| yts.woxikon.co.nz/felic-gamez-garcia/0lraf7JedJI |  104.21.81.72 | 301 Moved Permanently | 0 B |
URL HTTP/1.1yts.woxikon.co.nz/felic-gamez-garcia/0lraf7JedJI IP104.21.81.72:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /felic-gamez-garcia/0lraf7JedJI HTTP/1.1
Host: yts.woxikon.co.nz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Mon, 24 Oct 2022 22:55:56 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 24 Oct 2022 23:55:56 GMT
Location: https://yts.woxikon.co.nz/felic-gamez-garcia/0lraf7JedJI
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y7PuKUKffmjTzqDVhe4LID35OUlzF%2BYVrFg9C8DzLAfHnhHaET5o%2Fh57Rs9%2Fk8Od%2F5eT7ExlWFnrCxBgPVubC6heppMcWz2hqGzmtYPbOSeQT6TeU63tihNWWtwtoteU1y409w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75f64d8a68f7b511-OSL
alt-svc: h2=":443"; ma=60
|
|
| firefox.settings.services.mozilla.com/v1/ |  143.204.55.115 | 200 OK | 939 B |
URL HTTP/1.1firefox.settings.services.mozilla.com/v1/ IP143.204.55.115:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hashcd8d0809aa5948f2a6ee41d2158861af 098cd24ac587cdc70137af412678526de4d43969 88e6741d6bf076bf7132c7cf98456702cc775476095aafd839888edff52fb03e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Backoff, Alert, Retry-After, Content-Length, Content-Type
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 24 Oct 2022 22:53:04 GMT
Expires: Mon, 24 Oct 2022 23:09:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 142be88a35733307a5e7de05da0a20b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 3oL3nmUfs550HBB1OCBdinMnDzvjMVzChU_YpGL8Nk0TUTx8E5Ok5w==
Age: 172
|
|
| r3.o.lencr.org/ |  23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash73c4166ca864f777db2cc1cd8658a7c2 c56b66b0b7c8516d4d5bfafe0c166711c78f3d25 310c633350812c064e159275b6dbbdba6d6a5991a54ccfcc23459320c6513572
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "310C633350812C064E159275B6DBBDBA6D6A5991A54CCFCC23459320C6513572"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9925
Expires: Tue, 25 Oct 2022 01:41:21 GMT
Date: Mon, 24 Oct 2022 22:55:56 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashae56efd62a0d9249d98573172eb8b28b 5ff4e9959be677ad76c26ca73f9ef4feb9fa2f28 82d9ee4948fce839f7edb1f8490c4213cded3912464a4169b0bf6a61278694bd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "82D9EE4948FCE839F7EDB1F8490C4213CDED3912464A4169B0BF6A61278694BD"
Last-Modified: Sat, 22 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8773
Expires: Tue, 25 Oct 2022 01:22:09 GMT
Date: Mon, 24 Oct 2022 22:55:56 GMT
Connection: keep-alive
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash67d5a988edcda47bc3b3b3f65d32b4b6 d4f0e0da8b3690cc7da925026d3414b68c7d954f 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: zMDcSEUX9tND6naqRsniaJsFRXuFDngPY4VOXZy2B8km0nRMCyNRL79th00lJnXBgLR6zlpfg6I=
x-amz-request-id: GKF3WZ1ZC5T274DJ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 24 Oct 2022 22:38:33 GMT
age: 1043
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 24 Oct 2022 22:55:56 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/s/gts1p5/HMG6pyzx4_Y | 142.250.74.35 | 200 OK | 472 B |
URL HTTP/1.1ocsp.pki.goog/s/gts1p5/HMG6pyzx4_Y IP142.250.74.35:0
Hash682f59802491d9dfce368c620424feb5 f7d0e8869bd9fd11a80bbc164e2ca1258a0bdfc5 e44c89418d74efc6aebaed6ff6dadc08712a43f2aa00fa3bd965a3d07239a634
POST /s/gts1p5/HMG6pyzx4_Y HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:56 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/s/gts1p5/HMG6pyzx4_Y | 142.250.74.35 | 200 OK | 472 B |
URL HTTP/1.1ocsp.pki.goog/s/gts1p5/HMG6pyzx4_Y IP142.250.74.35:0
Hash682f59802491d9dfce368c620424feb5 f7d0e8869bd9fd11a80bbc164e2ca1258a0bdfc5 e44c89418d74efc6aebaed6ff6dadc08712a43f2aa00fa3bd965a3d07239a634
POST /s/gts1p5/HMG6pyzx4_Y HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:57 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 143.204.55.115 | 200 OK | 329 B |
URL HTTP/1.1firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP143.204.55.115:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600
Date: Mon, 24 Oct 2022 22:33:32 GMT
Expires: Mon, 24 Oct 2022 22:58:55 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: n9fkbl6GJZ2LzQStkJT4iNYXbaFYjPgYAied2jugWcuCasq0_3QjXQ==
Age: 1345
|
|
| ocsp.digicert.com/ |  93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hash7c6fdc8e76ef5875b5c965ade2df503e 45d548aa2a9d7ede163743274790700878eaea62 d2ff6eacd48af4892a2642e5d7bb925ca683062139f5a5cb4047f6f706830618
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6526
Cache-Control: max-age=125974
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:57 GMT
Etag: "63564795-1d7"
Expires: Wed, 26 Oct 2022 09:55:31 GMT
Last-Modified: Mon, 24 Oct 2022 08:06:45 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471
|
|
| push.services.mozilla.com/ | 44.240.207.158 | 101 Switching Protocols | 0 B |
URL HTTP/1.1push.services.mozilla.com/ IP44.240.207.158:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: wiUkFTWkSo4/NMhQ8QKYbw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Jv572KCITy0yHXzHyS0+zbX2qrU=
|
|
| yts.woxikon.co.nz/felic-gamez-garcia/0lraf7JedJI | 104.21.81.72 | 302 Found | 18 kB |
URL HTTP/2yts.woxikon.co.nz/felic-gamez-garcia/0lraf7JedJI IP104.21.81.72:0
File typegzip compressed data, from Unix\012- data Hashfb559a3ec5aa9e1b8fb9d63c0b9300c8 72635458f00a2b03ceb539543cad8cdc513cb092 f5b62d3b05e47536797ed803c2efc05eb5f6cb63fd7bc83e80064c70b172be83
GET /felic-gamez-garcia/0lraf7JedJI HTTP/1.1
Host: yts.woxikon.co.nz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
date: Mon, 24 Oct 2022 22:55:57 GMT
content-type: text/html; charset=UTF-8
location: https://yts1.us/felic-gamez-garcia/0lraf7JedJI
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tPlLQCRrSc0Zxtd2OqQq5qj35pCVV%2F%2Fb1NLxZr0DJqnNJkmMLLzAqLqLT89dLzpwloJe3INhen%2BsB%2FTsWEXkbxgonXLZWDxqmKSH%2Bn3A%2B5yHssj%2BeWd3XWnhSrRqgBO6cP8UdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 75f64d8cae14b4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg | 192.0.77.2 | 302 Found | 138 B |
URL HTTP/2i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg IP192.0.77.2:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg HTTP/1.1
Host: i1.wp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Mon, 24 Oct 2022 22:55:58 GMT
content-type: text/html
content-length: 138
location: https://ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg
x-nc: EXPIRED arn 5
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg | 192.0.77.2 | 302 Found | 138 B |
URL HTTP/2i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg IP192.0.77.2:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg HTTP/1.1
Host: i1.wp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Mon, 24 Oct 2022 22:55:58 GMT
content-type: text/html
content-length: 138
location: https://ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg
x-nc: EXPIRED arn 7
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg | 192.0.77.2 | 302 Found | 138 B |
URL HTTP/2i1.wp.com/ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg IP192.0.77.2:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg HTTP/1.1
Host: i1.wp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Mon, 24 Oct 2022 22:55:58 GMT
content-type: text/html
content-length: 138
location: https://ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg
x-nc: EXPIRED arn 6
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| yts1.us/images/load.gif |  157.245.201.11 | 200 OK | 980 B |
IP157.245.201.11:0 ASN#14061 DIGITALOCEAN-ASN
File typeGIF image data, version 89a, 79 x 44\012- data Hash9c64a4a00c86435f9713759258de77d9 c0e6a61e4791caa24f8792152bac0288fcbc8105 06cfdd55f8feef3584ea60f16d6146fc73f5666c987b48da481e2457ba975760
GET /images/load.gif HTTP/1.1
Host: yts1.us
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/felic-gamez-garcia/0lraf7JedJI
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Mon, 31 Oct 2022 22:55:58 GMT
etag: "3d4-632ed522-56a042;;;"
last-modified: Sat, 24 Sep 2022 10:00:02 GMT
content-type: image/gif
content-length: 980
accept-ranges: bytes
date: Mon, 24 Oct 2022 22:55:58 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashc3746c19860d7b11d243d955632fd7dd aba31742e95e267d47c13bd1b31b73aa1003a5fb 6dac16bc75dd00919200997eb6ffc362b76bf22a246df768e58d3c053e81a105
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6DAC16BC75DD00919200997EB6FFC362B76BF22A246DF768E58D3C053E81A105"
Last-Modified: Sat, 22 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15777
Expires: Tue, 25 Oct 2022 03:18:55 GMT
Date: Mon, 24 Oct 2022 22:55:58 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash398e3c90084d7d71fc1e9fd833116f5f 3e202da5559a8f219144adee3639d063a98559c0 724547db3ed9f1779308e9dd6604664e6ffa3580ca076fbdc1dfb1b75591bba4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "724547DB3ED9F1779308E9DD6604664E6FFA3580CA076FBDC1DFB1B75591BBA4"
Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14361
Expires: Tue, 25 Oct 2022 02:55:19 GMT
Date: Mon, 24 Oct 2022 22:55:58 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash398e3c90084d7d71fc1e9fd833116f5f 3e202da5559a8f219144adee3639d063a98559c0 724547db3ed9f1779308e9dd6604664e6ffa3580ca076fbdc1dfb1b75591bba4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "724547DB3ED9F1779308E9DD6604664E6FFA3580CA076FBDC1DFB1B75591BBA4"
Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14361
Expires: Tue, 25 Oct 2022 02:55:19 GMT
Date: Mon, 24 Oct 2022 22:55:58 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash398e3c90084d7d71fc1e9fd833116f5f 3e202da5559a8f219144adee3639d063a98559c0 724547db3ed9f1779308e9dd6604664e6ffa3580ca076fbdc1dfb1b75591bba4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "724547DB3ED9F1779308E9DD6604664E6FFA3580CA076FBDC1DFB1B75591BBA4"
Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14361
Expires: Tue, 25 Oct 2022 02:55:19 GMT
Date: Mon, 24 Oct 2022 22:55:58 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash398e3c90084d7d71fc1e9fd833116f5f 3e202da5559a8f219144adee3639d063a98559c0 724547db3ed9f1779308e9dd6604664e6ffa3580ca076fbdc1dfb1b75591bba4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "724547DB3ED9F1779308E9DD6604664E6FFA3580CA076FBDC1DFB1B75591BBA4"
Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14361
Expires: Tue, 25 Oct 2022 02:55:19 GMT
Date: Mon, 24 Oct 2022 22:55:58 GMT
Connection: keep-alive
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facb7f3ea-1b51-4cac-a5ab-7201a12df641.jpeg | 34.120.237.76 | 200 OK | 8.7 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facb7f3ea-1b51-4cac-a5ab-7201a12df641.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash8502c90bf679dce29b1c2a87606bbb3e 7940c911dea3882ab8a7ff70240f4edc1b89a56d ccc5ab3068b7f90276124148a812eb26951a95d7c146bdcf28a69a3d05f76ee2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facb7f3ea-1b51-4cac-a5ab-7201a12df641.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8735
x-amzn-requestid: 51dfaabc-ee88-465f-8da7-fd6739cf7794
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aZSHjHeLIAMF8mQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635396fc-1e4ad2d647a7f07a094574be;Sampled=0
x-amzn-remapped-date: Sat, 22 Oct 2022 07:08:44 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: dgxcF8hXUOo_WqQwpd0yctMNPuB-IfmSRxD1_TRG7zuV3b5EbpVIig==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 91356d2137f5a7345e93da4516c49ec4.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 07:48:43 GMT
age: 54435
etag: "7940c911dea3882ab8a7ff70240f4edc1b89a56d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5d616770-e793-4da0-8ebe-826e806ececd.jpeg | 34.120.237.76 | 200 OK | 9.2 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5d616770-e793-4da0-8ebe-826e806ececd.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash89448f1a52030b28e9ecfcdc190787d4 5080ba75c230fd2b303f29a9b64868c6e8771df8 10a736997d441e274a54e9689c349d407087fef7aa7c0f4d0a7a603e446fdabd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5d616770-e793-4da0-8ebe-826e806ececd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9209
x-amzn-requestid: 94dad7b4-9c12-4bda-9202-3b7427185182
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aLiElGzEIAMFnOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634e16e9-3c79cd392d5bc4312a730cda;Sampled=0
x-amzn-remapped-date: Tue, 18 Oct 2022 03:00:57 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: c5_B2RXKJx7FHrQvHdCG50zcDFWUqaaZu0GYuCxEI8fpK019dSlD3Q==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 13:16:16 GMT
age: 34782
etag: "5080ba75c230fd2b303f29a9b64868c6e8771df8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9ac739ea-5d5d-4900-8e3f-c815c25f5c8d.png | 34.120.237.76 | 200 OK | 12 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9ac739ea-5d5d-4900-8e3f-c815c25f5c8d.png IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash1f22a424f72f369a3511d6af25d67a82 e9aabd2daee2d2e6265a69e309542c5b5983d1f2 600f1a4989fe65b14cfe5234c8bc723834d53543026c13eaf8217b22d3a3a9a9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9ac739ea-5d5d-4900-8e3f-c815c25f5c8d.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11916
x-amzn-requestid: 319eaac6-dfda-4a48-ae9a-612650705bd6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: afdKuHK6IAMFnXA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63560f11-61545bf1110795c0299b85f4;Sampled=0
x-amzn-remapped-date: Mon, 24 Oct 2022 04:05:37 GMT
x-amz-cf-pop: SFO53-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: wrxksbQXK96TvYk2rEf5biIaLtjbB1ia0FpYxnd908Dd_MkKQSRCtQ==
via: 1.1 0da7848263e39308b12bac6a925793b0.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 15:02:35 GMT
etag: "e9aabd2daee2d2e6265a69e309542c5b5983d1f2"
content-type: image/jpeg
age: 28403
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf8cfe72-ca76-42ae-a95f-b33a2edb91b3.jpeg | 34.120.237.76 | 200 OK | 8.0 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf8cfe72-ca76-42ae-a95f-b33a2edb91b3.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash80bab61eeda285e378b86b3efc4f87f9 5c690531e195332c04092ce22e7bdcecccc3c9d5 0c4dec046835501b598b5165acd592c3baeb2d6e21b6ac5fd549e790a802cd02
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf8cfe72-ca76-42ae-a95f-b33a2edb91b3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7977
x-amzn-requestid: 3e217877-33a2-4efc-a21f-b75764a8ced9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ah3FWGRooAMFagw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63570555-2bc77cb653ef022b4aab7f71;Sampled=0
x-amzn-remapped-date: Mon, 24 Oct 2022 21:36:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: CWRIYnB8Zcc-9L-EdFq_ahTPlv8AMqnBGlZmRTN-0BsZIUWF3eUOfg==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 21:37:08 GMT
age: 4730
etag: "5c690531e195332c04092ce22e7bdcecccc3c9d5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33fda234-9118-4b4b-86d9-02c36810eda5.jpeg | 34.120.237.76 | 200 OK | 12 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33fda234-9118-4b4b-86d9-02c36810eda5.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashb949df0edd9d64aa962e3bf4b267889e 3ef04f8c638dddf8bb8b70aae74770892307c814 e6c42bdd84bc9661c25a201599c29257b843d86d638ec479e7b5fa7bf81bc961
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33fda234-9118-4b4b-86d9-02c36810eda5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11622
x-amzn-requestid: 2d6c3eb8-6a67-40bb-b970-a92caf783a4f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aYPSZFWpoAMFU1g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63532c0f-14a2cd9f68bda5a01a765a2d;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 23:32:31 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: _AwDcPb8X7mPlOseeJZxw4kaQsR4d_HDyqEUM7I4RfurX2iDap87YA==
via: 1.1 7514e5e25722778fd4b1744d4ecc67e0.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 03:36:20 GMT
age: 69578
etag: "3ef04f8c638dddf8bb8b70aae74770892307c814"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f505e74-07f3-4154-bfa4-5dfc184b8262.jpeg | 34.120.237.76 | 200 OK | 7.4 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f505e74-07f3-4154-bfa4-5dfc184b8262.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash01dacddfb62128799a20e0541bf5a18c 1bb8047c270b76c9dfcd8dba4a63b25c7604f03d 65f5c51b84ff7a131a3a695142ae9d82a73a516792abdd2d137714a1a3cf3bb5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f505e74-07f3-4154-bfa4-5dfc184b8262.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7361
x-amzn-requestid: 33e339c8-c7e8-439d-a593-d7e19bd3b3eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aYvRkGGIIAMFdYw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63535f3d-7cbcf593571aa2df6a97f077;Sampled=0
x-amzn-remapped-date: Sat, 22 Oct 2022 03:10:53 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 0iPBD-KhZZI_L24QKVStukb8MwWC7Q2AzSOfwnV--BxOreqD4e9Kfw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Mon, 24 Oct 2022 05:43:46 GMT
age: 61932
etag: "1bb8047c270b76c9dfcd8dba4a63b25c7604f03d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27018), with no line terminators Hashfceee8a447e2bbe38007afb2d51fa7ac 480a35a2fdf75782b21a850af6116a1ba795c6d9 a53932e4174c066386d6f67f8420c1a959f4d786930edf43dd61140d5d7b954d
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:58 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: bcef33db34ff2e4f8fe0914af58b1365
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27010), with no line terminators Hash95d65f0327f4da0a134e58bf01f259f2 15e5325b2b7bd8cd80561291a9a196b46b93d7d5 bb4ca2fcbc3781c98ea713ad6e254deea80e31e19ed8c64b970f685ac6d4af88
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 688eb5d794d846332958ad39df39238f
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.sca1b.amazontrust.com/ | 143.204.42.158 | 200 OK | 471 B |
URL HTTP/1.1ocsp.sca1b.amazontrust.com/ IP143.204.42.158:0
Hashbdc512cc94fbd0212bcf18b9a7fac82d 23d54ba9a701f43629e4a1cd64da839178be40b2 e5d5362490f1f152087e524e4d838a988a87e7b63312f07c074fb80d0dd0aaa2
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=141556
Date: Mon, 24 Oct 2022 22:55:59 GMT
Etag: "63568581-1d7"
Expires: Wed, 26 Oct 2022 14:15:15 GMT
Last-Modified: Mon, 24 Oct 2022 12:30:57 GMT
Server: ECS (nyb/1D1E)
X-Cache: Miss from cloudfront
Via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: UXIY9Q-nU05HgupPF4LFtNkhvI7T991CFReVlcCH2f67IyggdKyS5Q==
Age: 6258
|
|
| simplewebanalysis.com/stats |  3.74.98.52 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP3.74.98.52:0
File typeASCII text, with no line terminators Hash778398fa1b8d077c9afed175c91cc768 833e836ac36e8ea92b2dee76e5bfcc583f8afc90 bb1e07a321dc8b69a4130104d78ddefd28814afc054337b93b23bb376a47fcb2
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:55:59 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://yts1.us
access-control-allow-credentials: true
set-cookie: uid_id2=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5:3:1; expires=Thu, 21 Oct 2032 22:55:59 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| simplewebanalysis.com/stats | 3.74.98.52 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP3.74.98.52:0
File typeASCII text, with no line terminators Hashdb426eda017fac2764e77ad2a25fed8d 51006be63b5433e930b14931a8199a3aaa8ccf8e b13693d2f58abbbab23e5878dffcc46e490de392601e88a1c404d8ebdac3a351
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:55:59 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://yts1.us
