Overview

URLxtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
IP 192.185.117.118 (United States)
ASN#46606 UNIFIEDLAYER-AS-1
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-12-02 10:13:31 UTC
StatusLoading report..
IDS alerts0
Blocklist alert28
urlquery alerts No alerts detected
Tags None

Domain Summary (21)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
xtc-hair.com (41) 0 2019-04-09 04:16:55 UTC 2022-11-30 09:59:50 UTC 192.185.117.118 Unknown ranking
www.googletagmanager.com (1) 75 2013-05-22 02:07:37 UTC 2022-12-01 18:48:44 UTC 142.250.74.168
stats.g.doubleclick.net (1) 96 2013-06-10 20:21:11 UTC 2022-12-01 20:40:43 UTC 108.177.14.156
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 54.71.202.2
i0.wp.com (2) 3021 2013-09-17 06:14:42 UTC 2022-12-01 17:17:02 UTC 192.0.77.2
s.w.org (2) 748 2017-01-30 04:56:16 UTC 2022-12-01 17:16:17 UTC 192.0.77.48
www.google-analytics.com (1) 40 2012-10-03 01:04:21 UTC 2022-12-01 21:18:15 UTC 216.58.207.206
connect.facebook.net (1) 139 2012-05-22 02:51:28 UTC 2020-02-17 13:26:09 UTC 157.240.240.1
ocsp.digicert.com (4) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-12-01 17:12:49 UTC 34.117.237.239
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76
pixel.wp.com (1) 2545 2017-01-30 05:31:40 UTC 2022-12-01 17:22:35 UTC 192.0.76.3
www.facebook.com (1) 99 2012-05-21 00:23:41 UTC 2021-06-08 06:38:51 UTC 157.240.240.35
r3.o.lencr.org (8) 344 No data No data 23.36.77.32
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-12-01 17:14:08 UTC 34.102.187.140
ocsp.pki.goog (8) 175 2018-07-01 06:43:07 UTC 2020-05-02 20:58:16 UTC 216.58.211.3
www.google.com (1) 7 2016-03-22 03:56:07 UTC 2022-12-01 18:17:59 UTC 142.250.74.132
www.gstatic.com (1) 0 2016-07-26 09:37:06 UTC 2022-12-01 17:12:24 UTC 142.250.74.35 Domain (gstatic.com) ranked at: 540
fonts.gstatic.com (2) 0 2014-09-09 00:40:21 UTC 2022-12-01 22:08:56 UTC 142.250.74.35 Domain (gstatic.com) ranked at: 540
stats.wp.com (1) 2711 2017-01-30 05:06:59 UTC 2022-12-01 17:13:41 UTC 192.0.76.3

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-02 2 xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/ Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/wp-includes/css/classic-themes.min.css?ver=1 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/wp-store-locator/css/styles.min.css?ver=2.2.235 Phishing
2022-12-02 2 xtc-hair.com/wp-content/themes/spacious/js/spacious-custom.js?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.4 Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js (...) Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?v (...) Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/wp-gallery-custom-links/wp-gallery-custom-l (...) Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/wp-facebook-pixel/assets/NSAFacebookPixel.min.js Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/wp-facebook-pixel/inc/scripts/nsautilities. (...) Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/comment-reply.min.js?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1664461981 Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 Phishing
2022-12-02 2 xtc-hair.com/wp-content/themes/spacious/assets/fonts/Lato-Bold.woff Phishing
2022-12-02 2 xtc-hair.com/wp-content/themes/spacious/assets/fonts/Lato-Regular.woff Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/lightweight-social-icons/fonts/fontello.woff Phishing
2022-12-02 2 xtc-hair.com/wp-content/themes/spacious/assets/fonts/Lato-Italic.woff Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?v (...) Phishing
2022-12-02 2 xtc-hair.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/wp-content/themes/spacious/style.css?ver=6.1.1 Phishing
2022-12-02 2 xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/ Phishing
2022-12-02 2 xtc-hair.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 Phishing
2022-12-02 2 xtc-hair.com/wp-content/plugins/jetpack/css/jetpack.css?ver=11.5.1 Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 192.185.117.118
Date UQ / IDS / BL URL IP
2022-12-02 10:13:31 +0000 0 - 0 - 28 xtc-hair.com/full-download-edius-pro-6-5-crac (...) 192.185.117.118
2022-11-29 13:48:08 +0000 0 - 0 - 3 xtc-hair.com/ 192.185.117.118
2022-10-21 22:30:16 +0000 0 - 0 - 2 xtc-hair.com/wp-content/uploads/2022/09/carag (...) 192.185.117.118
2022-09-27 10:15:30 +0000 0 - 0 - 28 xtc-hair.com/keygen-alias-speedform-2019-exclusive 192.185.117.118
2022-09-15 15:43:39 +0000 0 - 0 - 3 xtc-hair.com/wp-content/uploads/2022/06/gaswel.pdf 192.185.117.118


Last 5 reports on ASN: UNIFIEDLAYER-AS-1
Date UQ / IDS / BL URL IP
2023-01-29 09:08:47 +0000 0 - 0 - 1 testeapp.altdesigner.com.br/homee.zip 162.240.11.196
2023-01-29 09:08:32 +0000 0 - 0 - 1 catherinemorris.com/file/tatal.zip 74.220.199.6
2023-01-29 09:08:20 +0000 0 - 0 - 2 solarsolarenergy.com/zbi.zip 162.241.24.173
2023-01-29 09:07:54 +0000 0 - 0 - 1 eig-kristinjangro.com/document/PDF 74.220.199.6
2023-01-29 09:04:03 +0000 0 - 0 - 2 indlovulekhulu.com/scripts/webmail.earth-core (...) 192.185.75.212


Last 5 reports on domain: xtc-hair.com
Date UQ / IDS / BL URL IP
2023-01-19 19:03:05 +0000 0 - 0 - 1 xtc-hair.com/ 104.21.2.210
2022-12-02 10:13:31 +0000 0 - 0 - 28 xtc-hair.com/full-download-edius-pro-6-5-crac (...) 192.185.117.118
2022-11-29 13:48:08 +0000 0 - 0 - 3 xtc-hair.com/ 192.185.117.118
2022-10-21 22:30:16 +0000 0 - 0 - 2 xtc-hair.com/wp-content/uploads/2022/09/carag (...) 192.185.117.118
2022-09-27 10:15:30 +0000 0 - 0 - 28 xtc-hair.com/keygen-alias-speedform-2019-exclusive 192.185.117.118


No other reports with similar screenshot

JavaScript

Executed Scripts (32)

