy8amXyGE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 750ebeac9a71e658-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&randomA=0_4369&maxw=0
200 OK 0 B URL HTTP/2 bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&randomA=0_4369&maxw=0
IP
ASN #201702 skHosting.eu s.r.o.
GET /4fe48aebd6/4f59451604/?placementName=Pop&randomA=0_4369&maxw=0 HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://31s84g.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 26 Sep 2022 20:28:17 GMT
content-type: text/html; charset=UTF-8
set-cookie: shown1=0; expires=Tue, 27-Sep-2022 20:28:17 GMT; Max-Age=86400; secure; SameSite=None
used_ad2633299=1; expires=Tue, 27-Sep-2022 03:59:59 GMT; Max-Age=27102; path=/; secure; SameSite=None
total_impressions=1; expires=Tue, 27-Sep-2022 03:59:59 GMT; Max-Age=27102; secure; SameSite=None
used_c_51856=1; expires=Tue, 27-Sep-2022 20:28:17 GMT; Max-Age=86400; path=/; secure; SameSite=None
expires: Sun, 01 Jan 2014 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex,nofollow
access-control-allow-origin: *
content-encoding: br
X-Firefox-Spdy: h2
172.67.161.51
23.36.77.32
185.66.200.220
104.21.82.177
93.184.220.29
103.235.46.191