redir.findthewind.xyz/feed/click/?t1=128&tid=8&uid=3&subid=8.jp&id=a7a00d186162bb0324f83ddbb35e4aa6:cc81756fd8b55150925b22f650b58d84de94459f964506114e774a33dd06dc5ccad94586240672770ef1d7d92dbd9e5480211b9dc5c09dba5bc2f59b6d49260d1771f2d9359cb933b0d159119fa760e1725b4acf866b24499e4094b10b7a66187c83ef9f6feb2d816e69b3ad0a8b0c41b3d11bd421e8e7bc495faeb30c256be1ae66fb182dca288eb9c6ed8af77988e28b61136d2662e5afd95762cc5a1f84d990988be38d9501467e34cfce3fa7a9d1dc3fbe17b545e115662872f145beb28d128b8d6b12522c6f0d4ecc91bd9dc6930fe2192fe0324cdc8a217b48386c77ad56635b923c7247567217c6046433f32ee47fbefecf78c705855b1e2f2d69df6c3401504a60881ca05b7fa6ab28e3e6ccb9aea395c6766e37860ddbb8401b2ae38eb3ef26a6f3b38a99ca92923053930db24f86743782649e19f9dcbef8e58dc631a281015ae696abb22e3b7a47b70ba5079d4404f883da68356ef6a97beb16814f4c08e017762324294caf8b555aab199fd24363e09c78b7f0045b7aaff96d5fee2f83173809b085ee2ac57af765815bb9b39657a25234ec95c7251347cd116e&s1=6328caa40082d95fb7517e40
198.211.113.186302 Found 234 B URL HTTP/1.1 redir.findthewind.xyz/feed/click/?t1=128&tid=8&uid=3&subid=8.jp&id=a7a00d186162bb0324f83ddbb35e4aa6:cc81756fd8b55150925b22f650b58d84de94459f964506114e774a33dd06dc5ccad94586240672770ef1d7d92dbd9e5480211b9dc5c09dba5bc2f59b6d49260d1771f2d9359cb933b0d159119fa760e1725b4acf866b24499e4094b10b7a66187c83ef9f6feb2d816e69b3ad0a8b0c41b3d11bd421e8e7bc495faeb30c256be1ae66fb182dca288eb9c6ed8af77988e28b61136d2662e5afd95762cc5a1f84d990988be38d9501467e34cfce3fa7a9d1dc3fbe17b545e115662872f145beb28d128b8d6b12522c6f0d4ecc91bd9dc6930fe2192fe0324cdc8a217b48386c77ad56635b923c7247567217c6046433f32ee47fbefecf78c705855b1e2f2d69df6c3401504a60881ca05b7fa6ab28e3e6ccb9aea395c6766e37860ddbb8401b2ae38eb3ef26a6f3b38a99ca92923053930db24f86743782649e19f9dcbef8e58dc631a281015ae696abb22e3b7a47b70ba5079d4404f883da68356ef6a97beb16814f4c08e017762324294caf8b555aab199fd24363e09c78b7f0045b7aaff96d5fee2f83173809b085ee2ac57af765815bb9b39657a25234ec95c7251347cd116e&s1=6328caa40082d95fb7517e40
IP 198.211.113.186:0
ASN #14061 DIGITALOCEAN-ASN
File type HTML document, ASCII text, with no line terminators
Hash ec5db86b65bb94d1ae856c7ef84ada1e
14cb402b710327b35e5e2cc315cf3e9b18718223
682fdb61228205f6ff34d48ee6229e0ab0f086f9c7c6ec2d53b812c9fff3aa57
GET /feed/click/?t1=128&tid=8&uid=3&subid=8.jp&id=a7a00d186162bb0324f83ddbb35e4aa6:cc81756fd8b55150925b22f650b58d84de94459f964506114e774a33dd06dc5ccad94586240672770ef1d7d92dbd9e5480211b9dc5c09dba5bc2f59b6d49260d1771f2d9359cb933b0d159119fa760e1725b4acf866b24499e4094b10b7a66187c83ef9f6feb2d816e69b3ad0a8b0c41b3d11bd421e8e7bc495faeb30c256be1ae66fb182dca288eb9c6ed8af77988e28b61136d2662e5afd95762cc5a1f84d990988be38d9501467e34cfce3fa7a9d1dc3fbe17b545e115662872f145beb28d128b8d6b12522c6f0d4ecc91bd9dc6930fe2192fe0324cdc8a217b48386c77ad56635b923c7247567217c6046433f32ee47fbefecf78c705855b1e2f2d69df6c3401504a60881ca05b7fa6ab28e3e6ccb9aea395c6766e37860ddbb8401b2ae38eb3ef26a6f3b38a99ca92923053930db24f86743782649e19f9dcbef8e58dc631a281015ae696abb22e3b7a47b70ba5079d4404f883da68356ef6a97beb16814f4c08e017762324294caf8b555aab199fd24363e09c78b7f0045b7aaff96d5fee2f83173809b085ee2ac57af765815bb9b39657a25234ec95c7251347cd116e&s1=6328caa40082d95fb7517e40 HTTP/1.1
Host: redir.findthewind.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
X-Powered-By: Express
Surrogate-Control: no-store
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: 0
Location: https://mono.trffcsource.com/z.php?p=c:9qopki6xxt24fkzm4&d=620239e89b29133e2933cceb&s=8
Vary: Accept
Content-Type: text/html; charset=utf-8
Content-Length: 234
Date: Mon, 19 Sep 2022 20:02:01 GMT
Connection: keep-alive
Keep-Alive: timeout=5
firefox.settings.services.mozilla.com/v1/
143.204.55.35200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP 143.204.55.35:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 91dd975a7b17b2922dd23c0e49314e40