Executed Evals (6)
#1 JavaScript::Eval (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
#2 JavaScript::Eval (size: 22) - SHA256: 9bb0c662c12831d4a6a9d504b2534e28f08b91591da1303a05ad2b3e12a6e49e
0,
function(y) {
    xz(1, y)
}
#3 JavaScript::Eval (size: 15588) - SHA256: 0d4559ba47020dfb3d3229a79fae241152a0337f86a9c8a01bd5add41c1753b7
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var y = this || self,
        e = function(R) {
            return R
        },
        q = function(R, n) {
            if ((n = (R = y.trustedTypes, null), !R) || !R.createPolicy) return n;
            try {
                n = R.createPolicy("bg", {
                    createHTML: e,
                    createScript: e,
                    createScriptURL: e
                })
            } catch (k) {
                y.console && y.console.error(k.message)
            }
            return n
        };
    (0, eval)(function(R, n) {
        return (n = q()) && 1 === R.eval(n.createScript("1")) ? function(k) {
            return n.createScript(k)
        } : function(k) {
            return "" + k
        }
    }(y)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var p=function(R,n,k){k[V(R,n,k),Rl]=2796},nX=function(R,n){return R(function(k){k(n)}),[function(){return n}]},kz=function(R,n,k,q,c){for(n=(q=(c=n[3]|0,0),n[2])|0;14>q;q++)c=c>>>8|c<<24,k=k>>>8|k<<24,k+=R|0,c+=n|0,k^=n+2298,R=R<<3|R>>>29,c^=q+2298,R^=k,n=n<<3|n>>>29,n^=c;return[R>>>24&255,R>>>16&255,R>>>8&255,R>>>0&255,k>>>24&255,k>>>16&255,k>>>8&255,k>>>0&255]},E,L=function(R,n,k,q,c,y,e,K,N,Q,Z,w,U,h){if(y=v(n,278),y>=n.B)throw[x,31];for(c=(K=0,q=R,Q=y,n.c0.length);0<q;)Z=Q%8,N=8-(Z|0),N=N<q?N:q,U=Q>>3,w=n.i[U],k&&(e=n,e.A!=Q>>6&&(e.A=Q>>6,h=v(e,358),e.l=kz(e.O,[0,0,h[1],h[2]],e.A)),w^=n.l[U&c]),K|=(w>>8-(Z|0)-(N|0)&(1<<N)-1)<<(q|0)-(N|0),Q+=N,q-=N;return V(278,n,(k=K,(y|0)+(R|0))),k},yB=function(R,n,k,q){try{q=R[((n|0)+2)%3],R[n]=(R[n]|0)-(R[((n|0)+1)%3]|0)-(q|0)^(1==n?q<<k:q>>>k)}catch(c){throw c;}},eM=function(R,n){return n=P(R),n&128&&(n=n&127|P(R)<<7),n},qX=function(R,n,k){if((n=typeof R,"object")==n)if(R){if(R instanceof Array)return"array";if(R instanceof Object)return n;if("[object Window]"==(k=Object.prototype.toString.call(R),k))return"object";if("[object Array]"==k||"number"==typeof R.length&&"undefined"!=typeof R.splice&&"undefined"!=typeof R.propertyIsEnumerable&&!R.propertyIsEnumerable("splice"))return"array";if("[object Function]"==k||"undefined"!=typeof R.call&&"undefined"!=typeof R.propertyIsEnumerable&&!R.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==n&&"undefined"==typeof R.call)return"object";return n},C=function(R,n){R.P.splice(0,0,n)},G=function(R,n,k,q,c,y){if(n.C==n)for(c=v(n,R),421==R?(R=function(e,K,N,Q){if(c.mm!=(Q=((K=c.length,K)|0)-4>>3,Q)){Q=(c.mm=(N=[0,0,y[1],y[2]],Q),(Q<<3)-4);try{c.nk=kz(KX(c,Q),N,KX(c,(Q|0)+4))}catch(Z){throw Z;}}c.push(c.nk[K&7]^e)},y=v(n,408)):R=function(e){c.push(e)},q&&R(q&255),n=k.length,q=0;q<n;q++)R(k[q])},NX=function(R,n,k,q){for(;R.P.length;){k=(R.F=null,R).P.pop();try{q=ca(R,k)}catch(c){r(R,c)}if(n&&R.F){n=R.F,n(function(){B(true,R,true)});break}}return q},QB=function(R,n,k,q){return(q=I[R.substring(0,3)+"_"])?q(R.substring(3),n,k):nX(n,R)},sk=function(R,n,k,q,c){G(((c=(k=u((c=u((q=n&4,n&=3,R)),R)),v(R,c)),q)&&(c=pX(""+c)),n&&G(k,R,D(2,c.length)),k),R,c)},l=function(R,n,k,q,c,y,e,K,N){if((R.C=(((K=(y=(N=(c=(e=0<(k||R.X++,R).U&&R.S&&R.xh&&1>=R.J&&!R.L&&!R.F&&(!k||1<R.Z-n)&&0==document.hidden,4==R.X))||e?R.s():R.T,N-R.T),y)>>14,R).O&&(R.O^=K*(y<<2)),R).Y+=K,K||R.C),c)||e)R.X=0,R.T=N;if(!e||N-R.H<R.U-(q?255:k?5:2))return false;return!((V(278,(q=v(R,(R.Z=n,k?426:278)),R),R.B),R.P).push([jM,q,k?n+1:n]),R.F=z,0)},Ek=function(R,n,k){if(3==R.length){for(k=0;3>k;k++)n[k]+=R[k];for(k=[(R=0,13),8,13,12,16,5,3,10,15];9>R;R++)n[3](n,R%3,k[R])}},u=function(R,n){if(R.L)return Zn(R,R.N);return n=L(8,R,true),n&128&&(n^=128,R=L(2,R,true),n=(n<<2)+(R|0)),n},KX=function(R,n){return R[n]<<24|R[(n|0)+1]<<16|R[(n|0)+2]<<8|R[(n|0)+3]},we=function(R,n,k,q,c,y,e,K){return(c=d[n.I]((k=[-2,42,-72,-(y=va,46),-26,-71,k,61,(K=q&7,9),2],n.MJ)),c)[n.I]=function(N){e=N,K+=6+7*q,K&=7},c.concat=function(N){return(N=(e=(N=+(N=R%16+1,k)[K+59&7]*R*N-N*e- -2440*e+(y()|0)*N+1*R*R*N-2562*R*e-61*R*R*e+K+61*e*e,void 0),k[N]),k[(K+69&7)+(q&2)]=N,k)[K+(q&2)]=42,N},c},V=function(R,n,k){if(278==R||426==R)n.u[R]?n.u[R].concat(k):n.u[R]=h8(n,k);else{if(n.D&&358!=R)return;305==R||421==R||352==R||236==R||408==R?n.u[R]||(n.u[R]=we(R,n,k,54)):n.u[R]=we(R,n,k,113)}358==R&&(n.O=L(32,n,false),n.A=void 0)},P=function(R){return R.L?Zn(R,R.N):L(8,R,true)},B=function(R,n,k,q,c,y){if(n.P.length){(n.S=!(n.S&&0(),0),n).xh=k;try{q=n.s(),n.H=q,n.T=q,n.X=0,c=NX(n,k),y=n.s()-n.H,n.G+=y,y<(R?0:10)||0>=n.g--||(y=Math.floor(y),n.K.push(254>=y?y:254))}finally{n.S=false}return c}},xz=function(R,n,k,q){for(k=(q=u(n),0);0<R;R--)k=k<<8|P(n);V(q,n,k)},I,Pa=function(R,n,k,q){return v(R,(LX((q=v(R,278),R.i&&q<R.B?(V(278,R,R.B),Uk(k,R)):V(278,R,k),n),R),V(278,R,q),15))},Tu=function(R,n,k,q,c){for(c=(q=(k.In=(k.MJ=J8(k.I,(k.v0=(k.NJ=be,CX),k.c0=k[F],{get:function(){return this.concat()}})),d)[k.I](k.MJ,{value:{value:{}}}),[]),0);128>c;c++)q[c]=String.fromCharCode(c);B((C((C(k,(C(k,(p(340,(V((V(305,k,[160,((V(307,(V(327,(V(236,k,(p(59,k,(p(127,k,(p(119,(V(421,k,(V(270,k,(p(87,(p(158,(p(396,k,(p(448,k,(k.on=(p(362,(k.E9=(p((p(250,k,(p(371,(V(15,(p(354,k,(V(352,k,((p(442,k,(p(227,k,(p(103,k,(p(11,k,(p(121,(V(289,(p(173,(V(409,k,(p(275,k,(p(317,(p(375,k,(p(432,((p((p(295,(V(278,k,(k.B0=(k.wE=(k.P0=function(y){this.C=y},k.u=(k.R=void 0,[]),k.F=((k.O=(k.N=void 0,void 0),k.Y=1,k.U=0,(k.Rn=[],k).C=k,c=window.performance||{},k.j=[],(k.J=0,k).T=0,k.B=0,k.S=((k.A=void 0,k.X=void 0,k).i=[],k.H=(k.P=(k.xh=false,[]),k.g=(k.G=0,25),0),k.L=(k.l=void 0,void 0),k.D=false,k.Z=8001,false),k).K=[],null),0),c).timeOrigin||(c.timing||{}).navigationStart||0,0)),V(426,k,0),k),function(y,e,K,N){V((e=v(y,(N=(K=(N=(e=u(y),u(y)),u(y)),v(y,N)),e)),K),y,e in N|0)}),163),k,function(y,e,K,N){!l(y,e,true,false)&&(e=re(y),N=e.Ck,K=e.h,y.C==y||K==y.P0&&N==y)&&(V(e.un,y,K.apply(N,e.o)),y.T=y.s())}),p)(341,k,function(y,e,K,N){if(N=y.Rn.pop()){for(K=P(y);0<K;K--)e=u(y),N[e]=y.u[e];y.u=(N[236]=y.u[236],N[307]=y.u[307],N)}else V(278,y,y.B)}),k),function(y,e){(e=v(y,u(y)),Uk)(e,y.C)}),function(y,e,K,N){(e=v(y,(N=v((K=(N=u((e=u(y),y)),u(y)),y),N),e))==N,V)(K,y,+e)})),k),function(y){xz(4,y)}),function(y,e,K,N,Q,Z){if(!l(y,e,true,true)){if("object"==(y=v((N=(Q=v((e=v((N=(e=(Q=(Z=u(y),u)(y),u(y)),u)(y),y),e),y),Q),v(y,N)),y),Z),qX)(y)){for(K in Z=[],y)Z.push(K);y=Z}for(Z=(e=0<e?e:1,K=y.length,0);Z<K;Z+=e)Q(y.slice(Z,(Z|0)+(e|0)),N)}})),p(193,k,function(y,e,K,N,Q){0!==(Q=v(y,(K=(e=v((N=v(y,(N=(Q=u((K=u(y),y)),e=u(y),u(y)),N)),y),e),v(y.C,K)),Q)),K)&&(N=Ba(e,N,y,1,K,Q),K.addEventListener(Q,N,W),V(270,y,[K,Q,N]))}),687)),k),function(y){sk(y,4)}),k),0),k),function(){}),function(y,e,K,N,Q,Z,w){for(w=(e=(K=(N=u(y),Z=eM(y),Q="",v(y,115)),K.length),0);Z--;)w=((w|0)+(eM(y)|0))%e,Q+=q[K[w]];V(N,y,Q)})),function(y,e,K){K=v((e=(K=(e=u(y),u(y)),0!=v(y,e)),y),K),e&&V(278,y,K)})),function(y,e,K,N,Q){for(K=(e=(N=u(y),eM)(y),0),Q=[];K<e;K++)Q.push(P(y));V(N,y,Q)})),function(y,e,K){(e=u((K=u(y),y)),V)(e,y,""+v(y,K))})),V)(408,k,[0,0,0]),[])),function(y,e,K,N,Q,Z,w,U,h,T,Y,J){function f(b,a){for(;e<b;)T|=P(y)<<e,e+=8;return T>>=(a=T&(e-=b,(1<<b)-1),b),a}for(K=(h=(U=(Y=(e=T=(Z=u(y),0),f(3)|0)+1,f(5)),0),[]),Q=0;Q<U;Q++)J=f(1),K.push(J),h+=J?0:1;for(Q=(N=(h=((h|0)-1).toString(2).length,[]),0);Q<U;Q++)K[Q]||(N[Q]=f(h));for(h=0;h<U;h++)K[h]&&(N[h]=u(y));for(w=[];Y--;)w.push(v(y,u(y)));p(Z,y,function(b,a,O,VB,X){for(O=(VB=(X=[],[]),0);O<U;O++){if(a=N[O],!K[O]){for(;a>=X.length;)X.push(u(b));a=X[a]}VB.push(a)}b.L=h8(b,w.slice()),b.N=h8(b,VB)})})),k),{}),k),function(y){al(y,1)}),function(y,e,K){l(y,e,true,false)||(e=u(y),K=u(y),V(K,y,function(N){return eval(N)}(Gu(v(y.C,e)))))})),499),k,function(y){sk(y,3)}),0),k),function(y,e,K,N){K=(N=P((e=u(y),y)),u(y)),V(K,y,v(y,e)>>>N)}),0),function(y,e,K,N){V((e=v(y,(N=v(y,(K=u((N=u(y),y)),N)),K)),K),y,e+N)})),function(y,e){y=(e=u(y),v)(y.C,e),y[0].removeEventListener(y[1],y[2],W)})),k),function(y,e,K,N,Q){V((K=v(y,(N=(Q=v(y,(Q=(N=(K=(e=u(y),u(y)),u(y)),u)(y),Q)),v(y,N)),K)),e),y,Ba(K,N,y,Q))}),k),function(y,e,K){V((K=v(y,(e=(K=u(y),u(y)),K)),K=qX(K),e),y,K)}),0)),S(4))),k),function(y,e,K,N,Q,Z){l(y,e,true,false)||(N=re(y.C),e=N.o,Z=N.Ck,Q=N.h,K=e.length,N=N.un,e=0==K?new Z[Q]:1==K?new Z[Q](e[0]):2==K?new Z[Q](e[0],e[1]):3==K?new Z[Q](e[0],e[1],e[2]):4==K?new Z[Q](e[0],e[1],e[2],e[3]):2(),V(N,y,e))}),function(y,e,K,N){N=u((e=u(y),y)),K=u(y),y.C==y&&(N=v(y,N),K=v(y,K),v(y,e)[N]=K,358==e&&(y.A=void 0,2==N&&(y.O=L(32,y,false),y.A=void 0)))})),function(y){al(y,4)})),[])),k),H),k),2048),k).an=0,0),0]),120),k,k),k),function(y,e,K,N){V((K=v((e=v(y,(N=u((K=u((e=u(y),y)),y)),e)),y),K),N),y,e[K])}),p(472,k,function(y,e,K,N){N=(e=u(y),u)(y),K=u(y),V(K,y,v(y,e)||v(y,N))}),[Rl])),[A,n])),k),[Il,R]),true),k,true)},J8=function(R,n){return d[R](d.prototype,{pop:n,replace:n,length:n,document:n,splice:n,parent:n,stack:n,floor:n,prototype:n,console:n,call:n,propertyIsEnumerable:n})},pX=function(R,n,k,q,c){for(q=(R=R.replace(/\\r\\n/g,"\\n"),n=0,[]),k=0;n<R.length;n++)c=R.charCodeAt(n),128>c?q[k++]=c:(2048>c?q[k++]=c>>6|192:(55296==(c&64512)&&n+1<R.length&&56320==(R.charCodeAt(n+1)&64512)?(c=65536+((c&1023)<<10)+(R.charCodeAt(++n)&1023),q[k++]=c>>18|240,q[k++]=c>>12&63|128):q[k++]=c>>12|224,q[k++]=c>>6&63|128),q[k++]=c&63|128);return q},LX=function(R,n,k,q,c,y){if(!n.R){n.J++;try{for(k=(q=(y=void 0,n).B,0);--R;)try{if((c=void 0,n).L)y=Zn(n,n.L);else{if(k=v(n,278),k>=q)break;y=(c=(V(426,n,k),u(n)),v)(n,c)}(y&&y[ue]&2048?y(n,R):M(n,0,[x,21,c]),l)(n,R,false,false)}catch(e){v(n,409)?M(n,22,e):V(409,n,e)}if(!R){if(n.Lk){n.J--,LX(338687074593,n);return}M(n,0,[x,33])}}catch(e){try{M(n,22,e)}catch(K){r(n,K)}}n.J--}},Zn=function(R,n){return(n=n.create().shift(),R.L.create()).length||R.N.create().length||(R.L=void 0,R.N=void 0),n},Dn=function(R,n,k,q){function c(){}return{invoke:(k=QB((q=void 0,R),function(y){c&&(n&&z(n),q=y,c(),c=void 0)},!!n)[0],function(y,e,K,N){function Q(){q(function(Z){z(function(){y(Z)})},K)}if(!e)return e=k(K),y&&y(e),e;q?Q():(N=c,c=function(){N(),z(Q)})})}},v=function(R,n){if(void 0===(R=R.u[n],R))throw[x,30,n];if(R.value)return R.create();return R.create(1*n*n+42*n+-40),R.prototype},D=function(R,n,k,q){for(k=(q=(R|0)-1,[]);0<=q;q--)k[(R|0)-1-(q|0)]=n>>8*q&255;return k},Uk=function(R,n){V(278,((n.Rn.push(n.u.slice()),n.u)[278]=void 0,n),R)},r=function(R,n){R.R=((R.R?R.R+"~":"E:")+n.message+":"+n.stack).slice(0,2048)},fX=function(R,n,k){return n.W(function(q){k=q},false,R),k},Ba=function(R,n,k,q,c,y){function e(){if(k.C==k){if(k.u){var K=[m,R,n,void 0,c,y,arguments];if(2==q)var N=B(false,(C(k,K),k),false);else if(1==q){var Q=!k.P.length;C(k,K),Q&&B(false,k,false)}else N=ca(k,K);return N}c&&y&&c.removeEventListener(y,e,W)}}return e},S=function(R,n){for(n=[];R--;)n.push(255*Math.random()|0);return n},ca=function(R,n,k,q,c){if(c=n[0],c==g)R.g=25,R.v(n);else if(c==F){q=n[1];try{k=R.R||R.v(n)}catch(y){r(R,y),k=R.R}q(k)}else if(c==jM)R.v(n);else if(c==A)R.v(n);else if(c==Il){try{for(k=0;k<R.j.length;k++)try{q=R.j[k],q[0][q[1]](q[2])}catch(y){}}catch(y){}(0,n[R.j=[],1])(function(y,e){R.W(y,true,e)},function(y){(C((y=!R.P.length,R),[ue]),y)&&B(false,R,true)})}else{if(c==m)return k=n[2],V(126,R,n[6]),V(15,R,k),R.v(n);c==ue?