access-control-allow-credentials: true
set-cookie: uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1; expires=Thu, 21 Oct 2032 22:55:59 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (26996), with no line terminators Hash40c5244f24d1ea52a15acefdf178f64e ad10da600420ee9dcef2f622d978fc9a1a32bb51 9de701914922ddcd5a8a974c6f5d394f4d9bdc57e1b878aa8d5bb56e5a0682b5
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ed073dee526c5c38cf9f5ad01be089d8
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| simplewebanalysis.com/stats | 3.74.98.52 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP3.74.98.52:0
File typeASCII text, with no line terminators Hashdb426eda017fac2764e77ad2a25fed8d 51006be63b5433e930b14931a8199a3aaa8ccf8e b13693d2f58abbbab23e5878dffcc46e490de392601e88a1c404d8ebdac3a351
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Cookie: uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:55:59 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://yts1.us
access-control-allow-credentials: true
X-Firefox-Spdy: h2
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27014), with no line terminators Hashac03e84099fa0e6d5e4a74491c276255 338a791b4cb9d34b42132aaa693662db098fb2b7 ffb7702be4150959149b75ca86d73f025ee79ffbe806b404c3eb9c8aae3506ff
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6ca7f9a35ea347d6db4318134d40b19b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash96d572e5b26eff1300210514a08a4ede 8ba1b840b6108f45665ca42d9d15dd72c16ad8e6 426359ae8407fa774682a31f4840cf967f5660ea5e44a30a3cd7395c5b88e521
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "426359AE8407FA774682A31F4840CF967F5660EA5E44A30A3CD7395C5B88E521"
Last-Modified: Sun, 23 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5196
Expires: Tue, 25 Oct 2022 00:22:35 GMT
Date: Mon, 24 Oct 2022 22:55:59 GMT
Connection: keep-alive
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27008), with no line terminators Hash8f277705bdfa9dd164d7f96fad5b817e 00eefc5633e46a03a0392befe045276b2ba629b1 5b375c85d6ed5f856f845f07daee24a77fff518dd688cc520466a711ee085773
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fb46c33177f998621b2d42a5af878db8
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashbfe7d9e70b026b7de42d310d3727770c 368a8a866e4ddad33f0f370362d8d8cd154643d8 e14d2812b3fdb9241c09d407f03b99eec5d2934720af79cfbb5aa7745e1ad27c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E14D2812B3FDB9241C09D407F03B99EEC5D2934720AF79CFBB5AA7745E1AD27C"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2760
Expires: Mon, 24 Oct 2022 23:41:59 GMT
Date: Mon, 24 Oct 2022 22:55:59 GMT
Connection: keep-alive
|
|
| sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1sessionamateur.com/d3369d4d22e28257e720c896d11afd8f/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27014), with no line terminators Hash30c623134959d98f89c22610dd380567 c9297ea74f389375f362a1f629b26b97a5841651 0fe4ef419e366f3d61cabd3b47ce414b28ac848bb0328080901480b28a9f4d5a
GET /d3369d4d22e28257e720c896d11afd8f/invoke.js HTTP/1.1
Host: sessionamateur.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: db15e9c4d0765769b7f94e06c1ac1759
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash4fe08d6ffc931438b886eb80f073ad2e dae5e9eb8bd9053329d24a55b8017c8162cb21d2 49a26dbac4208540e0d361219db57bea3922a33b0fd692212fec7a61727d387c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| lowhardboiledadjoin.com/watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1 | 192.243.59.20 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1lowhardboiledadjoin.com/watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1 IP192.243.59.20:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1 HTTP/1.1
Host: lowhardboiledadjoin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.17.9
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://lowhardboiledadjoin.com/watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1&shu=8c3c0e4b851d8688f042f4042257e1a84a37b7d6d60f5acf453c7ed56bded93ec39b644c8867416b4dca99fe82faa276c21093b8ccf4db4044ac40935fe3995693418742e6b7a1026990f3adcc7ecbce2923b031198f560a2a6b3781b4fb17&pst=1666652219&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ; expires=Mon, 24 Oct 2022 22:56:59 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ad05f604921740439e534471526b8f8b
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lowhardboiledadjoin.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 192.243.59.20 | 200 OK | 29 kB |
URL HTTP/1.1lowhardboiledadjoin.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP192.243.59.20:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hash5c1c07416782dd9dc137a02dc816bc6f 54b4cbb9c9701642f2a81b14e10644762b94b5a2 0ea927a5b3aebfcbfef159f16524ed91f459b403f2ec568a799df457ada172df
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: lowhardboiledadjoin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.9
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 31b02c788fc70f72b2f51cbfe148c87b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| dwightadjoining.com/watch.464150359320.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 | 192.243.59.13 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1dwightadjoining.com/watch.464150359320.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 IP192.243.59.13:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.464150359320.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 HTTP/1.1
Host: dwightadjoining.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.17.6
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://dwightadjoining.com/watch.464150359320.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=172620229dc4d265228ba1745a42f59b4822e2c8f25e99c78bbeeeba00fda65bb4a628ddcf3f89e56875ba4c6588ddc849c9ce8452e6e37683b5e4d741c519ed7ff9c157a71f19693649871351ba968a40441ab0&pst=1666652219&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ; expires=Mon, 24 Oct 2022 22:56:59 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1b38f0de37541d7bc5f285ef298f4c62
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash84c79175c5500bd4fb22853e15e5cb1e 5ba919cb186661aa4585a964fa8adfea9fb91eab d6256beaee7a7dbfe4bb3bc90a18e6920e54c39cd308e4496c26a474887f1647
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D6256BEAEE7A7DBFE4BB3BC90A18E6920E54C39CD308E4496C26A474887F1647"
Last-Modified: Sun, 23 Oct 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15111
Expires: Tue, 25 Oct 2022 03:07:50 GMT
Date: Mon, 24 Oct 2022 22:55:59 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash84c79175c5500bd4fb22853e15e5cb1e 5ba919cb186661aa4585a964fa8adfea9fb91eab d6256beaee7a7dbfe4bb3bc90a18e6920e54c39cd308e4496c26a474887f1647
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D6256BEAEE7A7DBFE4BB3BC90A18E6920E54C39CD308E4496C26A474887F1647"
Last-Modified: Sun, 23 Oct 2022 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15111
Expires: Tue, 25 Oct 2022 03:07:50 GMT
Date: Mon, 24 Oct 2022 22:55:59 GMT
Connection: keep-alive
|
|
| www.youtube.com/s/player/4bbf8bdb/www-player.css | 142.250.74.174 | 200 OK | 50 kB |
URL HTTP/2www.youtube.com/s/player/4bbf8bdb/www-player.css IP142.250.74.174:0
File typeASCII text, with very long lines (65536), with no line terminators Hasha6bad8b64588167878f1de946dd2b911 2d3c33bba6a47f05374274cbce7bef19ecfd87b2 41e7429a90008dd5226c1d096ce72beb44fba7315f31a627e7e66983f9edd4d8
GET /s/player/4bbf8bdb/www-player.css HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 49894
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Oct 2022 16:01:25 GMT
expires: Fri, 20 Oct 2023 16:01:25 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 20 Oct 2022 00:16:54 GMT
content-type: text/css
age: 370474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.youtube.com/s/player/4bbf8bdb/www-embed-player.vflset/www-embed-player.js | 142.250.74.174 | 200 OK | 97 kB |
URL HTTP/2www.youtube.com/s/player/4bbf8bdb/www-embed-player.vflset/www-embed-player.js IP142.250.74.174:0
File typeASCII text, with very long lines (572) Hashba5600e2cf16ffdd8859146ca2ea1cdf 5306a344ffa07e0e728615436f62f07167d63d27 33d8e19add799b3702d7f4120d5eb64dae11b9df8d3a523d84d744fb038af00c
GET /s/player/4bbf8bdb/www-embed-player.vflset/www-embed-player.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 97405
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 22 Oct 2022 02:12:33 GMT
expires: Sun, 22 Oct 2023 02:12:33 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 20 Oct 2022 00:16:54 GMT
content-type: text/javascript
age: 247406
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hasha142554c4f3e8f459a82bb3d6e025baf 8323714c011d96a9829cbe0fad9101ad1d15e626 493e7ebc4d3228e04b08a011bcda62940d6b3c3f215a6a0cd089e41166df7eef
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "493E7EBC4D3228E04B08A011BCDA62940D6B3C3F215A6A0CD089E41166DF7EEF"
Last-Modified: Sat, 22 Oct 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7131
Expires: Tue, 25 Oct 2022 00:54:50 GMT
Date: Mon, 24 Oct 2022 22:55:59 GMT
Connection: keep-alive
|
|
| www.youtube.com/s/player/4bbf8bdb/fetch-polyfill.vflset/fetch-polyfill.js | 142.250.74.174 | 200 OK | 2.8 kB |
URL HTTP/2www.youtube.com/s/player/4bbf8bdb/fetch-polyfill.vflset/fetch-polyfill.js IP142.250.74.174:0
File typeAlgol 68 source text\012- Pascal source, ASCII text, with very long lines (555) Hash80fe2d229007996c8397073b00755dc7 121f82c77bcf2a297a1085e3b092415c463fcafe 033dfa8941482c82d4f1aaa4a9172fb379b9e46a02d5b36297c5476bbbfdea2c
GET /s/player/4bbf8bdb/fetch-polyfill.vflset/fetch-polyfill.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 2786
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Oct 2022 16:01:25 GMT