57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Content-Type, Alert, Backoff, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 19 Sep 2022 19:12:48 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Ed1qV7p9tacj6XtKcmZLqQshd15VyX6wU5odEUwTJt13s1eXWXvBRg==
Age: 2953
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 861cfa99de956423d917ed0ddbea4b9c
ad65dbc394b48b04a45c205f56af296c8d008db4
5c706b2718b1698995f4feb91223779aef4bf6dc967c31f9ef9a93873197d5f9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5C706B2718B1698995F4FEB91223779AEF4BF6DC967C31F9EF9A93873197D5F9"
Last-Modified: Sun, 18 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10156
Expires: Mon, 19 Sep 2022 22:51:17 GMT
Date: Mon, 19 Sep 2022 20:02:01 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
143.204.55.25200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP 143.204.55.25:0
File type PEM certificate\012- , ASCII text
Hash 6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Mon, 19 Sep 2022 04:35:14 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: kQT9hFS4XWDqwGq4v0zi2lvzYb9L2OAwjRje216FJhOCqFbcUCpvGw==
age: 55608
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 6cb49ed3bfbb089b6c26949ea87a0840
ac9d9601738788f6152e648ce17776075216610c
ced109e5362acacc04705d2d05b135834172f91ca478f3ecd3ffb5b15833def9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CED109E5362ACACC04705D2D05B135834172F91CA478F3ECD3FFB5B15833DEF9"
Last-Modified: Sat, 17 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3452
Expires: Mon, 19 Sep 2022 20:59:33 GMT
Date: Mon, 19 Sep 2022 20:02:01 GMT
Connection: keep-alive
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 20:02:01 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
mono.trffcsource.com/z.php?p=c:9qopki6xxt24fkzm4&d=620239e89b29133e2933cceb&s=8
51.83.143.92302 Found 0 B URL HTTP/1.1 mono.trffcsource.com/z.php?p=c:9qopki6xxt24fkzm4&d=620239e89b29133e2933cceb&s=8
IP 51.83.143.92:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /z.php?p=c:9qopki6xxt24fkzm4&d=620239e89b29133e2933cceb&s=8 HTTP/1.1
Host: mono.trffcsource.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 302 Found
Server: nginx
Date: Mon, 19 Sep 2022 20:02:01 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 11hx4alk7e
Raund: 25e
Location: https://miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 6cb49ed3bfbb089b6c26949ea87a0840
ac9d9601738788f6152e648ce17776075216610c
ced109e5362acacc04705d2d05b135834172f91ca478f3ecd3ffb5b15833def9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CED109E5362ACACC04705D2D05B135834172F91CA478F3ECD3FFB5B15833DEF9"
Last-Modified: Sat, 17 Sep 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3452
Expires: Mon, 19 Sep 2022 20:59:33 GMT
Date: Mon, 19 Sep 2022 20:02:01 GMT
Connection: keep-alive
miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8
51.83.143.92200 OK 490 B URL HTTP/1.1 miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8
IP 51.83.143.92:0
File type HTML document text\012- HTML document, ASCII text, with very long lines (538)
Hash 41451641fd2fa01504017fa5f8e1a995
94cc4c44d1fdeb85daf73608c44ad4ed1dc111a9
42140c1e4f79701152710187cab579e44ad7251066eb9b76ffc7f7b98c818684
GET /s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8 HTTP/1.1
Host: miao.labtrffc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2022 20:02:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: bt-603611c5b7eaf46891533240=6328cab9f1cf96566731870c; expires=Thu, 22-Sep-2022 20:02:01 GMT; Max-Age=259200; path=/; domain=miao.labtrffc.com; HttpOnly
Content-Encoding: gzip
miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8&bv=1
51.83.143.92302 Found 0 B URL HTTP/1.1 miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8&bv=1
IP 51.83.143.92:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8&bv=1 HTTP/1.1
Host: miao.labtrffc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8
Cookie: bt-603611c5b7eaf46891533240=6328cab9f1cf96566731870c
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
HTTP/1.1 302 Found