(R.K=[],R.i=[],R.u=null):c==Rl&&"loading"===H.document.readyState&&(R.F=function(y,e){function K(){e||(e=true,y())}H.document.addEventListener("DOMContentLoaded",(e=false,K),W),H.addEventListener("load",K,W)})}},al=function(R,n,k,q){G((k=u(R),q=u(R),q),R,D(n,v(R,k)))},$z=function(R,n){if((R=null,n=H.trustedTypes,!n)||!n.createPolicy)return R;try{R=n.createPolicy("bg",{createHTML:zu,createScript:zu,createScriptURL:zu})}catch(k){H.console&&H.console.error(k.message)}return R},zu=function(R){return R},M=function(R,n,k,q,c,y){if(!R.D){if((k=v(R,(n=(0==(q=((c=void 0,k&&k[0]===x)&&(c=k[2],n=k[1],k=void 0),v)(R,236),q).length&&(y=v(R,426)>>3,q.push(n,y>>8&255,y&255),void 0!=c&&q.push(c&255)),""),k&&(k.message&&(n+=k.message),k.stack&&(n+=":"+k.stack)),307)),3)<k){R.C=(c=(n=pX((k-=((n=n.slice(0,(k|0)-3),n.length)|0)+3,n)),R.C),R);try{G(421,R,D(2,n.length).concat(n),9)}finally{R.C=c}}V(307,R,k)}},H=this||self,t=function(R,n,k){k=this;try{Tu(n,R,this)}catch(q){r(this,q),n(function(c){c(k.R)})}},h8=function(R,n,k){return k=d[R.I](R.In),k[R.I]=function(){return n},k.concat=function(q){n=q},k},W={passive:true,capture:true},re=function(R,n,k,q,c,y){for(q=(c=(n=(k=u((y=R[le]||{},R)),y.un=u(R),y.o=[],R.C==R?(P(R)|0)-1:1),u(R)),0);q<n;q++)y.o.push(u(R));for(y.Ck=v(R,c);n--;)y.o[n]=v(R,y.o[n]);return y.h=v(R,k),y},z=H.requestIdleCallback?function(R){requestIdleCallback(function(){R()},{timeout:4})}:H.setImmediate?function(R){setImmediate(R)}:function(R){setTimeout(R,0)},de=function(R,n){n.push(R[0]<<24|R[1]<<16|R[2]<<8|R[3]),n.push(R[4]<<24|R[5]<<16|R[6]<<8|R[7]),n.push(R[8]<<24|R[9]<<16|R[10]<<8|R[11])},le=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),x=((t.prototype.V="toString",t.prototype.Lk=false,t).prototype.Qy=void 0,{}),g=[],Il=[],jM=[],A=[],m=[],ue=(t.prototype.kh=void 0,[]),F=[],Rl=[],d=(E=((de,function(){})(S),yB,Ek,t.prototype),E.zc=function(){return Math.floor(this.G+(this.s()-this.H))},x.constructor),va=(E.s=(t.prototype.I="create",(E.dE=(E.W=function(R,n,k,q,c){if((k="array"===qX(k)?k:[k],this).R)R(this.R);else try{q=!this.P.length,c=[],C(this,[g,c,k]),C(this,[F,R,c]),n&&!q||B(true,this,n)}catch(y){r(this,y),R(this.R)}},function(R,n,k,q,c,y){for(c=q=0,y=[];q<R.length;q++)for(c+=n,k=k<<n|R[q];7<c;)c-=8,y.push(k>>c&255);return y}),(E.eN=(E.s9=function(R,n,k){return((n=(n^=n<<13,n^=n>>17,(n^n<<5)&k))||(n=1),R)^n},function(R,n,k,q,c){for(q=c=0;c<R.length;c++)q+=R.charCodeAt(c),q+=q<<10,q^=q>>6;return c=new Number((q+=q<<3,q^=q>>11,R=q+(q<<15)>>>0,R&(1<<n)-1)),c[0]=(R>>>n)%k,c}),E.FH=function(){return Math.floor(this.s())},window.performance||{}).now)?function(){return this.B0+window.performance.now()}:function(){return+new Date}),void 0),CX=((t.prototype.v=function(R,n){return n={},va=(R={},function(){return n==R?-40:9}),function(k,q,c,y,e,K,N,Q,Z,w,U,h,T,Y,J){n=(Y=n,R);try{if(h=k[0],h==A){T=k[1];try{for(Q=(y=atob(T),e=[],K=0);Q<y.length;Q++)J=y.charCodeAt(Q),255<J&&(e[K++]=J&255,J>>=8),e[K++]=J;V(358,this,(this.B=(this.i=e,this.i).length<<3,[0,0,0]))}catch(f){M(this,17,f);return}LX(8001,this)}else if(h==g)k[1].push(v(this,307),v(this,421).length,v(this,352).length,v(this,305).length),V(15,this,k[2]),this.u[349]&&Pa(this,8001,v(this,349));else{if(h==F){this.C=(Z=(U=D(2,(v(this,(K=k[2],305)).length|0)+2),this.C),this);try{w=v(this,236),0<w.length&&G(305,this,D(2,w.length).concat(w),10),G(305,this,D(1,this.Y),109),G(305,this,D(1,this[F].length)),y=0,y-=(v(this,305).length|0)+5,y+=v(this,289)&2047,q=v(this,421),4<q.length&&(y-=(q.length|0)+3),0<y&&G(305,this,D(2,y).concat(S(y)),15),4<q.length&&G(305,this,D(2,q.length).concat(q),156)}finally{this.C=Z}if(c=((Q=S(2).concat(v(this,305)),Q[1]=Q[0]^6,Q[3]=Q[1]^U[0],Q)[4]=Q[1]^U[1],this.rE(Q)))c="!"+c;else for(c="",y=0;y<Q.length;y++)N=Q[y][this.V](16),1==N.length&&(N="0"+N),c+=N;return v(this,(v((v((V(307,this,(e=c,K.shift())),this),421).length=K.shift(),this),352).length=K.shift(),305)).length=K.shift(),e}if(h==jM)Pa(this,k[2],k[1]);else if(h==m)return Pa(this,8001,k[1])}}finally{n=Y}}}(),t.prototype).rE=function(R,n,k,q){if(n=window.btoa){for(q=(k=0,"");k<R.length;k+=8192)q+=String.fromCharCode.apply(null,R.slice(k,k+8192));R=n(q).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else R=void 0;return R},/./);(t.prototype.Ax=0,t.prototype).yy=0;var be,Fn=A.pop.bind((t.prototype[Il]=[0,0,1,1,0,1,1],t).prototype[g]),Gu=function(R,n){return(n=$z())&&1===R.eval(n.createScript("1"))?function(k){return n.createScript(k)}:function(k){return""+k}}(((be=J8(t.prototype.I,{get:(CX[t.prototype.V]=Fn,Fn)}),t.prototype).O9=void 0,H));40<(I=H.botguard||(H.botguard={}),I.m)||(I.m=41,I.bg=Dn,I.a=QB),I.bDL_=function(R,n,k){return k=new t(R,n),[function(q){return fX(q,k)}]};}).call(this);'));
}).call(this);
#4 JavaScript::Eval (size: 20210) - SHA256: 8fe6c847e8ead12c52adc5599f66f2d33d1b2ec09aaaaf6ed30074a0f3996ab8
(function() {
    var p = function(R, n, k) {
            k[V(R, n, k), Rl] = 2796
        },
        nX = function(R, n) {
            return R(function(k) {
                k(n)
            }), [function() {
                return n
            }]
        },
        kz = function(R, n, k, q, c) {
            for (n = (q = (c = n[3] | 0, 0), n[2]) | 0; 14 > q; q++) c = c >>> 8 | c << 24, k = k >>> 8 | k << 24, k += R | 0, c += n | 0, k ^= n + 2298, R = R << 3 | R >>> 29, c ^= q + 2298, R ^= k, n = n << 3 | n >>> 29, n ^= c;
            return [R >>> 24 & 255, R >>> 16 & 255, R >>> 8 & 255, R >>> 0 & 255, k >>> 24 & 255, k >>> 16 & 255, k >>> 8 & 255, k >>> 0 & 255]
        },
        E, L = function(R, n, k, q, c, y, e, K, N, Q, Z, w, U, h) {
            if (y = v(n, 278), y >= n.B) throw [x, 31];
            for (c = (K = 0, q = R, Q = y, n.c0.length); 0 < q;) Z = Q % 8, N = 8 - (Z | 0), N = N < q ? N : q, U = Q >> 3, w = n.i[U], k && (e = n, e.A != Q >> 6 && (e.A = Q >> 6, h = v(e, 358), e.l = kz(e.O, [0, 0, h[1], h[2]], e.A)), w ^= n.l[U & c]), K |= (w >> 8 - (Z | 0) - (N | 0) & (1 << N) - 1) << (q | 0) - (N | 0), Q += N, q -= N;
            return V(278, n, (k = K, (y | 0) + (R | 0))), k
        },
        yB = function(R, n, k, q) {
            try {
                q = R[((n | 0) + 2) % 3], R[n] = (R[n] | 0) - (R[((n | 0) + 1) % 3] | 0) - (q | 0) ^ (1 == n ? q << k : q >>> k)
            } catch (c) {
                throw c;
            }
        },
        eM = function(R, n) {
            return n = P(R), n & 128 && (n = n & 127 | P(R) << 7), n
        },
        qX = function(R, n, k) {
            if ((n = typeof R, "object") == n)
                if (R) {
                    if (R instanceof Array) return "array";
                    if (R instanceof Object) return n;
                    if ("[object Window]" == (k = Object.prototype.toString.call(R), k)) return "object";
                    if ("[object Array]" == k || "number" == typeof R.length && "undefined" != typeof R.splice && "undefined" != typeof R.propertyIsEnumerable && !R.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == k || "undefined" != typeof R.call && "undefined" != typeof R.propertyIsEnumerable && !R.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == n && "undefined" == typeof R.call) return "object";
            return n
        },
        C = function(R, n) {
            R.P.splice(0, 0, n)
        },
        G = function(R, n, k, q, c, y) {
            if (n.C == n)
                for (c = v(n, R), 421 == R ? (R = function(e, K, N, Q) {
                        if (c.mm != (Q = ((K = c.length, K) | 0) - 4 >> 3, Q)) {
                            Q = (c.mm = (N = [0, 0, y[1], y[2]], Q), (Q << 3) - 4);
                            try {
                                c.nk = kz(KX(c, Q), N, KX(c, (Q | 0) + 4))
                            } catch (Z) {
                                throw Z;
                            }
                        }
                        c.push(c.nk[K & 7] ^ e)
                    }, y = v(n, 408)) : R = function(e) {
                        c.push(e)
                    }, q && R(q & 255), n = k.length, q = 0; q < n; q++) R(k[q])
        },
        NX = function(R, n, k, q) {
            for (; R.P.length;) {
                k = (R.F = null, R).P.pop();
                try {
                    q = ca(R, k)
                } catch (c) {
                    r(R, c)
                }
                if (n && R.F) {
                    n = R.F, n(function() {
                        B(true, R, true)
                    });
                    break
                }
            }
            return q
        },
        QB = function(R, n, k, q) {
            return (q = I[R.substring(0, 3) + "_"]) ? q(R.substring(3), n, k) : nX(n, R)
        },
        sk = function(R, n, k, q, c) {
            G(((c = (k = u((c = u((q = n & 4, n &= 3, R)), R)), v(R, c)), q) && (c = pX("" + c)), n && G(k, R, D(2, c.length)), k), R, c)
        },
        l = function(R, n, k, q, c, y, e, K, N) {
            if ((R.C = (((K = (y = (N = (c = (e = 0 < (k || R.X++, R).U && R.S && R.xh && 1 >= R.J && !R.L && !R.F && (!k || 1 < R.Z - n) && 0 == document.hidden, 4 == R.X)) || e ? R.s() : R.T, N - R.T), y) >> 14, R).O && (R.O ^= K * (y << 2)), R).Y += K, K || R.C), c) || e) R.X = 0, R.T = N;
            if (!e || N - R.H < R.U - (q ? 255 : k ? 5 : 2)) return false;
            return !((V(278, (q = v(R, (R.Z = n, k ? 426 : 278)), R), R.B), R.P).push([jM, q, k ? n + 1 : n]), R.F = z, 0)
        },
        Ek = function(R, n, k) {
            if (3 == R.length) {
                for (k = 0; 3 > k; k++) n[k] += R[k];
                for (k = [(R = 0, 13), 8, 13, 12, 16, 5, 3, 10, 15]; 9 > R; R++) n[3](n, R % 3, k[R])
            }
        },
        u = function(R, n) {
            if (R.L) return Zn(R, R.N);
            return n = L(8, R, true), n & 128 && (n ^= 128, R = L(2, R, true), n = (n << 2) + (R | 0)), n
        },
        KX = function(R, n) {
            return R[n] << 24 | R[(n | 0) + 1] << 16 | R[(n | 0) + 2] << 8 | R[(n | 0) + 3]
        },
        we = function(R, n, k, q, c, y, e, K) {
            return (c = d[n.I]((k = [-2, 42, -72, -(y = va, 46), -26, -71, k, 61, (K = q & 7, 9), 2], n.MJ)), c)[n.I] = function(N) {
                e = N, K += 6 + 7 * q, K &= 7
            }, c.concat = function(N) {
                return (N = (e = (N = +(N = R % 16 + 1, k)[K + 59 & 7] * R * N - N * e - -2440 * e + (y() | 0) * N + 1 * R * R * N - 2562 * R * e - 61 * R * R * e + K + 61 * e * e, void 0), k[N]), k[(K + 69 & 7) + (q & 2)] = N, k)[K + (q & 2)] = 42, N
            }, c
        },
        V = function(R, n, k) {
            if (278 == R || 426 == R) n.u[R] ? n.u[R].concat(k) : n.u[R] = h8(n, k);
            else {
                if (n.D && 358 != R) return;