expires: Fri, 20 Oct 2023 16:01:25 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 20 Oct 2022 00:16:54 GMT
content-type: text/javascript
age: 370474
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash4fe08d6ffc931438b886eb80f073ad2e dae5e9eb8bd9053329d24a55b8017c8162cb21d2 49a26dbac4208540e0d361219db57bea3922a33b0fd692212fec7a61727d387c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.youtube.com/s/player/4bbf8bdb/player_ias.vflset/en_US/base.js | 142.250.74.174 | 200 OK | 586 kB |
URL HTTP/2www.youtube.com/s/player/4bbf8bdb/player_ias.vflset/en_US/base.js IP142.250.74.174:0
File typeASCII text, with very long lines (554) Size586 kB (585591 bytes) Hash0d28cf863deda36ffbec2b49824d38d1 125cfec74aa9df0686b7ad10db94037142213544 9b40a5dbb02a0eb8136714ffb4aa9d48e9773825f6a9b167587fa7a4a4ac4a7a
GET /s/player/4bbf8bdb/player_ias.vflset/en_US/base.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
vary: Accept-Encoding, Origin
content-encoding: br
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 585591
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 20:28:43 GMT
expires: Sat, 21 Oct 2023 20:28:43 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 20 Oct 2022 00:16:54 GMT
content-type: text/javascript
age: 268036
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| lowhardboiledadjoin.com/watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1&shu=8c3c0e4b851d8688f042f4042257e1a84a37b7d6d60f5acf453c7ed56bded93ec39b644c8867416b4dca99fe82faa276c21093b8ccf4db4044ac40935fe3995693418742e6b7a1026990f3adcc7ecbce2923b031198f560a2a6b3781b4fb17&pst=1666652219&rmtc=t | 192.243.59.20 | 200 OK | 2.1 kB |
URL HTTP/1.1lowhardboiledadjoin.com/watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1&shu=8c3c0e4b851d8688f042f4042257e1a84a37b7d6d60f5acf453c7ed56bded93ec39b644c8867416b4dca99fe82faa276c21093b8ccf4db4044ac40935fe3995693418742e6b7a1026990f3adcc7ecbce2923b031198f560a2a6b3781b4fb17&pst=1666652219&rmtc=t IP192.243.59.20:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document text\012- HTML document, ASCII text, with very long lines (2647) Hashe23417a9b638c96c63f83edee9b6fc5b da81ab67574b905c4bda17ee1704e6f043c11409 40b1400c4c7ab72aa5ec18f53a850eb005d2261b2f1e299748b3597f063ae72e
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.771617900597.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5%3A3%3A1&shu=8c3c0e4b851d8688f042f4042257e1a84a37b7d6d60f5acf453c7ed56bded93ec39b644c8867416b4dca99fe82faa276c21093b8ccf4db4044ac40935fe3995693418742e6b7a1026990f3adcc7ecbce2923b031198f560a2a6b3781b4fb17&pst=1666652219&rmtc=t HTTP/1.1
Host: lowhardboiledadjoin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Referer: https://yts1.us/
Connection: keep-alive
Cookie: u_pl=17347003; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.9
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=e0221f3f-b735-4b4f-b7ed-80c5d9cafbf5:3:1; expires=Mon, 31 Oct 2022 22:55:59 GMT; secure; SameSite=None
iprc8df253f30aa2824997753596d03152a5=3569806; expires=Tue, 25 Oct 2022 02:55:59 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
uncs=1; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 25 Oct 2022 22:55:59 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5f6757a48858802a6aad3722b6028eb7
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.sectigo.com/ | 104.18.32.68 | 200 OK | 471 B |
IP104.18.32.68:0
Hashb406634c7cf29b40e8085256480720a1 00865dc5d9bb64b0ba5a58dba2c9ad3b108a4b04 01ca8f3e6b05f2445f1261564202fa33e8f38a894775a9601bec15aaf90e6064
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 24 Oct 2022 08:15:49 GMT
Expires: Mon, 31 Oct 2022 08:15:48 GMT
Etag: "00865dc5d9bb64b0ba5a58dba2c9ad3b108a4b04"
Cache-Control: max-age=551388,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 75f64d9eab5eb505-OSL
|
|
| dwightadjoining.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 192.243.59.13 | 200 OK | 29 kB |
URL HTTP/1.1dwightadjoining.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP192.243.59.13:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hash5eae37133b555b105049192b37dc68d0 9006d275788668a8bef6069c9ff9ac1469bf8c7f 54007e920c38c5debfd9508c50acc9377bcad9c3f8f3fd211dc2190acc60d1e0
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: dwightadjoining.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Mon, 24 Oct 2022 22:55:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0d12ec7886527be4116c1cee809382ec
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hasheb9238eaa63063c98563a1961fbbfefa 9b23eea87129d9516b8e7527cce7b8b1efcfa1fe ff87d571f813dd558347df32a52e27ebb6c66968a6d2e584e6b6467944ef40fb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:55:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| e1.o.lencr.org/ | 23.36.77.32 | 200 OK | 345 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash13c51695bfc0986bc4e4efc19d0845f1 431a0175f4735f8fa8c0e54eba8d2515fcf22d76 a0b6128d03df09119f28ea616e0442d008b708922c173fdfc4824f86c11a8296
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "A0B6128D03DF09119F28EA616E0442D008B708922C173FDFC4824F86C11A8296"
Last-Modified: Mon, 24 Oct 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8659
Expires: Tue, 25 Oct 2022 01:20:19 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 | 216.58.207.195 | 200 OK | 16 kB |
URL HTTP/2fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 IP216.58.207.195:0
File typeWeb Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data Hash285467176f7fe6bb6a9c6873b3dad2cc ea04e4ff5142ddd69307c183def721a160e0a64e 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 21 Oct 2022 00:48:31 GMT
expires: Sat, 21 Oct 2023 00:48:31 GMT
cache-control: public, max-age=31536000
age: 338849
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small | 142.250.74.174 | 200 OK | 472 B |
URL HTTP/2www.youtube.com/embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small IP142.250.74.174:0
Hasheb9238eaa63063c98563a1961fbbfefa 9b23eea87129d9516b8e7527cce7b8b1efcfa1fe ff87d571f813dd558347df32a52e27ebb6c66968a6d2e584e6b6467944ef40fb
GET /embed/0lraf7JedJI?modestbranding=1&rel=0&showinfo=0&fs=0&vq=small HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Oct 2022 22:55:59 GMT
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=v8cGxrgefoA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
VISITOR_INFO1_LIVE=agbaFO5DkcY; Domain=.youtube.com; Expires=Sat, 22-Apr-2023 22:55:59 GMT; Path=/; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+989; expires=Wed, 23-Oct-2024 22:55:59 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash9c9a345ea559eecb7084e331bcdc39e9 71dfe524fc069e7b71ead5162a9729fcf7612f65 e54c190e07e74def4c2b5698b18e39e8af5a5e594574bf471f0da0e94f03d295
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E54C190E07E74DEF4C2B5698B18E39E8AF5A5E594574BF471F0DA0E94F03D295"
Last-Modified: Sun, 23 Oct 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15742
Expires: Tue, 25 Oct 2022 03:18:22 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash9c9a345ea559eecb7084e331bcdc39e9 71dfe524fc069e7b71ead5162a9729fcf7612f65 e54c190e07e74def4c2b5698b18e39e8af5a5e594574bf471f0da0e94f03d295
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E54C190E07E74DEF4C2B5698B18E39E8AF5A5E594574BF471F0DA0E94F03D295"
Last-Modified: Sun, 23 Oct 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15742
Expires: Tue, 25 Oct 2022 03:18:22 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| service.supercounters.com/fc.php?id=1638466&w=1&v=2&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&ref=&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&sw=1280&sh=1024&rand=75 | 172.104.29.90 | 200 OK | 50 B |
URL HTTP/1.1service.supercounters.com/fc.php?id=1638466&w=1&v=2&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&ref=&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&sw=1280&sh=1024&rand=75 IP172.104.29.90:0
File typeASCII text, with CRLF line terminators Hashbe8815cf9932c884bee0aabfae94ffef 5d8d498c2ba98f72308bc92d678caea7bd2ccc74 472e72287d55dd3f66c092f85ce2b11dbbe910747ea7c0bc82dcdf923fcd0be0
GET /fc.php?id=1638466&w=1&v=2&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&ref=&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&sw=1280&sh=1024&rand=75 HTTP/1.1
Host: service.supercounters.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.13
Content-Encoding: gzip
|
|
| haglance.com/watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 | 173.233.139.164 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1haglance.com/watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 IP173.233.139.164:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 HTTP/1.1
Host: haglance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://haglance.com/watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=84ad0ea524389cceb6cb35d39e36f4c55a17ed83b8db11b8c92066ce61d82b5c42bd705a90d4d929065e9af5620d2410cc4b04b971621cb0b8aeb569d03e86d4484d3897804a0d013455985e1b823f5b314ab8b06a17fcaeae63f53498b6afb8&pst=1666652220&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjkiOiIyOTYwNWZmNzY2YjljMzk4ZWUwNjRkMDExYTVlMjEwYiIsIjI4IjoiZGUwNDNkYjFiOTJhZTdlZTYyNGJjMzU5MTUxNDkyMzYifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.ZhxU2mqiE3f2RSQReveFuWjaU035p8kpopKqW_O4WLQ; expires=Mon, 24 Oct 2022 22:57:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1216644343101070e0d2454fcd90d37b
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| indoorsbeliefgrew.com/watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 | 173.233.139.164 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1indoorsbeliefgrew.com/watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 IP173.233.139.164:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 HTTP/1.1