Server: nginx
Date: Mon, 19 Sep 2022 20:02:01 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: bt-603611c5b7eaf46891533240=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=miao.labtrffc.com; HttpOnly
Round: 10voqfxttf
Raund: 2fx
Location: https://popcash.net/world/go/134600/426377
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
143.204.55.35200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 143.204.55.35:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Mon, 19 Sep 2022 19:03:22 GMT
Cache-Control: max-age=3600
Expires: Mon, 19 Sep 2022 19:28:18 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: gCpPrKa5OfnDeezb08ODbUGAZG2-iLexz97gAbqMdj3WRRYNh3TqpQ==
Age: 3519
miao.labtrffc.com/favicon.ico
51.83.143.92200 OK 20 B URL HTTP/1.1 miao.labtrffc.com/favicon.ico
IP 51.83.143.92:0
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /favicon.ico HTTP/1.1
Host: miao.labtrffc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://miao.labtrffc.com/s.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240&s=int-8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 19 Sep 2022 20:02:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
popcash.net/world/go/134600/426377
172.67.194.203301 Moved Permanently 162 B URL HTTP/2 popcash.net/world/go/134600/426377
IP 172.67.194.203:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /world/go/134600/426377 HTTP/1.1
Host: popcash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://miao.labtrffc.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Mon, 19 Sep 2022 20:02:02 GMT
content-type: text/html
content-length: 162
location: http://ps.popcash.net/go/134600/426377
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gx8TolQx18gAemmkmoPtUH9RXsKjw0ehdpPQb%2BlSY5sDpPtpkiz5wQfAEjeNxh9GMmHkom6t%2FLFT9EyVP4ZfTxwDLAdBWUdTugXd65sS%2FRwuAzgXH7cprcMWopW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74d4eaaa4816b4f3-OSL
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 5c817aa82ca8ed4a4257fd1e1628b423
7905c62b6bbc582860c07b75eddae371a4b8d02b
dce1783ecfe50c83d30878b48d60e1cf3fe42a3fa4090fb5d318194de73e53d6
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2162
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:02 GMT
Last-Modified: Mon, 19 Sep 2022 19:26:00 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 471
ps.popcash.net/go/134600/426377
3.224.133.188200 OK 270 B URL HTTP/1.1 ps.popcash.net/go/134600/426377
IP 3.224.133.188:0
File type HTML document, ASCII text
Hash 7f1ade9f12c15c620ebdcb7102bd146b
b186f4bd2d7c51723cd6b09edb60531fed24122f
9a1d004166449a42a20e4053eab1f1e5a32d42016a00571f35c94a7809cd7935
Analyzer Verdict Alert fortinet Malware
GET /go/134600/426377 HTTP/1.1
Host: ps.popcash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 19 Sep 2022 20:02:02 GMT
Server: nginx
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive
push.services.mozilla.com/
54.189.35.180101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 54.189.35.180:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0nU8KOLtUni/YoqkLyi1kQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: vgY10IASppSm9gL04ujwSyDg84c=
ps.popcash.net/ad/ad?p=134600&w=426377&t=af3bc672bf83c26e&r=&vw=1280&vh=0
3.224.133.188303 See Other 0 B URL HTTP/1.1 ps.popcash.net/ad/ad?p=134600&w=426377&t=af3bc672bf83c26e&r=&vw=1280&vh=0
IP 3.224.133.188:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ad/ad?p=134600&w=426377&t=af3bc672bf83c26e&r=&vw=1280&vh=0 HTTP/1.1
Host: ps.popcash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ps.popcash.net/go/134600/426377
Upgrade-Insecure-Requests: 1
HTTP/1.1 303 See Other
Date: Mon, 19 Sep 2022 20:02:02 GMT
Location: https://heya.today/1
Server: nginx
Content-Length: 0
Connection: keep-alive
heya.today/1
99.192.224.70200 OK 4.2 kB IP 99.192.224.70:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 64133cd413c45220b1414f0b9c55ae31
86867038578aea823b9d5e648743af67aabaaffa