                305 == R || 421 == R || 352 == R || 236 == R || 408 == R ? n.u[R] || (n.u[R] = we(R, n, k, 54)) : n.u[R] = we(R, n, k, 113)
            }
            358 == R && (n.O = L(32, n, false), n.A = void 0)
        },
        P = function(R) {
            return R.L ? Zn(R, R.N) : L(8, R, true)
        },
        B = function(R, n, k, q, c, y) {
            if (n.P.length) {
                (n.S = !(n.S && 0(), 0), n).xh = k;
                try {
                    q = n.s(), n.H = q, n.T = q, n.X = 0, c = NX(n, k), y = n.s() - n.H, n.G += y, y < (R ? 0 : 10) || 0 >= n.g-- || (y = Math.floor(y), n.K.push(254 >= y ? y : 254))
                } finally {
                    n.S = false
                }
                return c
            }
        },
        xz = function(R, n, k, q) {
            for (k = (q = u(n), 0); 0 < R; R--) k = k << 8 | P(n);
            V(q, n, k)
        },
        I, Pa = function(R, n, k, q) {
            return v(R, (LX((q = v(R, 278), R.i && q < R.B ? (V(278, R, R.B), Uk(k, R)) : V(278, R, k), n), R), V(278, R, q), 15))
        },
        Tu = function(R, n, k, q, c) {
            for (c = (q = (k.In = (k.MJ = J8(k.I, (k.v0 = (k.NJ = be, CX), k.c0 = k[F], {get: function() {
                        return this.concat()
                    }
                })), d)[k.I](k.MJ, {
                    value: {
                        value: {}
                    }
                }), []), 0); 128 > c; c++) q[c] = String.fromCharCode(c);
            B((C((C(k, (C(k, (p(340, (V((V(305, k, [160, ((V(307, (V(327, (V(236, k, (p(59, k, (p(127, k, (p(119, (V(421, k, (V(270, k, (p(87, (p(158, (p(396, k, (p(448, k, (k.on = (p(362, (k.E9 = (p((p(250, k, (p(371, (V(15, (p(354, k, (V(352, k, ((p(442, k, (p(227, k, (p(103, k, (p(11, k, (p(121, (V(289, (p(173, (V(409, k, (p(275, k, (p(317, (p(375, k, (p(432, ((p((p(295, (V(278, k, (k.B0 = (k.wE = (k.P0 = function(y) {
                this.C = y
            }, k.u = (k.R = void 0, []), k.F = ((k.O = (k.N = void 0, void 0), k.Y = 1, k.U = 0, (k.Rn = [], k).C = k, c = window.performance || {}, k.j = [], (k.J = 0, k).T = 0, k.B = 0, k.S = ((k.A = void 0, k.X = void 0, k).i = [], k.H = (k.P = (k.xh = false, []), k.g = (k.G = 0, 25), 0), k.L = (k.l = void 0, void 0), k.D = false, k.Z = 8001, false), k).K = [], null), 0), c).timeOrigin || (c.timing || {}).navigationStart || 0, 0)), V(426, k, 0), k), function(y, e, K, N) {
                V((e = v(y, (N = (K = (N = (e = u(y), u(y)), u(y)), v(y, N)), e)), K), y, e in N | 0)
            }), 163), k, function(y, e, K, N) {
                !l(y, e, true, false) && (e = re(y), N = e.Ck, K = e.h, y.C == y || K == y.P0 && N == y) && (V(e.un, y, K.apply(N, e.o)), y.T = y.s())
            }), p)(341, k, function(y, e, K, N) {
                if (N = y.Rn.pop()) {
                    for (K = P(y); 0 < K; K--) e = u(y), N[e] = y.u[e];
                    y.u = (N[236] = y.u[236], N[307] = y.u[307], N)
                } else V(278, y, y.B)
            }), k), function(y, e) {
                (e = v(y, u(y)), Uk)(e, y.C)
            }), function(y, e, K, N) {
                (e = v(y, (N = v((K = (N = u((e = u(y), y)), u(y)), y), N), e)) == N, V)(K, y, +e)
            })), k), function(y) {
                xz(4, y)
            }), function(y, e, K, N, Q, Z) {
                if (!l(y, e, true, true)) {
                    if ("object" == (y = v((N = (Q = v((e = v((N = (e = (Q = (Z = u(y), u)(y), u(y)), u)(y), y), e), y), Q), v(y, N)), y), Z), qX)(y)) {
                        for (K in Z = [], y) Z.push(K);
                        y = Z
                    }
                    for (Z = (e = 0 < e ? e : 1, K = y.length, 0); Z < K; Z += e) Q(y.slice(Z, (Z | 0) + (e | 0)), N)
                }
            })), p(193, k, function(y, e, K, N, Q) {
                0 !== (Q = v(y, (K = (e = v((N = v(y, (N = (Q = u((K = u(y), y)), e = u(y), u(y)), N)), y), e), v(y.C, K)), Q)), K) && (N = Ba(e, N, y, 1, K, Q), K.addEventListener(Q, N, W), V(270, y, [K, Q, N]))
            }), 687)), k), function(y) {
                sk(y, 4)
            }), k), 0), k), function() {}), function(y, e, K, N, Q, Z, w) {
                for (w = (e = (K = (N = u(y), Z = eM(y), Q = "", v(y, 115)), K.length), 0); Z--;) w = ((w | 0) + (eM(y) | 0)) % e, Q += q[K[w]];
                V(N, y, Q)
            })), function(y, e, K) {
                K = v((e = (K = (e = u(y), u(y)), 0 != v(y, e)), y), K), e && V(278, y, K)
            })), function(y, e, K, N, Q) {
                for (K = (e = (N = u(y), eM)(y), 0), Q = []; K < e; K++) Q.push(P(y));
                V(N, y, Q)
            })), function(y, e, K) {
                (e = u((K = u(y), y)), V)(e, y, "" + v(y, K))
            })), V)(408, k, [0, 0, 0]), [])), function(y, e, K, N, Q, Z, w, U, h, T, Y, J) {
                function f(b, a) {
                    for (; e < b;) T |= P(y) << e, e += 8;
                    return T >>= (a = T & (e -= b, (1 << b) - 1), b), a
                }
                for (K = (h = (U = (Y = (e = T = (Z = u(y), 0), f(3) | 0) + 1, f(5)), 0), []), Q = 0; Q < U; Q++) J = f(1), K.push(J), h += J ? 0 : 1;
                for (Q = (N = (h = ((h | 0) - 1).toString(2).length, []), 0); Q < U; Q++) K[Q] || (N[Q] = f(h));
                for (h = 0; h < U; h++) K[h] && (N[h] = u(y));
                for (w = []; Y--;) w.push(v(y, u(y)));
                p(Z, y, function(b, a, O, VB, X) {
                    for (O = (VB = (X = [], []), 0); O < U; O++) {
                        if (a = N[O], !K[O]) {
                            for (; a >= X.length;) X.push(u(b));
                            a = X[a]
                        }
                        VB.push(a)
                    }
                    b.L = h8(b, w.slice()), b.N = h8(b, VB)
                })
            })), k), {}), k), function(y) {
                al(y, 1)
            }), function(y, e, K) {
                l(y, e, true, false) || (e = u(y), K = u(y), V(K, y, function(N) {
                    return eval(N)
                }(Gu(v(y.C, e)))))
            })), 499), k, function(y) {
                sk(y, 3)
            }), 0), k), function(y, e, K, N) {
                K = (N = P((e = u(y), y)), u(y)), V(K, y, v(y, e) >>> N)
            }), 0), function(y, e, K, N) {
                V((e = v(y, (N = v(y, (K = u((N = u(y), y)), N)), K)), K), y, e + N)
            })), function(y, e) {
                y = (e = u(y), v)(y.C, e), y[0].removeEventListener(y[1], y[2], W)
            })), k), function(y, e, K, N, Q) {
                V((K = v(y, (N = (Q = v(y, (Q = (N = (K = (e = u(y), u(y)), u(y)), u)(y), Q)), v(y, N)), K)), e), y, Ba(K, N, y, Q))
            }), k), function(y, e, K) {
                V((K = v(y, (e = (K = u(y), u(y)), K)), K = qX(K), e), y, K)
            }), 0)), S(4))), k), function(y, e, K, N, Q, Z) {
                l(y, e, true, false) || (N = re(y.C), e = N.o, Z = N.Ck, Q = N.h, K = e.length, N = N.un, e = 0 == K ? new Z[Q] : 1 == K ? new Z[Q](e[0]) : 2 == K ? new Z[Q](e[0], e[1]) : 3 == K ? new Z[Q](e[0], e[1], e[2]) : 4 == K ? new Z[Q](e[0], e[1], e[2], e[3]) : 2(), V(N, y, e))
            }), function(y, e, K, N) {
                N = u((e = u(y), y)), K = u(y), y.C == y && (N = v(y, N), K = v(y, K), v(y, e)[N] = K, 358 == e && (y.A = void 0, 2 == N && (y.O = L(32, y, false), y.A = void 0)))
            })), function(y) {
                al(y, 4)
            })), [])), k), H), k), 2048), k).an = 0, 0), 0]), 120), k, k), k), function(y, e, K, N) {
                V((K = v((e = v(y, (N = u((K = u((e = u(y), y)), y)), e)), y), K), N), y, e[K])
            }), p(472, k, function(y, e, K, N) {
                N = (e = u(y), u)(y), K = u(y), V(K, y, v(y, e) || v(y, N))
            }), [Rl])), [A, n])), k), [Il, R]), true), k, true)
        },
        J8 = function(R, n) {
            return d[R](d.prototype, {
                pop: n,
                replace: n,
                length: n,
                document: n,
                splice: n,
                parent: n,
                stack: n,
                floor: n,
                prototype: n,
                console: n,
                call: n,
                propertyIsEnumerable: n
            })
        },
        pX = function(R, n, k, q, c) {
            for (q = (R = R.replace(/\r\n/g, "\n"), n = 0, []), k = 0; n < R.length; n++) c = R.charCodeAt(n), 128 > c ? q[k++] = c : (2048 > c ? q[k++] = c >> 6 | 192 : (55296 == (c & 64512) && n + 1 < R.length && 56320 == (R.charCodeAt(n + 1) & 64512) ? (c = 65536 + ((c & 1023) << 10) + (R.charCodeAt(++n) & 1023), q[k++] = c >> 18 | 240, q[k++] = c >> 12 & 63 | 128) : q[k++] = c >> 12 | 224, q[k++] = c >> 6 & 63 | 128), q[k++] = c & 63 | 128);
            return q
        },
        LX = function(R, n, k, q, c, y) {
            if (!n.R) {
                n.J++;
                try {
                    for (k = (q = (y = void 0, n).B, 0); --R;) try {
                        if ((c = void 0, n).L) y = Zn(n, n.L);
                        else {
                            if (k = v(n, 278), k >= q) break;
                            y = (c = (V(426, n, k), u(n)), v)(n, c)
                        }(y && y[ue] & 2048 ? y(n, R) : M(n, 0, [x, 21, c]), l)(n, R, false, false)
                    } catch (e) {
                        v(n, 409) ? M(n, 22, e) : V(409, n, e)
                    }
                    if (!R) {
                        if (n.Lk) {
                            n.J--, LX(338687074593, n);
                            return
                        }
                        M(n, 0, [x, 33])
                    }
                } catch (e) {
                    try {
                        M(n, 22, e)
                    } catch (K) {
                        r(n, K)
                    }
                }
                n.J--
            }
        },
        Zn = function(R, n) {
            return (n = n.create().shift(), R.L.create()).length || R.N.create().length || (R.L = void 0, R.N = void 0), n
        },
        Dn = function(R, n, k, q) {
            function c() {}
            return {
                invoke: (k = QB((q = void 0, R), function(y) {
                    c && (n && z(n), q = y, c(), c = void 0)
                }, !!n)[0], function(y, e, K, N) {
                    function Q() {
                        q(function(Z) {
                            z(function() {
                                y(Z)
                            })
                        }, K)
                    }
                    if (!e) return e = k(K), y && y(e), e;
                    q ? Q() : (N = c, c = function() {
                        N(), z(Q)
                    })
                })
            }
        },
        v = function(R, n) {
            if (void 0 === (R = R.u[n], R)) throw [x, 30, n];
            if (R.value) return R.create();
            return R.create(1 * n * n + 42 * n + -40), R.prototype
        },
        D = function(R, n, k, q) {