Host: indoorsbeliefgrew.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://indoorsbeliefgrew.com/watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=879cb0f2fdd91922f104b5546118d01a1565ac3393ff16312c340535b23079667dc4b00d3f2139a3dd3f8cfc41048b3589353d0dcd7fb57216a0de1fafad05ccd36fdaf51ba3c72074bef54b16b6c130c21479b918d9fc46b580c5723255271452&pst=1666652220&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ; expires=Mon, 24 Oct 2022 22:57:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 98d046070de143cc25a3f123ee0dd6f1
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| e1.o.lencr.org/ | 23.36.77.32 | 200 OK | 345 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash13c51695bfc0986bc4e4efc19d0845f1 431a0175f4735f8fa8c0e54eba8d2515fcf22d76 a0b6128d03df09119f28ea616e0442d008b708922c173fdfc4824f86c11a8296
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "A0B6128D03DF09119F28EA616E0442D008B708922C173FDFC4824F86C11A8296"
Last-Modified: Mon, 24 Oct 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8659
Expires: Tue, 25 Oct 2022 01:20:19 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash20b10f60f3c1d1ebf4bef79876d07f78 52e912599b0f603f9eeeb578f31b09c3dc23173a 9180af09d54fca04980926273ba9dbf8e7ea1196ae576f4ca54e9e8d5c4f73cc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9180AF09D54FCA04980926273BA9DBF8E7EA1196AE576F4CA54E9E8D5C4F73CC"
Last-Modified: Sat, 22 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5440
Expires: Tue, 25 Oct 2022 00:26:40 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| haglance.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 173.233.139.164 | 200 OK | 29 kB |
URL HTTP/1.1haglance.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP173.233.139.164:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hash06469384d4dd46a15357c77c55db1150 7759d298fbd8794e1ad68fa3e90ade9fe950ebbc 630511362c04ed0f5b0dfbffd5c48b31eb4f77bf3c704473efc68f699194a32c
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: haglance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f36b1244a9895e88677f29043ef776ef
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash76c5fccc92c1485e8c5a83cccf8c1f18 e7795e178c14905f2dcff6938174785e196f8839 d1c2df7f6d0301a39a2843992cc5f4a985d1bb7b64dc2d8cf0da6806b6250955
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D1C2DF7F6D0301A39A2843992CC5F4A985D1BB7B64DC2D8CF0DA6806B6250955"
Last-Modified: Sat, 22 Oct 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3482
Expires: Mon, 24 Oct 2022 23:54:02 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| indoorsbeliefgrew.com/watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=879cb0f2fdd91922f104b5546118d01a1565ac3393ff16312c340535b23079667dc4b00d3f2139a3dd3f8cfc41048b3589353d0dcd7fb57216a0de1fafad05ccd36fdaf51ba3c72074bef54b16b6c130c21479b918d9fc46b580c5723255271452&pst=1666652220&rmtc=t | 173.233.139.164 | 200 OK | 2.0 kB |
URL HTTP/1.1indoorsbeliefgrew.com/watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=879cb0f2fdd91922f104b5546118d01a1565ac3393ff16312c340535b23079667dc4b00d3f2139a3dd3f8cfc41048b3589353d0dcd7fb57216a0de1fafad05ccd36fdaf51ba3c72074bef54b16b6c130c21479b918d9fc46b580c5723255271452&pst=1666652220&rmtc=t IP173.233.139.164:0
File typeHTML document, ASCII text, with very long lines (2473) Hash8055d725625fe2257242cfcbb273a4e1 676d9daed88469de8321afd3ce976f3b5f89f079 3ff78cf6fd4b4bf014b3f202b4392c65efd6236292122f90b395adbdd9055dad
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.1173827454483.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=879cb0f2fdd91922f104b5546118d01a1565ac3393ff16312c340535b23079667dc4b00d3f2139a3dd3f8cfc41048b3589353d0dcd7fb57216a0de1fafad05ccd36fdaf51ba3c72074bef54b16b6c130c21479b918d9fc46b580c5723255271452&pst=1666652220&rmtc=t HTTP/1.1
Host: indoorsbeliefgrew.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Referer: https://yts1.us/
Connection: keep-alive
Cookie: u_pl=17347003; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1; expires=Mon, 31 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fd1a6eb927cad85aa9a1adc7c7d06619
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| haglance.com/watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=84ad0ea524389cceb6cb35d39e36f4c55a17ed83b8db11b8c92066ce61d82b5c42bd705a90d4d929065e9af5620d2410cc4b04b971621cb0b8aeb569d03e86d4484d3897804a0d013455985e1b823f5b314ab8b06a17fcaeae63f53498b6afb8&pst=1666652220&rmtc=t | 173.233.139.164 | 200 OK | 2.0 kB |
URL HTTP/1.1haglance.com/watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=84ad0ea524389cceb6cb35d39e36f4c55a17ed83b8db11b8c92066ce61d82b5c42bd705a90d4d929065e9af5620d2410cc4b04b971621cb0b8aeb569d03e86d4484d3897804a0d013455985e1b823f5b314ab8b06a17fcaeae63f53498b6afb8&pst=1666652220&rmtc=t IP173.233.139.164:0
File typeHTML document, ASCII text, with very long lines (2445) Hash47e200e543460737aa4d67c4713827e4 4f22b59909393eecdf495b032028c21340315741 ef6cc1a8ac9b13bea2c27c7d4c6d018a3f81d158654735f3c7000d1be7a7092b
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.746687065285.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=84ad0ea524389cceb6cb35d39e36f4c55a17ed83b8db11b8c92066ce61d82b5c42bd705a90d4d929065e9af5620d2410cc4b04b971621cb0b8aeb569d03e86d4484d3897804a0d013455985e1b823f5b314ab8b06a17fcaeae63f53498b6afb8&pst=1666652220&rmtc=t HTTP/1.1
Host: haglance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Referer: https://yts1.us/
Connection: keep-alive
Cookie: u_pl=17347003; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjkiOiIyOTYwNWZmNzY2YjljMzk4ZWUwNjRkMDExYTVlMjEwYiIsIjI4IjoiZGUwNDNkYjFiOTJhZTdlZTYyNGJjMzU5MTUxNDkyMzYifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.ZhxU2mqiE3f2RSQReveFuWjaU035p8kpopKqW_O4WLQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1; expires=Mon, 31 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2f7fb3de6bf6eccde4202936ce288a8c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| indoorsbeliefgrew.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 173.233.139.164 | 200 OK | 29 kB |
URL HTTP/1.1indoorsbeliefgrew.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP173.233.139.164:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hashb9de1fc9d60e3d62fc2169620754845e d224b18f4eb185ec644d1eda95f4b9746fe63199 868c113298e224c7bf057340aa88eeb85f288389809241103717372c8b0e4033
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: indoorsbeliefgrew.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 78dea39c05c0506d23e2434353cce4b6
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| suspendedflesh.com/watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 | 173.233.137.44 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1suspendedflesh.com/watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 IP173.233.137.44:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 HTTP/1.1
Host: suspendedflesh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://suspendedflesh.com/watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=be659867a250ac43095e6bbc424409d3189b0979270cc3044acb3dfce40af82cdb4e5abd1d5706fef7fab6ae5e1dc68ababba2902f1e527d4d79536d90f2c8aabcf06729b825c6a2fc06b3ca211b248d6a5d24ba7f9c45858b24ec8f0db602b4207e45b94090&pst=1666652220&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ; expires=Mon, 24 Oct 2022 22:57:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6175a160f9998b24da7beb85fba10009
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png | 45.133.44.9 | 200 OK | 144 kB |
URL HTTP/2cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png IP45.133.44.9:0 ASN#39572 DataWeb Global Group B.V.
File typePNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced\012- data Size144 kB (144379 bytes) Hash33c304429dc1a4408a96e6a74ffa2feb c45fa8e65528d1bb2b46bf8a28af9eeaa1903d04 dbed482e5948ead5587d30a22306a5b611305f704de940bd22c76daf90e0a314
GET /cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:56:00 GMT
content-type: image/png
content-length: 144379
server: nginx/1.17.6
last-modified: Wed, 27 Jul 2022 11:07:21 GMT
etag: "62e11c69-233fb"
expires: Wed, 26 Oct 2022 22:56:00 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| haglance.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 | 173.233.139.164 | 200 OK | 0 B |
URL HTTP/1.1haglance.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 IP173.233.139.164:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 HTTP/1.1
Host: haglance.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| cdn.cloudimagesb.com/cti/60/ce/c4/60cec442407f9abe013ac98b00e12cb9/1627915957.png | 45.133.44.9 | 200 OK | 106 kB |
URL HTTP/2cdn.cloudimagesb.com/cti/60/ce/c4/60cec442407f9abe013ac98b00e12cb9/1627915957.png IP45.133.44.9:0 ASN#39572 DataWeb Global Group B.V.
File typePNG image data, 300 x 250, 8-bit/color RGB, non-interlaced\012- data Size106 kB (106115 bytes) Hash9281fd8d87dda51e160328a923b9a454 fb36ebbd8cc7c4c4871e5cf947ae64a9f567c039 41544e4c12d24c819661b9609eff83f0f2ed1a6fce359a8cc32cbb77c64118da
GET /cti/60/ce/c4/60cec442407f9abe013ac98b00e12cb9/1627915957.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:56:00 GMT
content-type: image/png
content-length: 106115
server: nginx/1.17.6
last-modified: Mon, 02 Aug 2021 14:52:46 GMT
etag: "610806be-19e83"
expires: Wed, 26 Oct 2022 22:56:00 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| cdn.cloudimagesb.com/cti/f5/37/77/f537776afc5dce31cd540a22c60788d4/1663164661.gif | 45.133.44.9 | 200 OK | 22 kB |
URL HTTP/2cdn.cloudimagesb.com/cti/f5/37/77/f537776afc5dce31cd540a22c60788d4/1663164661.gif IP45.133.44.9:0 ASN#39572 DataWeb Global Group B.V.