9ffa1d3902371c8939b031cbc966b4d9a784bb5d0bfed6aa3246ed6ed592b908
GET /1 HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ps.popcash.net/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/html;charset=UTF-8
content-length: 4152
set-cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2; Path=/; HttpOnly
content-language: en-US
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash eaa8b4aa123f9dd7237c5c51d2f848d9
1082f5f6ef7229ec76f94f3d236f273b26294563
d1ad33dae2fcab5c7d66875f0e7a01cc30e0b3a031606917fa5448c54f84e20d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash 26fcf8aea27805b4a6a29e3e2a4ba19b
f920fd6c5a79a4adb2f456edcee678757ff1602c
7aa63d03f514e4f51190e85f167f747563f980e0e6fdee6cce9393321dff1038
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-TBR6YBVH1L
142.250.74.72200 OK 75 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-TBR6YBVH1L
IP 142.250.74.72:0
File type ASCII text, with very long lines (17807)
Hash 6759e659329da1c8d47577471c9c185f
ab48ffaaba647fc82e00d02747d329e5e2d64cbe
1f755c3a112a19b701bcd298e12f7a159aff89f1d0bcfc4a563d5686b1af0979
GET /gtag/js?id=G-TBR6YBVH1L HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 19 Sep 2022 20:02:03 GMT
expires: Mon, 19 Sep 2022 20:02:03 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 74804
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash eaa8b4aa123f9dd7237c5c51d2f848d9
1082f5f6ef7229ec76f94f3d236f273b26294563
d1ad33dae2fcab5c7d66875f0e7a01cc30e0b3a031606917fa5448c54f84e20d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash 26fcf8aea27805b4a6a29e3e2a4ba19b
f920fd6c5a79a4adb2f456edcee678757ff1602c
7aa63d03f514e4f51190e85f167f747563f980e0e6fdee6cce9393321dff1038
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 85aa2dcaf76d25900c78356e5e1c254f
46cd66c9921a162c9e67cfa7d85bc82e5967d531
741815f43b76661b9edde512bc9061cb4bc659b297e7d822bf8e68e5aac9d23d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "741815F43B76661B9EDDE512BC9061CB4BC659B297E7D822BF8E68E5AAC9D23D"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7807
Expires: Mon, 19 Sep 2022 22:12:10 GMT
Date: Mon, 19 Sep 2022 20:02:03 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 85aa2dcaf76d25900c78356e5e1c254f
46cd66c9921a162c9e67cfa7d85bc82e5967d531
741815f43b76661b9edde512bc9061cb4bc659b297e7d822bf8e68e5aac9d23d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "741815F43B76661B9EDDE512BC9061CB4BC659B297E7D822BF8E68E5AAC9D23D"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7807
Expires: Mon, 19 Sep 2022 22:12:10 GMT
Date: Mon, 19 Sep 2022 20:02:03 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c670b93-3941-4322-a938-e74eba949ad6.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c670b93-3941-4322-a938-e74eba949ad6.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f003d8b6e12692fb16dddd6827deead8
786c333cf08456aea446a55c547520572e1c2df9
d79ea50cfc0f237b3de8f1826cbae1de0b1dbc632a5a06b08d9640abedded935
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c670b93-3941-4322-a938-e74eba949ad6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11919
x-amzn-requestid: b04884f3-149d-4750-876b-8e8762f0f2a5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YbfzrHKMoAMFlfQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6321467d-5852e5ef280580b8569b548f;Sampled=0
x-amzn-remapped-date: Wed, 14 Sep 2022 03:11:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: vaJ_7zKaGiXZh4VtTlLZCOFpi7bz9tpKRbsvRDJ4En-E93sREYnz5w==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Mon, 19 Sep 2022 05:49:41 GMT
age: 51142
etag: "786c333cf08456aea446a55c547520572e1c2df9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a91bc33-86f4-4bda-af70-da083ceb7c72.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a91bc33-86f4-4bda-af70-da083ceb7c72.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d3e70b2859ca89b353682d03f6b46b93
ebd83f29edd95217dfa4f4c7a94eddf34dd58b14