            for (k = (q = (R | 0) - 1, []); 0 <= q; q--) k[(R | 0) - 1 - (q | 0)] = n >> 8 * q & 255;
            return k
        },
        Uk = function(R, n) {
            V(278, ((n.Rn.push(n.u.slice()), n.u)[278] = void 0, n), R)
        },
        r = function(R, n) {
            R.R = ((R.R ? R.R + "~" : "E:") + n.message + ":" + n.stack).slice(0, 2048)
        },
        fX = function(R, n, k) {
            return n.W(function(q) {
                k = q
            }, false, R), k
        },
        Ba = function(R, n, k, q, c, y) {
            function e() {
                if (k.C == k) {
                    if (k.u) {
                        var K = [m, R, n, void 0, c, y, arguments];
                        if (2 == q) var N = B(false, (C(k, K), k), false);
                        else if (1 == q) {
                            var Q = !k.P.length;
                            C(k, K), Q && B(false, k, false)
                        } else N = ca(k, K);
                        return N
                    }
                    c && y && c.removeEventListener(y, e, W)
                }
            }
            return e
        },
        S = function(R, n) {
            for (n = []; R--;) n.push(255 * Math.random() | 0);
            return n
        },
        ca = function(R, n, k, q, c) {
            if (c = n[0], c == g) R.g = 25, R.v(n);
            else if (c == F) {
                q = n[1];
                try {
                    k = R.R || R.v(n)
                } catch (y) {
                    r(R, y), k = R.R
                }
                q(k)
            } else if (c == jM) R.v(n);
            else if (c == A) R.v(n);
            else if (c == Il) {
                try {
                    for (k = 0; k < R.j.length; k++) try {
                        q = R.j[k], q[0][q[1]](q[2])
                    } catch (y) {}
                } catch (y) {}(0, n[R.j = [], 1])(function(y, e) {
                    R.W(y, true, e)
                }, function(y) {
                    (C((y = !R.P.length, R), [ue]), y) && B(false, R, true)
                })
            } else {
                if (c == m) return k = n[2], V(126, R, n[6]), V(15, R, k), R.v(n);
                c == ue ? (R.K = [], R.i = [], R.u = null) : c == Rl && "loading" === H.document.readyState && (R.F = function(y, e) {
                    function K() {
                        e || (e = true, y())
                    }
                    H.document.addEventListener("DOMContentLoaded", (e = false, K), W), H.addEventListener("load", K, W)
                })
            }
        },
        al = function(R, n, k, q) {
            G((k = u(R), q = u(R), q), R, D(n, v(R, k)))
        },
        $z = function(R, n) {
            if ((R = null, n = H.trustedTypes, !n) || !n.createPolicy) return R;
            try {
                R = n.createPolicy("bg", {
                    createHTML: zu,
                    createScript: zu,
                    createScriptURL: zu
                })
            } catch (k) {
                H.console && H.console.error(k.message)
            }
            return R
        },
        zu = function(R) {
            return R
        },
        M = function(R, n, k, q, c, y) {
            if (!R.D) {
                if ((k = v(R, (n = (0 == (q = ((c = void 0, k && k[0] === x) && (c = k[2], n = k[1], k = void 0), v)(R, 236), q).length && (y = v(R, 426) >> 3, q.push(n, y >> 8 & 255, y & 255), void 0 != c && q.push(c & 255)), ""), k && (k.message && (n += k.message), k.stack && (n += ":" + k.stack)), 307)), 3) < k) {
                    R.C = (c = (n = pX((k -= ((n = n.slice(0, (k | 0) - 3), n.length) | 0) + 3, n)), R.C), R);
                    try {
                        G(421, R, D(2, n.length).concat(n), 9)
                    } finally {
                        R.C = c
                    }
                }
                V(307, R, k)
            }
        },
        H = this || self,
        t = function(R, n, k) {
            k = this;
            try {
                Tu(n, R, this)
            } catch (q) {
                r(this, q), n(function(c) {
                    c(k.R)
                })
            }
        },
        h8 = function(R, n, k) {
            return k = d[R.I](R.In), k[R.I] = function() {
                return n
            }, k.concat = function(q) {
                n = q
            }, k
        },
        W = {
            passive: true,
            capture: true
        },
        re = function(R, n, k, q, c, y) {
            for (q = (c = (n = (k = u((y = R[le] || {}, R)), y.un = u(R), y.o = [], R.C == R ? (P(R) | 0) - 1 : 1), u(R)), 0); q < n; q++) y.o.push(u(R));
            for (y.Ck = v(R, c); n--;) y.o[n] = v(R, y.o[n]);
            return y.h = v(R, k), y
        },
        z = H.requestIdleCallback ? function(R) {
            requestIdleCallback(function() {
                R()
            }, {
                timeout: 4
            })
        } : H.setImmediate ? function(R) {
            setImmediate(R)
        } : function(R) {
            setTimeout(R, 0)
        },
        de = function(R, n) {
            n.push(R[0] << 24 | R[1] << 16 | R[2] << 8 | R[3]), n.push(R[4] << 24 | R[5] << 16 | R[6] << 8 | R[7]), n.push(R[8] << 24 | R[9] << 16 | R[10] << 8 | R[11])
        },
        le = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        x = ((t.prototype.V = "toString", t.prototype.Lk = false, t).prototype.Qy = void 0, {}),
        g = [],
        Il = [],
        jM = [],
        A = [],
        m = [],
        ue = (t.prototype.kh = void 0, []),
        F = [],
        Rl = [],
        d = (E = ((de, function() {})(S), yB, Ek, t.prototype), E.zc = function() {
            return Math.floor(this.G + (this.s() - this.H))
        }, x.constructor),
        va = (E.s = (t.prototype.I = "create", (E.dE = (E.W = function(R, n, k, q, c) {
            if ((k = "array" === qX(k) ? k : [k], this).R) R(this.R);
            else try {
                q = !this.P.length, c = [], C(this, [g, c, k]), C(this, [F, R, c]), n && !q || B(true, this, n)
            } catch (y) {
                r(this, y), R(this.R)
            }
        }, function(R, n, k, q, c, y) {
            for (c = q = 0, y = []; q < R.length; q++)
                for (c += n, k = k << n | R[q]; 7 < c;) c -= 8, y.push(k >> c & 255);
            return y
        }), (E.eN = (E.s9 = function(R, n, k) {
            return ((n = (n ^= n << 13, n ^= n >> 17, (n ^ n << 5) & k)) || (n = 1), R) ^ n
        }, function(R, n, k, q, c) {
            for (q = c = 0; c < R.length; c++) q += R.charCodeAt(c), q += q << 10, q ^= q >> 6;
            return c = new Number((q += q << 3, q ^= q >> 11, R = q + (q << 15) >>> 0, R & (1 << n) - 1)), c[0] = (R >>> n) % k, c
        }), E.FH = function() {
            return Math.floor(this.s())
        }, window.performance || {}).now) ? function() {
            return this.B0 + window.performance.now()
        } : function() {
            return +new Date
        }), void 0),
        CX = ((t.prototype.v = function(R, n) {
            return n = {}, va = (R = {}, function() {
                    return n == R ? -40 : 9
                }),
                function(k, q, c, y, e, K, N, Q, Z, w, U, h, T, Y, J) {
                    n = (Y = n, R);
                    try {
                        if (h = k[0], h == A) {
                            T = k[1];
                            try {
                                for (Q = (y = atob(T), e = [], K = 0); Q < y.length; Q++) J = y.charCodeAt(Q), 255 < J && (e[K++] = J & 255, J >>= 8), e[K++] = J;
                                V(358, this, (this.B = (this.i = e, this.i).length << 3, [0, 0, 0]))
                            } catch (f) {
                                M(this, 17, f);
                                return
                            }
                            LX(8001, this)
                        } else if (h == g) k[1].push(v(this, 307), v(this, 421).length, v(this, 352).length, v(this, 305).length), V(15, this, k[2]), this.u[349] && Pa(this, 8001, v(this, 349));
                        else {
                            if (h == F) {
                                this.C = (Z = (U = D(2, (v(this, (K = k[2], 305)).length | 0) + 2), this.C), this);
                                try {
                                    w = v(this, 236), 0 < w.length && G(305, this, D(2, w.length).concat(w), 10), G(305, this, D(1, this.Y), 109), G(305, this, D(1, this[F].length)), y = 0, y -= (v(this, 305).length | 0) + 5, y += v(this, 289) & 2047, q = v(this, 421), 4 < q.length && (y -= (q.length | 0) + 3), 0 < y && G(305, this, D(2, y).concat(S(y)), 15), 4 < q.length && G(305, this, D(2, q.length).concat(q), 156)
                                } finally {
                                    this.C = Z
                                }
                                if (c = ((Q = S(2).concat(v(this, 305)), Q[1] = Q[0] ^ 6, Q[3] = Q[1] ^ U[0], Q)[4] = Q[1] ^ U[1], this.rE(Q))) c = "!" + c;
                                else
                                    for (c = "", y = 0; y < Q.length; y++) N = Q[y][this.V](16), 1 == N.length && (N = "0" + N), c += N;
                                return v(this, (v((v((V(307, this, (e = c, K.shift())), this), 421).length = K.shift(), this), 352).length = K.shift(), 305)).length = K.shift(), e
                            }
                            if (h == jM) Pa(this, k[2], k[1]);
                            else if (h == m) return Pa(this, 8001, k[1])
                        }
                    } finally {
                        n = Y
                    }
                }
        }(), t.prototype).rE = function(R, n, k, q) {
            if (n = window.btoa) {
                for (q = (k = 0, ""); k < R.length; k += 8192) q += String.fromCharCode.apply(null, R.slice(k, k + 8192));
                R = n(q).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
            } else R = void 0;
            return R
        }, /./);
    (t.prototype.Ax = 0, t.prototype).yy = 0;
    var be, Fn = A.pop.bind((t.prototype[Il] = [0, 0, 1, 1, 0, 1, 1], t).prototype[g]),
        Gu = function(R, n) {
            return (n = $z()) && 1 === R.eval(n.createScript("1")) ? function(k) {
                return n.createScript(k)
            } : function(k) {
                return "" + k
            }
        }(((be = J8(t.prototype.I, {get: (CX[t.prototype.V] = Fn, Fn)
        }), t.prototype).O9 = void 0, H));
    40 < (I = H.botguard || (H.botguard = {}), I.m) || (I.m = 41, I.bg = Dn, I.a = QB), I.bDL_ = function(R, n, k) {
        return k = new t(R, n), [function(q) {
            return fX(q, k)
        }]
    };
}).call(this);
#5 JavaScript::Eval (size: 64) - SHA256: cc158dc49db31ac40a09769c14f1e96ce12d8ee44ddb54a5321c32cd0536ef78
0,
function(y, e, K) {
    (e = (K = u((e = u(y), y)), y.u[e] && v(y, e)), V)(K, y, e)
}
#6 JavaScript::Eval (size: 22) - SHA256: 2ed176c7f9d5b3c8ca6ccdb0e994b6ddc34944c41fc4db7451fd7a3d27fed6f1
0,
function(y) {
    xz(2, y)
}