File typeGIF image data, version 89a, 300 x 250\012- data Hash3fbcfacdc5800cb77bf7c5e57fa753c1 c72434155c3959ad1b79ffe93de63f96d4c9895b 80b0e6de82d91d17b735c18d5bb2c2c31e543d1420b9b51857a1668ce69ee658
GET /cti/f5/37/77/f537776afc5dce31cd540a22c60788d4/1663164661.gif HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:56:00 GMT
content-type: image/gif
content-length: 22049
server: nginx/1.17.6
last-modified: Wed, 14 Sep 2022 14:11:09 GMT
etag: "6321e0fd-5621"
expires: Wed, 26 Oct 2022 22:56:00 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| suspendedflesh.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 173.233.137.44 | 200 OK | 29 kB |
URL HTTP/1.1suspendedflesh.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP173.233.137.44:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hash5eae37133b555b105049192b37dc68d0 9006d275788668a8bef6069c9ff9ac1469bf8c7f 54007e920c38c5debfd9508c50acc9377bcad9c3f8f3fd211dc2190acc60d1e0
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: suspendedflesh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f6547cef265c85349650f282f8e1cbc0
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| sicknessfestivity.com/watch.871017233440.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 | 173.233.137.36 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1sicknessfestivity.com/watch.871017233440.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 IP173.233.137.36:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.871017233440.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1 HTTP/1.1
Host: sicknessfestivity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Location: https://sicknessfestivity.com/watch.871017233440.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=5f137c8039dcb38f2575b67eacbf85451718827a34c0254da530d40f4cb434848d2a47b8ae79e472064509836ec8a69670f5e59c682c60f1257d19dec02723915a75c0c8d59e18e2ee15ec707d0d47b6672b4b863ad3ad7b6e8254f4f6dddff84b&pst=1666652220&rmtc=t
Set-Cookie: u_pl=17347003; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjkiOiIyOTYwNWZmNzY2YjljMzk4ZWUwNjRkMDExYTVlMjEwYiIsIjI4IjoiZGUwNDNkYjFiOTJhZTdlZTYyNGJjMzU5MTUxNDkyMzYifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.ZhxU2mqiE3f2RSQReveFuWjaU035p8kpopKqW_O4WLQ; expires=Mon, 24 Oct 2022 22:57:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b48a85147f68b26b44c8c0263679494f
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| suspendedflesh.com/watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=be659867a250ac43095e6bbc424409d3189b0979270cc3044acb3dfce40af82cdb4e5abd1d5706fef7fab6ae5e1dc68ababba2902f1e527d4d79536d90f2c8aabcf06729b825c6a2fc06b3ca211b248d6a5d24ba7f9c45858b24ec8f0db602b4207e45b94090&pst=1666652220&rmtc=t | 173.233.137.44 | 200 OK | 2.0 kB |
URL HTTP/1.1suspendedflesh.com/watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=be659867a250ac43095e6bbc424409d3189b0979270cc3044acb3dfce40af82cdb4e5abd1d5706fef7fab6ae5e1dc68ababba2902f1e527d4d79536d90f2c8aabcf06729b825c6a2fc06b3ca211b248d6a5d24ba7f9c45858b24ec8f0db602b4207e45b94090&pst=1666652220&rmtc=t IP173.233.137.44:0
File typeHTML document, ASCII text, with very long lines (2484) Hashb77b1b7a0fec75fec76533bbf9107c0e a6abb458a5038b8edaafb5e7e8289d2837d4aab4 d5cdc2be75f7e1654a882dbd4d94704e1734317223c3a8c78c9f4ec5bb80d4e5
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.36750850765.js?key=d3369d4d22e28257e720c896d11afd8f&kw=%5B%22el%22%2C%22d%C3%ADa%22%2C%22que%22%2C%22ejecutaron%22%2C%22a%22%2C%22dos%22%2C%22chapo%22%2C%22con%22%2C%22una%22%2C%22sierra%22%2C%22de%22%2C%22mano%22%2C%22para%22%2C%22madera%22%2C%22watch%22%2C%22hd%22%2C%22mp4%22%2C%22videos%22%2C%22download%22%2C%22free%22%5D&refer=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&tz=0&dev=r&res=12.31&uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268%3A1%3A1&shu=be659867a250ac43095e6bbc424409d3189b0979270cc3044acb3dfce40af82cdb4e5abd1d5706fef7fab6ae5e1dc68ababba2902f1e527d4d79536d90f2c8aabcf06729b825c6a2fc06b3ca211b248d6a5d24ba7f9c45858b24ec8f0db602b4207e45b94090&pst=1666652220&rmtc=t HTTP/1.1
Host: suspendedflesh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Referer: https://yts1.us/
Connection: keep-alive
Cookie: u_pl=17347003; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://yts1.us
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1; expires=Mon, 31 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
pdhtkv5=true; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
uncs5=1; expires=Tue, 25 Oct 2022 22:56:00 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8600d4326bcdac47008ce108755d34d8
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| suspendedflesh.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 | 173.233.137.44 | 200 OK | 0 B |
URL HTTP/1.1suspendedflesh.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 IP173.233.137.44:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 HTTP/1.1
Host: suspendedflesh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| sicknessfestivity.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js | 173.233.137.36 | 200 OK | 29 kB |
URL HTTP/1.1sicknessfestivity.com/de/04/3d/de043db1b92ae7ee624bc35915149236.js IP173.233.137.36:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hashe19a7661cbb0d90e6d3e2c7e5284dca4 95370d181a380a0d47938c26860f69f33428bd95 8b18c7e12d9ca8f4e5e4562cacdab4fac9893f2a37f43f070a708f5c31b01fcd
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /de/04/3d/de043db1b92ae7ee624bc35915149236.js HTTP/1.1
Host: sicknessfestivity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-Platform,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-PlatformSec-CH-UA-ModelSec-CH-UA-Mobile,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,Sec-CH-UASec-CH-UA-MobileSec-CH-UA-Platform,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1d4941d12308cd18c34de259c2c90307
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash070d8c0e5c85f0ab060f0d405f22a90b 57ad7cc6ac071590d87177a632ea0f22da30a988 4d927c44432c201546fad6f3c15319a9e31e0709b47238b62e5964f52db02f3e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash9ed554f0d1187302352f943e39d6c91a 10e1bb8702d0d14c56b659b1662b7c857484b0e7 2e1eda67a00dcf60ade2e3332b7f8b0c18c88ea6794fbb49fa9503e7c02236e1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| static.doubleclick.net/instream/ad_status.js | 142.250.74.166 | 200 OK | 29 B |
URL HTTP/2static.doubleclick.net/instream/ad_status.js IP142.250.74.166:0
Hash1fa71744db23d0f8df9cce6719defcb7 e4be9b7136697942a036f97cf26ebaf703ad2067 eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
GET /instream/ad_status.js HTTP/1.1
Host: static.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 29
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 24 Oct 2022 22:43:39 GMT
expires: Mon, 24 Oct 2022 22:58:39 GMT
cache-control: public, max-age=900
age: 741
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hashd114ab00b1cfe7f9b4f56c7b3655b55d 641e580d6148329b0c9eb2d49f5f8a30c08f30e9 e5420e919b2c05c148179c7d85a210941be6862b1f65ccfafcfc38d960bf38d7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hashd114ab00b1cfe7f9b4f56c7b3655b55d 641e580d6148329b0c9eb2d49f5f8a30c08f30e9 e5420e919b2c05c148179c7d85a210941be6862b1f65ccfafcfc38d960bf38d7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| googleads.g.doubleclick.net/pagead/id | 142.250.74.162 | 302 Found | 0 B |
URL HTTP/2googleads.g.doubleclick.net/pagead/id IP142.250.74.162:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pagead/id HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-credentials: true
access-control-allow-origin: https://www.youtube.com
date: Mon, 24 Oct 2022 22:56:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create | 142.250.74.170 | 200 OK | 0 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create IP142.250.74.170:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://www.youtube.com
vary: origin, referer, x-origin
access-control-allow-credentials: true
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-max-age: 3600
date: Mon, 24 Oct 2022 22:56:00 GMT
content-type: text/html
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash070d8c0e5c85f0ab060f0d405f22a90b 57ad7cc6ac071590d87177a632ea0f22da30a988 4d927c44432c201546fad6f3c15319a9e31e0709b47238b62e5964f52db02f3e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create | 142.250.74.170 | 200 OK | 31 kB |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create IP142.250.74.170:0
File typeJSON data\012- , ASCII text, with very long lines (65536), with no line terminators Hashae8a188878a98380564a1610fe864706 99077e10a93c1b2c82011bff8937294060d4982e 82c68b03c363242cb5d38d15ca135d215c7e4924bad586627040290256afc95e
POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 24
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Mon, 24 Oct 2022 22:56:00 GMT
server: ESF
cache-control: private
content-length: 30968
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash9ed554f0d1187302352f943e39d6c91a 10e1bb8702d0d14c56b659b1662b7c857484b0e7 2e1eda67a00dcf60ade2e3332b7f8b0c18c88ea6794fbb49fa9503e7c02236e1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 471 B |
IP142.250.74.35:0
Hashc560beed39cecb5417cb24d408e854bd 8128cbbdbb9357227cff89cf4a0825d62e1821cd a116fd57470c119c471df4fa54525043cddf2cd4d1c91eaf450155a2293d26f8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hashd114ab00b1cfe7f9b4f56c7b3655b55d 641e580d6148329b0c9eb2d49f5f8a30c08f30e9 e5420e919b2c05c148179c7d85a210941be6862b1f65ccfafcfc38d960bf38d7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.google.com/js/th/U__vy9oQYEAHXumYNbpwDo-BHbCBWjMavCmQTt1Znio.js | 142.250.74.164 | 200 OK | 14 kB |
URL HTTP/2www.google.com/js/th/U__vy9oQYEAHXumYNbpwDo-BHbCBWjMavCmQTt1Znio.js IP142.250.74.164:0
File typeASCII text, with very long lines (35596) Hashce08ce3721002876ba0c9656500a5e93 412da7b61117bb611ec2661b42620e46cd6608a8 3309d6188baeb3ae4fa75122e3652f132eae5bee1ce1f8a3742f410c2c6eaa6c
GET /js/th/U__vy9oQYEAHXumYNbpwDo-BHbCBWjMavCmQTt1Znio.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 14109
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Oct 2022 05:03:34 GMT
expires: Thu, 19 Oct 2023 05:03:34 GMT
cache-control: public, max-age=31536000
age: 496346
last-modified: Tue, 11 Oct 2022 09:30:00 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash559fb0a7d93992787dd1c79e9b6cd754 448f50141a2c51ac3a2b54cb380495847347fd80 8e651261efbbee72d82fbef68f6c8e32724f8730e2ebbe5b357439d2d22adb6d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash57342e17545488ea25a21852640c39ed b8108872d6ebe2e5168c117c6c7b94e622f1a4ff 9deb5a130b205123a360e0e15b0cef51ba12bb71747b1888ef84ccdc9c5039f6
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9DEB5A130B205123A360E0E15B0CEF51BA12BB71747B1888EF84CCDC9C5039F6"
Last-Modified: Sun, 23 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19953