43ad8f8b0a664bbec39e0410c1201498a2d2e36e5bd7d5ece8d65b15230ec50b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a91bc33-86f4-4bda-af70-da083ceb7c72.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10894
x-amzn-requestid: f7aad96e-af80-4db7-8bc1-d1e09a9b37e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YeJQGHhOIAMFYuw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6322559a-538534e91448af217c59ab3d;Sampled=0
x-amzn-remapped-date: Wed, 14 Sep 2022 22:28:42 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: P7aZQzmAvqn2rcHJUQjHo0Dcg8dsrqseey5mNOabfq1b857M4SUMDQ==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Mon, 19 Sep 2022 01:08:23 GMT
age: 68020
etag: "ebd83f29edd95217dfa4f4c7a94eddf34dd58b14"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb78000d2-f83e-44e6-b5dd-092b2c37f6b8.jpeg
34.120.237.76200 OK 4.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb78000d2-f83e-44e6-b5dd-092b2c37f6b8.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a533c29caf29ac5348a4443278d5c52c
915155faf27fad10373d5e282621af5c2eba0c17
eaa82b2d158d5f8c8a91a13cbce276aa8e2a9adabaa5a7d81e1155e3334ca27d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb78000d2-f83e-44e6-b5dd-092b2c37f6b8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4807
x-amzn-requestid: 9fdca623-dc65-4b51-9b40-15049a21b986
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yn5tlFNeIAMFblg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63263cbd-285bbc7b1d5cf53a0e4aee0c;Sampled=0
x-amzn-remapped-date: Sat, 17 Sep 2022 21:31:41 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: CY-m1MIG3c7tAi5RB6Oh_Fm_k2eLSRD7rFefVfaFlV6iYPvZfVzEvQ==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:48:04 GMT
age: 80039
etag: "915155faf27fad10373d5e282621af5c2eba0c17"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e5b5676-18df-4d43-8bbd-b85ffe4f1a94.jpeg
34.120.237.76200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e5b5676-18df-4d43-8bbd-b85ffe4f1a94.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1105b56cf779b6df1cbd081bbd0cda50
58c5d6f8ba1d3236d788ac55ff7cb2ec7863fb5c
10c1f0433baf51e06565ff905688075aaba8fec0a8b3f9cef34168e297f94c2c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e5b5676-18df-4d43-8bbd-b85ffe4f1a94.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5866
x-amzn-requestid: 3a7db39d-cd4f-486f-954b-39fc7464706c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YrNeAE67IAMFSoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63278f8c-66a419ac7fbd977f5f41061b;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 21:37:16 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: TdVz72qdwMdsuW1WsOq1qEZk2vmbXJlbppLTTsZ9PlrmN7GEph0dyQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:51:43 GMT
age: 79820
etag: "58c5d6f8ba1d3236d788ac55ff7cb2ec7863fb5c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.googleapis.com/css2?family=Roboto+Slab:wght@400;600;700&family=Roboto:wght@400;500;700&display=swap
142.250.74.10200 OK 5.9 kB URL HTTP/2 fonts.googleapis.com/css2?family=Roboto+Slab:wght@400;600;700&family=Roboto:wght@400;500;700&display=swap
IP 142.250.74.10:0
Hash 71f0c4ad96e7131c0e8272f7ec2c07c5
353d5ca6e019b4db582c78e5fd61f3aae320301f
71d604bc4f7e9fa3420a20f8af874b32ab39d36937fdbc18dd612c9330a1268d
GET /css2?family=Roboto+Slab:wght@400;600;700&family=Roboto:wght@400;500;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 19 Sep 2022 20:02:03 GMT
date: Mon, 19 Sep 2022 20:02:03 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd6067cf-6392-4f3a-8543-a3861c83d1cd.jpeg
34.120.237.76200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd6067cf-6392-4f3a-8543-a3861c83d1cd.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5ae5a7fc19cf9601753b147621cb9f8c
04063797f76518668fdd9a5d5a86c7637eac43b8
b1c659363aa69139a03aab9a6d76800b3568ccf5201f02e1ea864e2bff70d3a7
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd6067cf-6392-4f3a-8543-a3861c83d1cd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9093