Executed Writes (0)


HTTP Transactions (87)


Request Response
                                        
                                            GET /full-download-edius-pro-6-5-cracked-version-key-and-better/ HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         192.185.117.118
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Fri, 02 Dec 2022 10:13:19 GMT
Server: Apache
Location: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Content-Length: 288
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   288
Md5:    cc9db67629a5aa362235ec65d8ae4dc2
Sha1:   8d427090d6a3ddbee65b4aebe8cc304554823584
Sha256: 8ff498dc8616ea790d9ee6e9388b9628243655d9dfc6113d4272d51f31b72fec

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13119
Expires: Fri, 02 Dec 2022 13:51:58 GMT
Date: Fri, 02 Dec 2022 10:13:19 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2483
Cache-Control: 'max-age=158059'
Date: Fri, 02 Dec 2022 10:13:19 GMT
Etag: "63888270-1d7"
Last-Modified: Fri, 02 Dec 2022 09:31:56 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10032
Expires: Fri, 02 Dec 2022 13:00:31 GMT
Date: Fri, 02 Dec 2022 10:13:19 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 02 Dec 2022 09:18:11 GMT
cache-control: public,max-age=3600
age: 3309
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: Sn5X/OBIz3ebCTTGdnbqQ5nvfZ0SApX/X+Wgehz/PCEtS3RAiIFf4Zp2be43AyybWT5Ysw/F5BQ=
x-amz-request-id: VD4SYWCX37Z2YQR8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 02 Dec 2022 09:46:04 GMT
age: 1636
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:20 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D1DA92978682BB9AF5F962BA71C6AAD5914C0B1532E6CD465C4FACD4F69DD1DA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21570
Expires: Fri, 02 Dec 2022 16:12:50 GMT
Date: Fri, 02 Dec 2022 10:13:20 GMT
Connection: keep-alive

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 02 Dec 2022 10:11:15 GMT
cache-control: public,max-age=3600
age: 125
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2475
Cache-Control: 'max-age=158059'
Date: Fri, 02 Dec 2022 10:13:20 GMT
Last-Modified: Fri, 02 Dec 2022 09:32:05 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fxkWh0uQR/vPsztQLvVqpg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         54.71.202.2
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: yaVpRHVmezmDdcmrGltBi+nYBJQ=

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gtag/js?id=UA-6604786-9 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.168
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 02 Dec 2022 10:13:22 GMT
expires: Fri, 02 Dec 2022 10:13:22 GMT
cache-control: private, max-age=900
last-modified: Fri, 02 Dec 2022 09:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43613
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1921)
Size:   43613
Md5:    1ff0e73d5275e779a5e4f72f23a31ca8
Sha1:   a9605b224f8472b08d192a3cacc5f368cfee886f
Sha256: 3e5601e95a5a0e9ad3c459314d0e940579852ae49cef3e071f6c13a1d3e6e42d
                                        
                                            GET /xtc-hair.com/wp-content/uploads/2017/11/xtc-200.jpg?w=451&ssl=1 HTTP/1.1 
Host: i0.wp.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         192.0.77.2
HTTP/2 200 OK
content-type: image/webp
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:22 GMT
content-length: 4598
last-modified: Fri, 21 Oct 2022 11:18:53 GMT
expires: Sun, 20 Oct 2024 23:18:53 GMT
cache-control: public, max-age=63115200
link: <https://xtc-hair.com/wp-content/uploads/2017/11/xtc-200.jpg>; rel="canonical"
x-content-type-options: nosniff
etag: "c731930b24f28ec1"
vary: Accept
x-nc: HIT arn 8
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
timing-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image, VP8 encoding, 451x200, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size:   4598
Md5:    e495a00f48e5dc429fc96aea3a871781
Sha1:   72c64567427b9e91ed315838136326785335df31
Sha256: 03a743711874690a5fedce6297c025cf70d1de70228536f2bf1ff2829d321851
                                        
                                            GET /wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 09 Dec 2020 04:01:44 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3239
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (11256), with no line terminators
Size:   3239
Md5:    1054d0d53548e8bae51665b11acc6413
Sha1:   2eea6a05fe18db61fff58c431d34a86b3e0b7ade
Sha256: cb8b0f0f3f871d9776da32ee6d9e1af9277a211be61e97a831c7f8c98fbebfae
                                        
                                            GET /wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 13 Nov 2019 03:58:49 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1298
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (4186), with no line terminators
Size:   1298
Md5:    91bab39b98d7e5c1632717b9ebe349e4
Sha1:   e639a447d06fc7827be5b5b35d603ff16b5f7bb1
Sha256: 47ff151faeb23a5654f6ec58b404e51193f6714849a69de241c2ee79662f74c6

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /xtc-hair.com/wp-content/uploads/2016/05/Locations-sm.png?w=750 HTTP/1.1 
Host: i0.wp.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         192.0.77.2
HTTP/2 200 OK
content-type: image/webp
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:22 GMT
content-length: 29174
last-modified: Fri, 21 Oct 2022 11:18:53 GMT
expires: Sun, 20 Oct 2024 23:18:53 GMT
cache-control: public, max-age=63115200
link: <http://xtc-hair.com/wp-content/uploads/2016/05/Locations-sm.png>; rel="canonical"
x-content-type-options: nosniff
etag: "90d9a2535e99cb54"
vary: Accept
x-nc: HIT arn 3
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
timing-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  RIFF (little-endian) data, Web/P image\012- data
Size:   29174
Md5:    1ddae22ff1c78c4fae0baf9f172b7503
Sha1:   548c7a2bdb93e4a2993b7833acf3054e52d4c683
Sha256: 9a5478ba509c6d1ae2b4416354ca5db2344aae7a62cc38e82cc645b47bc8505e
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 30 Nov 2022 17:52:58 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 189
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   189
Md5:    5a18e16eb01cbaa862eb32e6b77bedb2
Sha1:   3abf9b913cc9f558f02cba7c9b822f8d1812cb96
Sha256: d2b5af913332941d5ae7786d1fa70e0d009315c4ede6ad5b80d0f663bb54521f

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/wp-store-locator/css/styles.min.css?ver=2.2.235 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Sat, 29 Jan 2022 23:45:07 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 4548
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (14979), with no line terminators
Size:   4548
Md5:    f2e41dbf24163bee8e916e6a9621a34e
Sha1:   c6ca67eb47140395068e7622385beaf9b061752f
Sha256: a56fc9642f0c88d6268cf9fc731fb1ce6f9ce56134e28d3268eca9b19e445f83