Expires: Tue, 25 Oct 2022 04:28:33 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash9c323ea08fbfcd6590d7a25544e38943 745897e63fdc93815129945f15b1339cee77dc3c 2526cef5db09ebc4aa0df37e65139deddbaa8a11a16dec82c0382b049b3a516b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2526CEF5DB09EBC4AA0DF37E65139DEDDBAA8A11A16DEC82C0382B049B3A516B"
Last-Modified: Sun, 23 Oct 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11193
Expires: Tue, 25 Oct 2022 02:02:33 GMT
Date: Mon, 24 Oct 2022 22:56:00 GMT
Connection: keep-alive
|
|
| i.ytimg.com/vi_webp/0lraf7JedJI/sddefault.webp | 142.250.74.22 | 200 OK | 10 kB |
URL HTTP/2i.ytimg.com/vi_webp/0lraf7JedJI/sddefault.webp IP142.250.74.22:0
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 640x480, Scaling: [none]x[none], YUV color, decoders should clamp\012- data Hash7351eba2b113d4c6afcf7c4bbb7ca6aa c5917099f6bf157272f8d7b5b49495f9e113acd8 f7367b29d379adfb48a6fe46ff45268533e210757efea29e18a5ccb873a1e8e5
GET /vi_webp/0lraf7JedJI/sddefault.webp HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/webp
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 10494
date: Mon, 24 Oct 2022 22:56:00 GMT
expires: Tue, 25 Oct 2022 00:56:00 GMT
cache-control: public, max-age=7200
etag: "0"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash68bd833d6e834b8d876d653751246cf8 fddb68b479878afe5f0e557fd7772b299394129a c40f3028befadba8b9d60c18e2c9fc83016348759f3fb06817972ab71ccd27e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| yt3.ggpht.com/ytc/AMLnZu-zNyYttGLwEq4l_gaZeVZx-M-g8Lex9-2EqhxY=s68-c-k-c0x00ffffff-no-rj | 142.250.74.161 | 200 OK | 2.8 kB |
URL HTTP/2yt3.ggpht.com/ytc/AMLnZu-zNyYttGLwEq4l_gaZeVZx-M-g8Lex9-2EqhxY=s68-c-k-c0x00ffffff-no-rj IP142.250.74.161:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3\012- data Hash95a58e91686ec014af078a68d350e5b0 c914f10db494afb943414db8895905eecf75110d 7e7e53f75fcc5781d5e7d682c39a079c2dbcda1fb59786044b7a379193c0d59b
GET /ytc/AMLnZu-zNyYttGLwEq4l_gaZeVZx-M-g8Lex9-2EqhxY=s68-c-k-c0x00ffffff-no-rj HTTP/1.1
Host: yt3.ggpht.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 2763
x-xss-protection: 0
date: Mon, 24 Oct 2022 20:12:19 GMT
expires: Sun, 09 Oct 2022 06:54:36 GMT
cache-control: public, max-age=86400, no-transform
age: 9821
etag: "v8"
content-type: image/jpeg
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| indoorsbeliefgrew.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 | 173.233.139.164 | 200 OK | 0 B |
URL HTTP/1.1indoorsbeliefgrew.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 IP173.233.139.164:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 HTTP/1.1
Host: indoorsbeliefgrew.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Cookie: u_pl=17347003; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzM0NzAwMywiayI6ImQzMzY5ZDRkMjJlMjgyNTdlNzIwYzg5NmQxMWFmZDhmIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxNTg5MzQ4LCJwaWQiOjYxNTA2LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjEsImFpZCI6NSwicHQiOjQsInBrIjoidHNxejJlOHMwIiwiY3BrcyI6eyAiMjgiOiJkZTA0M2RiMWI5MmFlN2VlNjI0YmMzNTkxNTE0OTIzNiIsIjI5IjoiMjk2MDVmZjc2NmI5YzM5OGVlMDY0ZDAxMWE1ZTIxMGIifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3l0czEudXMvZmVsaWMtZ2FtZXotZ2FyY2lhLzBscmFmN0plZEpJIn19.BWiBXIB5KZjKAZGbtv4VzlD-SHV4fig2DiT8Ao95KHQ; uid_id2=41ce9ee0-da2b-4c57-a484-b6cfd7caa268:1:1; pdhtkv=true; uncs=1; pdhtkv5=true; uncs5=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash559fb0a7d93992787dd1c79e9b6cd754 448f50141a2c51ac3a2b54cb380495847347fd80 8e651261efbbee72d82fbef68f6c8e32724f8730e2ebbe5b357439d2d22adb6d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hash68bd833d6e834b8d876d653751246cf8 fddb68b479878afe5f0e557fd7772b299394129a c40f3028befadba8b9d60c18e2c9fc83016348759f3fb06817972ab71ccd27e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2022 22:56:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| addresseepaper.com/sfp.js | 172.64.192.5 | 200 OK | 27 kB |
URL HTTP/2addresseepaper.com/sfp.js IP172.64.192.5:0
File typeUnicode text, UTF-8 text, with very long lines (65529), with no line terminators Hash249d5bb8f8d5fd948efc1354d88c6817 7c912d3b06643207404fedefff09fafa13366c0d f3bfe89639b988ecb00f0cfee2f14749541d67e96bd6b6308d6e934031db1352
GET /sfp.js HTTP/1.1
Host: addresseepaper.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:56:00 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: cd2a960f85bef5c6d2b9419baba54703
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Mon, 24 Oct 2022 22:55:59 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2B6%2F6DtXZdyTvHkQpIYB%2BP8UGMBSToo%2BMADnRZxIHSL3Ehbiydf9F9Pl%2Bgjrhb2SoOcfbq60wnq%2FugZ3HJO8F0IUykiPeNgbkQh3VRSFljcjQpccEUZCwE40p6UYAUxIBgtfIoQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75f64da02e91747c-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| yearlingpreferablyperiods.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 | 173.233.137.36 | 200 OK | 0 B |
URL HTTP/1.1yearlingpreferablyperiods.com/pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 IP173.233.137.36:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=3379&rd=3379&fd=826&bv=22.8.v.2&tmpl=136 HTTP/1.1
Host: yearlingpreferablyperiods.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 24 Oct 2022 22:56:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg | 142.250.74.33 | 200 OK | 2.3 kB |
URL HTTP/2ytimg.googleusercontent.com/vi/0lraf7JedJI/2.jpg IP142.250.74.33:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 120x90, components 3\012- data Hash6893684440cbcecf290cdfd46c2a378e 9a9fc924254634f46ac641f51a9786ba2aaf609f 5cddd497b11935080522011be5ece2611350569c72b7ce03ef1421904676ac08
GET /vi/0lraf7JedJI/2.jpg HTTP/1.1
Host: ytimg.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yts1.us/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 2329
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 24 Oct 2022 21:18:08 GMT
expires: Mon, 24 Oct 2022 23:18:08 GMT
cache-control: public, max-age=7200
etag: "0"
content-type: image/jpeg
age: 5873
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg | 142.250.74.33 | 200 OK | 2.4 kB |
URL HTTP/2ytimg.googleusercontent.com/vi/0lraf7JedJI/1.jpg IP142.250.74.33:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 120x90, components 3\012- data Hash8012810a336876e8b2d911f05447eeb9 b0bd8ee1479ac161c9327af6e3602fea1f50ca01 4f1eb7a76b09792165eec8f87ff4841c01762fa1d424b31aed6830c957fa4483
GET /vi/0lraf7JedJI/1.jpg HTTP/1.1
Host: ytimg.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yts1.us/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 2434
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 24 Oct 2022 21:18:08 GMT
expires: Mon, 24 Oct 2022 23:18:08 GMT
cache-control: public, max-age=7200
etag: "0"
content-type: image/jpeg
age: 5873
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg | 142.250.74.33 | 200 OK | 2.3 kB |
URL HTTP/2ytimg.googleusercontent.com/vi/0lraf7JedJI/3.jpg IP142.250.74.33:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 120x90, components 3\012- data Hashc48f7d8a12a4e419339b28474c28c46d b0ff683b9fad1f4b856cfdc3755e8b0eea9c252e ef7417b66ca5de6b25c05b97390800eedb6a03dd9b89eeb7b67ff07d63924a18
GET /vi/0lraf7JedJI/3.jpg HTTP/1.1
Host: ytimg.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yts1.us/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 2288
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 24 Oct 2022 21:18:08 GMT
expires: Mon, 24 Oct 2022 23:18:08 GMT
cache-control: public, max-age=7200
etag: "0"
content-type: image/jpeg
age: 5873
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| platform-api.sharethis.com/js/sharethis.js | 143.204.55.6 | 200 OK | 79 kB |
URL HTTP/2platform-api.sharethis.com/js/sharethis.js IP143.204.55.6:0
Hashbec6abeb1989be5fd6d618e58ac1335f 1f4806e96ea319e86cb0ba6dd0961d11320015fd 8e5d4f6b830bd355560448fc8e06579d886500588e4ab508cb74bdd3765ff168
GET /js/sharethis.js HTTP/1.1
Host: platform-api.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-encoding: gzip
date: Mon, 24 Oct 2022 22:49:01 GMT
edge-control: cache-maxage=60m,downstream-ttl=60m
x-frame-options: SAMEORIGIN
etag: W/"2fe41-B6RUASRBT1G2X6u3Ue+hBuA9DqQ"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: MLfW76tVZiGhvlol6ZXnwwoIcKxUH7SYBoUJgtrpTcBXrllpoHQ_HQ==
age: 420
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| buttons-config.sharethis.com/js/6235b782da340f001a398a31.js | 54.230.111.117 | 200 OK | 740 B |
URL HTTP/2buttons-config.sharethis.com/js/6235b782da340f001a398a31.js IP54.230.111.117:0
File typeASCII text, with very long lines (740), with no line terminators Hashefad94ae41b1addd80ca8b435ea4910e 517aef870a6a22db8ffddab3da39e75f679fe693 103cc86d5ff9fa458c98baa47838a9cb913d6d65640dd7a7810f8a669070bf09
GET /js/6235b782da340f001a398a31.js HTTP/1.1
Host: buttons-config.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/javascript
content-length: 740
last-modified: Sat, 19 Mar 2022 12:49:03 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Mon, 24 Oct 2022 22:56:01 GMT
cache-control: public, max-age=60
etag: "efad94ae41b1addd80ca8b435ea4910e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 1YO-vQpri6LcKEszfJcCHuvAQRp-HlQuRzZUpjYOpbg4eAk1HnFamA==
age: 43
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| ocsp.sca1b.amazontrust.com/ | 143.204.42.158 | 200 OK | 471 B |
URL HTTP/1.1ocsp.sca1b.amazontrust.com/ IP143.204.42.158:0
Hashcf3b1b7a646f3765b3f098f52001334b d619eff48c413f7219f3c78678fda5e0fa24d7c7 3f003929f785bc1e47f58c66b3489a02a1c5c889fd22b7f027546877ee87f74b
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=154583
Date: Mon, 24 Oct 2022 22:56:01 GMT
Etag: "6356c7b6-1d7"
Expires: Wed, 26 Oct 2022 17:52:24 GMT
Last-Modified: Mon, 24 Oct 2022 17:13:26 GMT
Server: ECS (nyb/1D32)
X-Cache: Miss from cloudfront
Via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Tq3rJLwRUWLWgEFv0n2RyFQe8BsIRhm3ibOFCXpfjPBiW8H3WnqIdg==
Age: 2338
|
|
| l.sharethis.com/pview?event=pview&hostname=yts1.us&location=%2Ffelic-gamez-garcia%2F0lraf7JedJI&product=sticky-share-buttons&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20Watch%20HD%20Mp4%20Videos%20Download%20Free&cms=unknown&publisher=6235b782da340f001a398a31&embeds_csv=https%3A%2F%2Fwww.youtube.com%2Fembed%2F0lraf7JedJI%3Fmodestbranding%3D1%26rel%3D0%26showinfo%3D0%26fs%3D0%26vq%3Dsmall&sop=true&version=st_sop.js&lang=en&description=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20videos%20Download%20Movie%20download%20720p%2C%20480p%2C%20mp4%2C%20300mbmovies%20El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20full%20hd%20Tamilrockers%2C%20Movierulz%2C%20Worldfree4u. | 18.198.228.79 | 204 No Content | 0 B |