x-amzn-requestid: 29c7788f-27e9-4823-8cba-ebf4ef9ea7ef
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yn5tjEvsoAMFrtA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63263cbc-37b8d7930503d507592bf728;Sampled=0
x-amzn-remapped-date: Sat, 17 Sep 2022 21:31:40 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: -hhkLqfURsIBwgNHxoMM002WynFjq5WJ62bNRbXhFxH6dbmZD7zm2g==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 2ab6211e66998c8b58132661a7e3cade.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 22:10:51 GMT
age: 78672
etag: "04063797f76518668fdd9a5d5a86c7637eac43b8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
heya.today/css/dark.css
99.192.224.70200 OK 49 kB IP 99.192.224.70:0
Hash 14db029ff0061c8731c9fab007802c34
80f12ee25f9cce1e9ec66d88506621802f08780e
df94a7c9445b6c4e56eee884c779428e6c90995e404d3b08fffd647fa3e95330
GET /css/dark.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 48770
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/css/animate.css
99.192.224.70200 OK 90 kB URL HTTP/2 heya.today/css/animate.css
IP 99.192.224.70:0
Hash 88c24e437ebcc966247369463639c90a
4d1181a77fc2319c664096176886c1f4c91b43f6
a950859f0d8002e2647b7b8fc4498ba36f72489619ca84a5d0229656019be05c
GET /css/animate.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 89704
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/css/magnific-popup.css
99.192.224.70200 OK 7.3 kB URL HTTP/2 heya.today/css/magnific-popup.css
IP 99.192.224.70:0
Hash bd3439ab2014971767f1de6ee61ebb84
67d6917ff6d4734f668f023e46765494b990bca1
7a53eeb87a94ddde169539c9ab0e20eb49ea9e59cad50406302b0538b03d3a32
GET /css/magnific-popup.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 7332
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/css/custom.css
99.192.224.70200 OK 268 B URL HTTP/2 heya.today/css/custom.css
IP 99.192.224.70:0
Hash 04cf7e63dc1e98251e56a027b09e160f
f6134124b935956d99bf8db3cdc44bc8d793a8fc
98cd464f3960ef6f6279c2b10115c065c735ff59dfb9236018fbc41c37219f2f
GET /css/custom.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 268
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/css/colors.php?color=FF8600
99.192.224.70200 OK 9.4 kB URL HTTP/2 heya.today/css/colors.php?color=FF8600
IP 99.192.224.70:0
Hash a712949e3c4d63017cccacc550e7dcb0
d8f19ec9f608cec38911e3a0ff3ce27a442b1aef
4b69bb9b3d39ca2f61c6aae034ca20ede1f4834f387926377e01b01ee412c63e
GET /css/colors.php?color=FF8600 HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: application/octet-stream
content-length: 9395
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/demos/news/css/fonts.css
99.192.224.70200 OK 1.0 kB URL HTTP/2 heya.today/demos/news/css/fonts.css
IP 99.192.224.70:0
Hash 53c3ec2a1f9e3f2427f1ed90daff8576
7906476e0fb913e9fc284c6267d28eb3727f38c8
c439e78fb3ec09c5c554bbcd38bee96c89505af3c677add82ccb6c459ec852b5
GET /demos/news/css/fonts.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 1049
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/demos/news/news.css
99.192.224.70200 OK 13 kB URL HTTP/2 heya.today/demos/news/news.css
IP 99.192.224.70:0
Hash 6cc6f11776e5a90ab2e07bd4cd2415cf
b2aeefe3ebd08797bd16f6444281ab6f862eb878
b2782cea1456ffbf1b342a8937180c77aa5c3d82833e3a9b52b692800c5da8fb
GET /demos/news/news.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 13276
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/css/font-icons.css
99.192.224.70200 OK 123 kB URL HTTP/2 heya.today/css/font-icons.css
IP 99.192.224.70:0
Size 123 kB (122677 bytes)
Hash da4e62e317f47bcacfbf448c338ee382
92fadeb976e7e8154575500792e6ae8236faf108
489281a64c3c7821929eac74ad520f46edced4f81d5719fbcae7579c6be9dfe4
GET /css/font-icons.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 122677
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/img/icon.png
99.192.224.70200 OK 68 B IP 99.192.224.70:0
File type PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced\012- data