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/tablepress/css/default.min.css?ver=1.14 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Thu, 05 Aug 2021 17:41:10 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 2462
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (5092), with no line terminators
Size:   2462
Md5:    793aed4abaceb0925e60458c8c42d980
Sha1:   6371ef087dee13724484a6cca1feda59c061644e
Sha256: b43746949f5740fbf14e40489cb2bdee809c5a9d0954a0cf0982a3b4e90467af
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11621
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 10:13:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11621
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 10:13:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11621
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 10:13:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11621
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 10:13:22 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11621
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 10:13:22 GMT
Connection: keep-alive

                                        
                                            GET /recaptcha/api.js?render=6LeQrmEbAAAAAFBa2Ufo_PLvcDe102G8l2XsKiSp&ver=3.0 HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.132
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
expires: Fri, 02 Dec 2022 10:13:22 GMT
date: Fri, 02 Dec 2022 10:13:22 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   583
Md5:    894b5f35a84cce5a2ce0d33766c82e03
Sha1:   b195b5824ea3e2f1e0eaf599995415afdf3ed047
Sha256: d27a6f25bd04565d2b8527ef74bc293e68b29c01f8a17b85781e86903731dd0d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7334
x-amzn-requestid: a6b8b420-8394-496b-8be8-26dee52e3887
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoHJOoAMF75g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-0b38d07f518c8b3134457df2;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 17nFm7AQdmRYS_af-EJ4XBVw8l3YudcphlpcZMveuVjvjhhYdkAQsw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:33:10 GMT
age: 42012
etag: "23753fe8af09ec8ffa10eed4d201a71833885c99"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7334
Md5:    498ab4412ed5cf977bc23e4e870894b0
Sha1:   23753fe8af09ec8ffa10eed4d201a71833885c99
Sha256: 036042656f15e42b4d1537c45f5b8e7190c70305fa9a69c1287c6739ad0b7122
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Fw6nrporwF27NW0-vXpaolW79nDXLF2RyS-lqhhp1osHt7q98VpI3g==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:34:47 GMT
age: 45515
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2942
Md5:    b47431190f34eccf0a6efb98e2a32b7d
Sha1:   9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
Sha256: 08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 15495
x-amzn-requestid: 977cdbce-3a9c-4006-a5a1-5c4c82bd4a94
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfHDIFxzIAMFzEw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891ee0-4b2cb3a16ca745537a8caf8c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:38:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nwKxQKsw8g5zCzfMFu_XpOac5rhImez29TKrycGJzozZyHTzoCHASw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:20:06 GMT
age: 42796
etag: "f799dfd89a4f5a452dc837b8616549f578fb4184"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   15495
Md5:    82ea44d6cb116fb1f5752ce9bb87e345
Sha1:   f799dfd89a4f5a452dc837b8616549f578fb4184
Sha256: e9087e7fce332289d67d4d5646d0233c2f2d871cc88dc1c51d5ea1e9f2fb5abd
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 00:54:54 GMT
age: 33508
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6174
Md5:    b986f9fcbeca91ed5c8d58fbfaf47d19
Sha1:   6e6c8bd2bce144cc4da1cd7be375b046b60dca79
Sha256: 07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb582f62c-d1ce-4054-b87e-36be40dadfa4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8863
x-amzn-requestid: 798d014b-0f9c-4787-a676-8f5e8fae3d11
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cdG14HBNIAMFdWg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638851bf-7549feac6d476a8512676412;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 07:03:27 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: cgj3fw3lpngosMNOK7cZUZO94T__4RTy_p7wa6rI62OOvhI5E9wMSw==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 13:30:28 GMT
age: 74574
etag: "fc71ae3cae92ed6011904bb2367f23bf4e69fab4"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8863
Md5:    156e9ea97b774cbd8361072e4041b6c8
Sha1:   fc71ae3cae92ed6011904bb2367f23bf4e69fab4
Sha256: 58d953c19ebbbdfc3965bbe3f52308d4702deaf4d0c029f4674bcb862da138af
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb8ec880-52b8-4350-bb47-d051878e78f1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6882
x-amzn-requestid: 6b5f15a5-c15b-46bf-9fd5-5d013d37a0eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGfrG3WIAMFc9Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891dfd-6038ca700dfb4489230c2683;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2O6x-8-ESFDtlhcjVyGxEXCZcLbbfhsCVQeX02lbNMupPWmM-fKuLA==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:47:56 GMT
age: 44726
etag: "45cf5e1a54ee491497ffe08a8e39fe97ba3c8a48"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6882
Md5:    25c68d8b1fae82820f93efca500fd848
Sha1:   45cf5e1a54ee491497ffe08a8e39fe97ba3c8a48
Sha256: f0ec6b6f6ba0a931c9b71f5bc7ad1e5b89c8e4d8b7441f35eeebfba418d0e588
                                        
                                            GET /wp-content/themes/spacious/font-awesome/css/font-awesome.min.css?ver=4.7.0 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 7119
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (30837), with CRLF line terminators
Size:   7119
Md5:    132393cbbd112512206aa3c468a210ee
Sha1:   7c0a904b30a100e744fa0dce8a5e47079810a4c3
Sha256: fe7806c8283bc20c74e50713d63b477299130d05d9b0e2391ad5d307f5eb2292
                                        
                                            GET /wp-content/themes/spacious/js/spacious-custom.js?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1047
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   1047
Md5:    dadc838792cbce3cf9aa041753aed2ef
Sha1:   53d30467a3bffe9d0aad046a72cb33a663304b9a
Sha256: ce677d1e8b1ddee194459c599dbc87aa43d198ec802f37ed90f0c82d46503f64

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/lightweight-social-icons/css/style-min.css?ver=1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Thu, 09 Apr 2020 14:24:19 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1753
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (7989), with no line terminators
Size:   1753
Md5:    651b107c868611eaf140b8d2efedcf0d
Sha1:   afd2e4f4017cdba568ae9879280fb023cb286188
Sha256: 6d9d93708ba83fc0c491ace3c24846e2148c3feadb47884953094a21a5314b5b
                                        
                                            GET /wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Fri, 27 May 2022 15:03:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 5321
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (15660)
Size:   5321
Md5:    710f8b142ea44c0682dc2c30f318f065
Sha1:   49144e9b3a76d3d383b1d4359cf7a25e947f4233
Sha256: 708bb5819879a2a2c7670abc20a58cca68a415ffd621011cbc4c3c9d82dddc50

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.min.js?ver=7.10.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 30 Nov 2022 17:52:07 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3848
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1571)
Size:   3848
Md5:    f2694bc14d8b63a7d406f4400b74cca4
Sha1:   eb87c041943667f69b6dc73b1ca12370fff38fb0
Sha256: 28baa20440db143848726898dac1510692b768c9086b97f637cde74db6e96a2a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /wp-content/plugins/jetpack/_inc/build/photon/photon.min.js?ver=20191001 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 30 Nov 2022 17:52:10 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 369
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (685), with no line terminators
Size:   369
Md5:    accd80b294f42169b1e447e68bacfffe
Sha1:   40847092d82d78897a8219b270b22838fcc0bb95
Sha256: 35e8294d38f054cd6fbcdef72076443685888546d93b41a596e981a5e9a61552
                                        
                                            GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 09 Dec 2020 04:01:44 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 4618
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (11126)
Size:   4618
Md5:    acdb97105af28a7066790c6748ae2e1e
Sha1:   65794d2c5a9d04f747faf370bc8bacd330e69e5a
Sha256: dc4efbc4b704b142b5313588c32e56ea56648068a01d2bc596a4eee06b379b5e
                                        
                                            GET /wp-content/themes/spacious/js/skip-link-focus-fix.js?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 425
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   425
Md5:    62c10ae379acf345832166577cf721a4
Sha1:   a9d99c17fbe36ee8ed057b181b8a885d2bb88556
Sha256: 8cd627febaae9f8dbdfaca4cb5ed2c298e3d0d6513b3f45478af7bd91fde691b
                                        
                                            GET /wp-content/plugins/wp-gallery-custom-links/wp-gallery-custom-links.js?ver=1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Tue, 29 Aug 2017 14:19:48 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 536
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   536
Md5:    6f60958d7fc961a2f5e744a081f8a8ac
Sha1:   bb558da62a47b135476a5eb4ee66745d8cd12d7a
Sha256: 4be5234257b239c5e32fd6b5ccebde0b7c6b3af12d732778b090ab0f07bb079d

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/wp-facebook-pixel/assets/NSAFacebookPixel.min.js HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 04 Sep 2019 13:31:54 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 363
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (521)
Size:   363
Md5:    500545bf22f6760751dcd932bc1ba078
Sha1:   95ff2a360643bb23024055cbb3fac63512dfab45
Sha256: d1ed998bdee807eacffc3f3313369cbf9033c79ff80e61181caa1c5818c4cfcc

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/wp-facebook-pixel/inc/scripts/nsautilities.min.js HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 04 Sep 2019 13:31:54 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 214
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text
Size:   214
Md5:    d472cbacb37c016041b58772d54ad559
Sha1:   63e1c1aa09aef1189ac568497f4d8b762b3f22b7
Sha256: ae454e133e079135e984107978953414c24f4a4cee42639af40d60535582b116

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-includes/js/comment-reply.min.js?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Fri, 27 May 2022 15:03:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1477
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2946)
Size:   1477
Md5:    92712acce6ce836d0a929b1800b4f9d6
Sha1:   8157d1380bb1d6dadfd85565dd464bb5b0ed06bd
Sha256: 2f82d181a2cadadf7d898d7f5ea2eb527106fb6413044b55fbfa4fb0081a2e09

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/themes/spacious/js/navigation.js?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3152
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   3152
Md5:    6e2649475b40aaa23c7933cd4864d49c
Sha1:   b58b3cdfdc538d9199cda602c2cd0ff922ebd3a3
Sha256: 9875d2e52f93962fe242e2f5984210a87304988d3a78b8b10118843d28c6ab7d
                                        
                                            GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Fri, 27 May 2022 15:03:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 2675
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (6475), with no line terminators
Size:   2675
Md5:    45bd1d6f7fc3a4069fc6fd400b90c961
Sha1:   903c7e28c7141e9fc1bdb4dfc62d043a97a01e2d
Sha256: c638a0057b4be0a61cfb65b1860a855a327397e9871f5dde28fa2f138fb394dc

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1664461981 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Thu, 29 Sep 2022 14:33:01 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3830
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   3830
Md5:    66b85ee07e712680856a30dbbffd6851
Sha1:   1b7f567df71b51b648eac224f3782aed0f2eb740
Sha256: ff6d4e7e045697210f93d5d8f201ac69ddf676e0d4e1fd60e6e778cb4931f9f3

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 30 Nov 2022 17:52:58 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 7621
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (17819), with no line terminators
Size:   7621
Md5:    66c68f2158dcf7d97a02f3719a17aab0
Sha1:   fdb04fb4c632b9fb4275006a4e402cd0d4fa393a
Sha256: e4b360f0e6ae1afc06f05f958e8696e5ae45257912bc2ab0b9334bd1382a51aa

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/themes/spacious/assets/fonts/Lato-Bold.woff HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://xtc-hair.com/wp-content/themes/spacious/style.css?ver=6.1.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: font/woff
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
content-length: 36784
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 36784, version 1.104\012- data
Size:   36784
Md5:    a9d8f02506c0ea8b1b0ea76ccc485651
Sha1:   94372d3d5222e5601b8a801ba81df80e5c66a7fe
Sha256: 9f8224817f8e13b4047734e58a7a3310b35146bd436752546d04389e4a46d766