URL HTTP/1.1l.sharethis.com/pview?event=pview&hostname=yts1.us&location=%2Ffelic-gamez-garcia%2F0lraf7JedJI&product=sticky-share-buttons&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20Watch%20HD%20Mp4%20Videos%20Download%20Free&cms=unknown&publisher=6235b782da340f001a398a31&embeds_csv=https%3A%2F%2Fwww.youtube.com%2Fembed%2F0lraf7JedJI%3Fmodestbranding%3D1%26rel%3D0%26showinfo%3D0%26fs%3D0%26vq%3Dsmall&sop=true&version=st_sop.js&lang=en&description=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20videos%20Download%20Movie%20download%20720p%2C%20480p%2C%20mp4%2C%20300mbmovies%20El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20full%20hd%20Tamilrockers%2C%20Movierulz%2C%20Worldfree4u. IP18.198.228.79:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pview?event=pview&hostname=yts1.us&location=%2Ffelic-gamez-garcia%2F0lraf7JedJI&product=sticky-share-buttons&url=https%3A%2F%2Fyts1.us%2Ffelic-gamez-garcia%2F0lraf7JedJI&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20Watch%20HD%20Mp4%20Videos%20Download%20Free&cms=unknown&publisher=6235b782da340f001a398a31&embeds_csv=https%3A%2F%2Fwww.youtube.com%2Fembed%2F0lraf7JedJI%3Fmodestbranding%3D1%26rel%3D0%26showinfo%3D0%26fs%3D0%26vq%3Dsmall&sop=true&version=st_sop.js&lang=en&description=El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20videos%20Download%20Movie%20download%20720p%2C%20480p%2C%20mp4%2C%20300mbmovies%20El%20d%C3%ADa%20que%20ejecutaron%20a%20dos%20Chapo%20con%20una%20Sierra%20de%20mano%20para%20madera%20full%20hd%20Tamilrockers%2C%20Movierulz%2C%20Worldfree4u. HTTP/1.1
Host: l.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://yts1.us
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 204 No Content
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: https://yts1.us
Access-Control-Expose-Headers: stid
Access-Control-Max-Age: 1728000
Cache-Control: no-cache, no-store, must-revalidate
Date: Mon, 24 Oct 2022 22:56:01 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Connection: keep-alive
|
|
| platform-cdn.sharethis.com/img/arrow_right.svg | 54.230.111.128 | 200 OK | 565 B |
URL HTTP/2platform-cdn.sharethis.com/img/arrow_right.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (409) Hash9928d025bd5792b718ee0a185f62e67c 16406d7b5b6d383b12859b853cf6cb7e3733e33d 1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
GET /img/arrow_right.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 565
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Tue, 18 Oct 2022 01:53:53 GMT
cache-control: public, max-age=2592000
etag: "9928d025bd5792b718ee0a185f62e67c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: x6r8y8xu3xAK-xsmtWya5ILNWiIdDbwMhh19y1cEvCGeO2f9HlTJeQ==
age: 594129
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/pinterest.svg | 54.230.111.128 | 200 OK | 771 B |
URL HTTP/2platform-cdn.sharethis.com/img/pinterest.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (615) Hash2b10a062e719c64b686e2e8fcdc216dc 38bd37fa3975f4d5b849763359481d8b31bb80ba efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
GET /img/pinterest.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 771
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Oct 2022 01:45:30 GMT
cache-control: public, max-age=2592000
etag: "2b10a062e719c64b686e2e8fcdc216dc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: HNCI5jUZBOo5qr6sPHrLN_Qo9O5XqcG0zFOKFSBdAsrk0wP1rCXR-Q==
age: 421832
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/sharethis.svg | 54.230.111.128 | 200 OK | 514 B |
URL HTTP/2platform-cdn.sharethis.com/img/sharethis.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (358) Hashdeecdaa377907db5cc1722fc831670a1 4e39e0fd5742cc1460e24620df4a360abb71290e 9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
GET /img/sharethis.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 514
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Mon, 10 Oct 2022 13:19:55 GMT
cache-control: public, max-age=2592000
etag: "deecdaa377907db5cc1722fc831670a1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dDqL-QMkSE7-Yp-j_Q6etAS5brI2xejEux-cXWbmjkkJv1WRak2xXw==
age: 1244167
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/arrow_left.svg | 54.230.111.128 | 200 OK | 565 B |
URL HTTP/2platform-cdn.sharethis.com/img/arrow_left.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (409) Hashb55d8d2b9321e381a3c38a4bddb74037 000c29635758e608bbe15d191e953adb27627c2e 5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
GET /img/arrow_left.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 565
date: Sun, 25 Sep 2022 10:31:58 GMT
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
etag: "b55d8d2b9321e381a3c38a4bddb74037"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=2592000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 6l2pDJK1lkSKHYxtuwhB53W30O-vHsIHZiDunJX8216ZSNnDYJPw5Q==
age: 2550244
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/twitter.svg | 54.230.111.128 | 200 OK | 731 B |
URL HTTP/2platform-cdn.sharethis.com/img/twitter.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (575) Hash0af2fb38987598376c99e21af17ade45 bfbdfd0b1a2dcef714e347928bd11b8410dc7ca2 7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
GET /img/twitter.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 731
date: Thu, 29 Sep 2022 07:08:03 GMT
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
etag: "0af2fb38987598376c99e21af17ade45"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=2592000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 0ZpdyiHUBVee-MoW69FDZRnPoyYYIzh_Um1ciLBLlggsYMVvTfV9uw==
age: 2216879
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/facebook.svg | 54.230.111.128 | 200 OK | 301 B |
URL HTTP/2platform-cdn.sharethis.com/img/facebook.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text Hashc6e9be45643e197ce1db1d7e24a99adc d7338e398bb0f7a9082d24f121140d2cf9e88859 768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
GET /img/facebook.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 301
date: Tue, 04 Oct 2022 15:33:18 GMT
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
etag: "c6e9be45643e197ce1db1d7e24a99adc"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=2592000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: -mSK42_DUwHQW8pWJYH1Qw96Niqz9B7wHQxXfMobwEgf_r7Y2W_mog==
age: 1754564
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/whatsapp.svg | 54.230.111.128 | 200 OK | 832 B |
URL HTTP/2platform-cdn.sharethis.com/img/whatsapp.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (676) Hashafe7fc60ed757db39a88d2950fce69c9 e120b53e856848419275723e24a539359cf41b4a 847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
GET /img/whatsapp.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 832
date: Tue, 27 Sep 2022 01:43:40 GMT
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
etag: "afe7fc60ed757db39a88d2950fce69c9"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=2592000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 3GZP2Hdj4GeApJUdVv-kdKS2jKehpUfbFtpNT5nrE-58d6CvWw0JiQ==
age: 2409142
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| platform-cdn.sharethis.com/img/email.svg | 54.230.111.128 | 200 OK | 343 B |
URL HTTP/2platform-cdn.sharethis.com/img/email.svg IP54.230.111.128:0
File typeSVG Scalable Vector Graphics image\012- , ASCII text Hash5977437466e857c7ddcadda6f6d88c2a 19c6378daa1f946ca225fb8d9e039e1f7762fb0d 5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
GET /img/email.svg HTTP/1.1
Host: platform-cdn.sharethis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 343
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Mon, 24 Oct 2022 02:44:38 GMT
cache-control: public, max-age=2592000
etag: "5977437466e857c7ddcadda6f6d88c2a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: OgfQQFCpf-9IoTeqn4kQxlYJmMLJtYN9SptxVXLVWCqdrycDT80x2g==
age: 72684
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashd44dfb6199247e4920ba63036814a0f3 8b7175ff3a8a3ad6adec181bfb9104545ec77a99 63172accaeb07d57d1929485c01f2b6a7f32b7693d15333ca2790dd81d1b7ccc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "63172ACCAEB07D57D1929485C01F2B6A7F32B7693D15333CA2790DD81D1B7CCC"
Last-Modified: Sat, 22 Oct 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8593
Expires: Tue, 25 Oct 2022 01:19:15 GMT
Date: Mon, 24 Oct 2022 22:56:02 GMT
Connection: keep-alive
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT | 142.250.74.170 | 200 OK | 0 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT IP142.250.74.170:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://www.youtube.com
vary: origin, referer, x-origin
access-control-allow-credentials: true
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-max-age: 3600
date: Mon, 24 Oct 2022 22:56:02 GMT
content-type: text/html
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT | 142.250.74.170 | 200 OK | 110 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT IP142.250.74.170:0
File typeJSON data\012- , ASCII text, with no line terminators Hasha26558e0cfae2a69172a1d7945e14ac9 73a3dde420f936a947d1358b7bec87d97ab44a1f d09d37af7f8e8f62b5b4057a983e14caaa3fa2ba6508f0a7ead71b59f75cfabb
POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 884
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Mon, 24 Oct 2022 22:56:02 GMT
server: ESF
cache-control: private
content-length: 110
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| unseenreport.com/pxf.gif?uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268&eb=10f387f87b313393a6d69bc0ef8596f8&te=8a361a1ceecdc6c0004ea425d91e176f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=de043db1b92ae7ee624bc35915149236&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=22 | 192.243.59.12 | 200 OK | 1 B |
URL HTTP/1.1unseenreport.com/pxf.gif?uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268&eb=10f387f87b313393a6d69bc0ef8596f8&te=8a361a1ceecdc6c0004ea425d91e176f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=de043db1b92ae7ee624bc35915149236&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=22 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pxf.gif?uuid=41ce9ee0-da2b-4c57-a484-b6cfd7caa268&eb=10f387f87b313393a6d69bc0ef8596f8&te=8a361a1ceecdc6c0004ea425d91e176f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=r&res=14.31&b_frame=0&pk=de043db1b92ae7ee624bc35915149236&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=22 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Mon, 24 Oct 2022 22:56:02 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cd14c8e880afed1e7015894c39e3718e
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| widget.supercounters.com/ssl/online_i.js | 104.21.4.189 | 200 OK | 0 B |
URL HTTP/2widget.supercounters.com/ssl/online_i.js IP104.21.4.189:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /ssl/online_i.js HTTP/1.1
Host: widget.supercounters.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://yts1.us/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 24 Oct 2022 22:55:58 GMT
content-type: application/javascript
last-modified: Thu, 03 Mar 2022 11:46:10 GMT
etag: W/"6220aa82-10a3"
cache-control: max-age=14400
cf-cache-status: HIT
age: 663
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1vukOTDUdSbD90atEaKq6Q7yCtd%2BsFpdO4mCcHyDxfTstJOFL5G7pOTR03tSCKb2xtDyCngAXS5mjHqkZmLa%2BKuMqw783HjkIi91VBS3sQ877PRYbkvyj989Nt1C1VY3MtpjpsgenyWj9Ho%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 75f64d94f917b506-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
104.21.81.72