Hash 24693e546434dd0fd40707a301106d3e
91d4073d16df6cfdb5bd6d8950bb3154f1438960
d39cae93ecafb8d8e55d5df425af460a4cba9def94c8811ac4bd5ce6d48adb37
GET /img/icon.png HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: image/png
content-length: 68
last-modified: Tue, 09 Mar 2021 08:04:05 GMT
etag: "60472bf5-44"
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/demos/HEYA.png
99.192.224.70200 OK 9.1 kB URL HTTP/2 heya.today/demos/HEYA.png
IP 99.192.224.70:0
File type PNG image data, 184 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash 63f948b459405a765027d42d1fdedaf2
f00ff4a8057e0e4148ba37d0bfaf2c1b4a3e93ca
7c79b0d224fba16a7108b3144784f8592220c2d9f4633c372a6b3fe892857071
GET /demos/HEYA.png HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: image/png
content-length: 9091
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
heya.today/style.css
99.192.224.70200 OK 334 kB IP 99.192.224.70:0
Size 334 kB (333681 bytes)
Hash cf2f8d1244d826c88a15c8b2b35c42f7
e78cdd51b1b32db2c7bcf7ebe58637d861011e1b
7c21f9fb759c0bb25819f7a6e0bda38d22fd9a02ef6df4bd7ee8ff4a24df0881
GET /style.css HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:03 GMT
content-type: text/css
content-length: 333681
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
last-modified: Wed, 14 Sep 2022 13:23:55 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 4f5180e6651455bc8443945fb5b6860c
01457b8648200c9d274b2790b95274b1dc855aaf
39301cccc2805993f794301cb01a70a954e7c8a8e5d6779acc4888f77d7282c0
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
142.250.74.163200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 142.250.74.163:0
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://heya.today
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: font/woff2
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
date: Mon, 19 Sep 2022 20:02:04 GMT
expires: Tue, 19 Sep 2023 20:02:04 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash a9323cf0781cad0d5ac23f0c81c105b1
772d0218be53da9f875bb96a287c904976c296da
5c808b03cd8dd26275f12a850d8a36b467246c1461ea65a4c717acb04f2ca722
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 20:02:04 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
region1.google-analytics.com/g/collect?v=2&tid=G-TBR6YBVH1L>m=2oe9e0&_p=1759102570&cid=1712473449.1663617705&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1663617704&sct=1&seg=0&dl=https%3A%2F%2Fheya.today%2F1&dr=http%3A%2F%2Fps.popcash.net%2F&dt=Heya%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
216.239.34.36204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-TBR6YBVH1L>m=2oe9e0&_p=1759102570&cid=1712473449.1663617705&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1663617704&sct=1&seg=0&dl=https%3A%2F%2Fheya.today%2F1&dr=http%3A%2F%2Fps.popcash.net%2F&dt=Heya%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP 216.239.34.36:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-TBR6YBVH1L>m=2oe9e0&_p=1759102570&cid=1712473449.1663617705&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1663617704&sct=1&seg=0&dl=https%3A%2F%2Fheya.today%2F1&dr=http%3A%2F%2Fps.popcash.net%2F&dt=Heya%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://heya.today
Connection: keep-alive
Referer: https://heya.today/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://heya.today
date: Mon, 19 Sep 2022 20:02:04 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
heya.today/favicon.ico
99.192.224.70404 Not Found 0 B IP 99.192.224.70:0
GET /favicon.ico HTTP/1.1
Host: heya.today
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://heya.today/1
Cookie: JSESSIONID=75CEF45F9E7103CD4EC8F143722F5BE2; _ga_TBR6YBVH1L=GS1.1.1663617704.1.0.1663617704.0.0.0; _ga=GA1.1.1712473449.1663617705
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.1
date: Mon, 19 Sep 2022 20:02:04 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
X-Firefox-Spdy: h2