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/themes/spacious/assets/fonts/Lato-Regular.woff HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://xtc-hair.com/wp-content/themes/spacious/style.css?ver=6.1.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: font/woff
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
content-length: 37580
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 37580, version 1.104\012- data
Size:   37580
Md5:    8ed525743dbb32ae4bdb7531d637f7fa
Sha1:   c5f13bf20b52ddbe34ccde18c1d92df8bffefdf3
Sha256: dff99fb17b5e8fa6ea55c50a6200c824ef0ab3e88b4e06b2284c37d19ac4bf9a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/lightweight-social-icons/fonts/fontello.woff HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://xtc-hair.com/wp-content/plugins/lightweight-social-icons/css/style-min.css?ver=1.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: font/woff
                                        
last-modified: Thu, 09 Apr 2020 14:24:19 GMT
accept-ranges: bytes
content-length: 23328
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 23328, version 0.0\012- data
Size:   23328
Md5:    242e0c93f0f72bde894698405d7a04ab
Sha1:   368cef17895968a3d6a683c43e4cf4175665a757
Sha256: 1b6e0cc5ce7dad5ae275d7ac33c17034f27f801270805bf8d320bab919045a2c

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/themes/spacious/assets/fonts/Lato-Italic.woff HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://xtc-hair.com/wp-content/themes/spacious/style.css?ver=6.1.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: font/woff
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
content-length: 39144
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 39144, version 1.104\012- data
Size:   39144
Md5:    5518023c841f1844a49e352831fe011c
Sha1:   ed4952a517498fa4fe5da6e46ee75c73b376cf3a
Sha256: 7ddc8f319db77a7867a106e97b74bfd0f9c94c9612feac09567fee256164688e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e
                                        
                                            GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.6.4 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 409 Conflict
content-type: text/html; charset=iso-8859-1
                                        
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
content-length: 83
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   83
Md5:    26267cd8990f15d3bbea71684a6d5995
Sha1:   ac3b38cf3fe0e112bb6aeb7e05226b7133575d93
Sha256: 769e8ab745a0fe4bf811036e75a8630e38c50a18cb3e24d539ce4a0722c7c85e

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /g.gif?v=ext&blog=194744380&post=122608&tz=-5&srv=xtc-hair.com&j=1%3A11.5.1&host=xtc-hair.com&ref=&fcp=2871&rand=0.3089024926209114 HTTP/1.1 
Host: pixel.wp.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         192.0.76.3
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:22 GMT
content-length: 50
cache-control: no-cache
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 6 x 5\012- data
Size:   50
Md5:    e4d673a55c5656f19ef81563fb10884c
Sha1:   1f2d8ed221d39329251ad3a6ff1edb20b7219443
Sha256: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
                                        
                                            GET /images/core/emoji/14.0.0/svg/1f539.svg HTTP/1.1 
Host: s.w.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         192.0.77.48
HTTP/2 200 OK
content-type: image/svg+xml
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:22 GMT
content-length: 271
last-modified: Tue, 12 Apr 2022 03:50:59 GMT
x-frame-options: SAMEORIGIN
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
x-nc: HIT arn 1
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size:   271
Md5:    85e5fb9f60873c46d98c8ab4efdf4066
Sha1:   660eb8d3178ebb6de98de7d0b6540688b6c5b913
Sha256: 752fdd9a839060506caa9f1ccffc7cab99f5387e2d05165c49cc5c2bec82831d
                                        
                                            GET /images/core/emoji/14.0.0/svg/231b.svg HTTP/1.1 
Host: s.w.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         192.0.77.48
HTTP/2 200 OK
content-type: image/svg+xml
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:23 GMT
content-length: 688
last-modified: Tue, 12 Apr 2022 03:47:26 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
x-nc: HIT arn 1
x-content-type-options: nosniff
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (688), with no line terminators
Size:   688
Md5:    fcff6ac673eb2d32ef5a49818d9572da
Sha1:   ac8067d1221ae5a34ab656df64836ea0e1cbd06b
Sha256: 044160ca4463e342fa8979dc8ebd9c84c03fb0403d12e606412595637b5723b8
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         216.58.207.206
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Fri, 02 Dec 2022 08:41:08 GMT
expires: Fri, 02 Dec 2022 10:41:08 GMT
cache-control: public, max-age=7200
age: 5535
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   20039
Md5:    47e6f374ca946fddd5b59871b325736c
Sha1:   baa9282efc8785e84d247c3bff518eaa45f101c4
Sha256: 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4656
Cache-Control: max-age=139647
Date: Fri, 02 Dec 2022 10:13:23 GMT
Etag: "63893c12-1d7"
Expires: Sun, 04 Dec 2022 01:00:50 GMT
Last-Modified: Thu, 01 Dec 2022 23:43:14 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://xtc-hair.com
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 162976
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Nov 2022 19:09:57 GMT
expires: Tue, 28 Nov 2023 19:09:57 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 14 Nov 2022 03:01:59 GMT
age: 313406
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (730)
Size:   162976
Md5:    79d18cf4265108d7cecca1bf4ada6109
Sha1:   e51d0285a545381d4c39e9e0292a650ffeeecbb9
Sha256: 59ce7253f371df0833c3f72d4748ef812002b90a49413c56d0ca7c40bb5a0ab6
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /en_US/fbevents.js HTTP/1.1 
Host: connect.facebook.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         157.240.240.1
HTTP/2 200 OK
content-type: application/x-javascript; charset=utf-8
                                        
vary: Accept-Encoding
content-encoding: gzip
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: G5OUxXCa3QsHWRNX8NjEfJBqO5V2ldTlfgm1y2luFF0EgBWZLQqXbesWaUNan4WrPRYxh3H2LDNevb75nibSXw==
priority: u=3,i
content-length: 27340
x-fb-trip-id: 1679558926
date: Fri, 02 Dec 2022 10:13:23 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (64348)
Size:   27340
Md5:    44ecaa3c2a4929a40141edc4540aaf84
Sha1:   f29a573182333b2500d41bfc389d6c5232dfb348
Sha256: 6589fe14578dedd4df678a909afadd7e5bc7f57c7e3e24518a7f5faac7383396
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4656
Cache-Control: max-age=139647
Date: Fri, 02 Dec 2022 10:13:23 GMT
Etag: "63893c12-1d7"
Expires: Sun, 04 Dec 2022 01:00:50 GMT
Last-Modified: Thu, 01 Dec 2022 23:43:14 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-6604786-9&cid=383251903.1669976001&jid=130567892&gjid=143888924&_gid=730747989.1669976001&_u=YEBAAUAAAAAAACAAI~&z=640258286 HTTP/1.1 
Host: stats.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://xtc-hair.com
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         108.177.14.156
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin: https://xtc-hair.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 02 Dec 2022 10:13:23 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  very short file (no magic)
Size:   1
Md5:    c4ca4238a0b923820dcc509a6f75849b
Sha1:   356a192b7913b04c54574d18c28d46e6395428ab
Sha256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.211.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Fri, 02 Dec 2022 10:13:23 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 01 Dec 2022 21:48:03 GMT
expires: Fri, 01 Dec 2023 21:48:03 GMT
cache-control: public, max-age=31536000
age: 44720
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Size:   15344
Md5:    5d4aeb4e5f5ef754e307d7ffaef688bd
Sha1:   06db651cdf354c64a7383ea9c77024ef4fb4cef8
Sha256: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
                                        
                                            GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         142.250.74.35
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 01 Dec 2022 16:40:43 GMT
expires: Fri, 01 Dec 2023 16:40:43 GMT
cache-control: public, max-age=31536000
age: 63160
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Size:   15552
Md5:    285467176f7fe6bb6a9c6873b3dad2cc
Sha1:   ea04e4ff5142ddd69307c183def721a160e0a64e
Sha256: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
                                        
                                            GET /tr/?id=159612091116662&ev=PageView&dl=https%3A%2F%2Fxtc-hair.com%2Ffull-download-edius-pro-6-5-cracked-version-key-and-better%2F&rl=&if=false&ts=1669976001715&sw=1280&sh=1024&v=2.9.89&r=stable&ec=0&o=30&fbp=fb.1.1669976001714.1765892094&it=1669976001459&coo=false&rqm=GET HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         157.240.240.35
HTTP/2 200 OK
content-type: text/plain
                                        
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Fri, 02 Dec 2022 10:13:23 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  gzip compressed data, from Unix\012- data
Size:   85975
Md5:    a1783f550b1c8ecfeec9fee9cdd7acaf
Sha1:   3c4c35c319b9c2d4cbf8117c13c8df5af6ac8802
Sha256: 7d60b493f2f1ae727d78c013921901f84b4b76bf8c04bcc96ee043076dac4515
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
link: <https://xtc-hair.com/wp-json/>; rel="https://api.w.org/"
x-redirect-by: WordPress
location: https://xtc-hair.com/wp-includes/images/w-logo-blue-white-bg.png
content-length: 0
date: Fri, 02 Dec 2022 10:13:23 GMT
server: Apache
X-Firefox-Spdy: h2

                                        
                                            GET /wp-includes/images/w-logo-blue-white-bg.png HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Connection: keep-alive
Cookie: _ga=GA1.2.383251903.1669976001; _gid=GA1.2.730747989.1669976001; _gat_gtag_UA_6604786_9=1; _fbp=fb.1.1669976001714.1765892094
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: image/png
                                        
last-modified: Thu, 11 Jun 2020 03:59:22 GMT
accept-ranges: bytes
content-length: 4119
date: Fri, 02 Dec 2022 10:13:24 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced\012- data
Size:   4119
Md5:    000bf649cc8f6bf27cfb04d1bcdcd3c7
Sha1:   d73d2f6d74ec6cdcbae07955592962e77d8ae814
Sha256: 6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0
                                        
                                            GET /wp-includes/css/dist/block-library/style.min.css?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 30 Nov 2022 17:52:58 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/themes/spacious/genericons/genericons.css?ver=3.3.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /wp-content/themes/spacious/style.css?ver=6.1.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 27 Jul 2022 18:01:39 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /full-download-edius-pro-6-5-cracked-version-key-and-better/ HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
x-pingback: https://xtc-hair.com/xmlrpc.php
link: <https://xtc-hair.com/wp-json/>; rel="https://api.w.org/", <https://xtc-hair.com/wp-json/wp/v2/posts/122608>; rel="alternate"; type="application/json", <https://xtc-hair.com/?p=122608>; rel=shortlink
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:20 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /e-202248.js HTTP/1.1 
Host: stats.wp.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         192.0.76.3
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx
date: Fri, 02 Dec 2022 10:13:22 GMT
vary: Accept-Encoding
etag: W/"62f6b688-3508"
content-encoding: br
expires: Mon, 20 Nov 2023 01:50:03 GMT
cache-control: max-age=31536000
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
x-nc: HIT arn
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 30 Nov 2022 17:52:58 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /wp-content/plugins/jetpack/css/jetpack.css?ver=11.5.1 HTTP/1.1 
Host: xtc-hair.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://xtc-hair.com/full-download-edius-pro-6-5-cracked-version-key-and-better/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         192.185.117.118
HTTP/2 200 OK
content-type: text/css
                                        
last-modified: Wed, 30 Nov 2022 17:52:10 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 02 Dec 2022 10:13:22 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---

Alerts:
  Blocklists:
    - fortinet: Phishing